Edit tour

Windows Analysis Report
7qBBKk0P4l.exe

Overview

General Information

Sample name:	7qBBKk0P4l.exe renamed because original name is a hash value
Original sample name:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470.exe
Analysis ID:	1488122
MD5:	94e7772b2b1bda89b23a2fba0e57742e
SHA1:	2af48b80b7354b4a15eff49af3f3d70d3e5789a4
SHA256:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470
Tags:	exe
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

Connects to many different domains

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7qBBKk0P4l.exe (PID: 5452 cmdline: "C:\Users\user\Desktop\7qBBKk0P4l.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

psjpq2s5tgtsjq0yguk.exe (PID: 2976 cmdline: "C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 3628 cmdline: "C:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 3120 cmdline: C:\hjflhukc\yanidfx.exe MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

xxxniijvj.exe (PID: 1984 cmdline: tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 5676 cmdline: "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

xxxniijvj.exe (PID: 6500 cmdline: tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 4584 cmdline: "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

svchost.exe (PID: 2688 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 2688, ProcessName: svchost.exe

Snort Signatures

Suricata Signatures

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses - Source IP: 1.1.1.1 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:38:07.114356+0200
SID:	2018316
Source Port:	53
Destination Port:	56830
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 188.225.40.227

Timestamp:	2024-08-05T16:38:17.877671+0200
SID:	2815568
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.246.200.160 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:36:45.925960+0200
SID:	2037771
Source Port:	80
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses - Source IP: 1.1.1.1 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:36:42.598232+0200
SID:	2018316
Source Port:	53
Destination Port:	56810
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 15.197.192.55

Timestamp:	2024-08-05T16:36:48.099598+0200
SID:	2815568
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 54.244.188.177

Timestamp:	2024-08-05T16:36:56.538931+0200
SID:	2815568
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 35.164.78.200

Timestamp:	2024-08-05T16:36:43.677692+0200
SID:	2815568
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 54.244.188.177 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:36:56.545343+0200
SID:	2037771
Source Port:	80
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) - Source IP: 1.1.1.1 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:36:41.235057+0200
SID:	2811542
Source Port:	53
Destination Port:	59367
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 35.164.78.200

Timestamp:	2024-08-05T16:38:00.887942+0200
SID:	2815568
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 34.246.200.160

Timestamp:	2024-08-05T16:38:02.779063+0200
SID:	2815568
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 54.244.188.177

Timestamp:	2024-08-05T16:38:13.014870+0200
SID:	2815568
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 81.169.145.88

Timestamp:	2024-08-05T16:38:15.755898+0200
SID:	2815568
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 3.33.130.190

Timestamp:	2024-08-05T16:37:58.771271+0200
SID:	2815568
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 85.13.130.3

Timestamp:	2024-08-05T16:38:08.756166+0200
SID:	2815568
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 81.169.145.88

Timestamp:	2024-08-05T16:36:58.610225+0200
SID:	2815568
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 3.33.130.190

Timestamp:	2024-08-05T16:36:41.217947+0200
SID:	2815568
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 35.164.78.200 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:38:00.892788+0200
SID:	2037771
Source Port:	80
Destination Port:	49728
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) - Source IP: 1.1.1.1 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:38:13.043633+0200
SID:	2811542
Source Port:	53
Destination Port:	53468
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 35.164.78.200 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:36:43.682520+0200
SID:	2037771
Source Port:	80
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 170.187.200.48

Timestamp:	2024-08-05T16:38:10.787983+0200
SID:	2815568
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7qBBKk0P4l.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\hjflhukc\xxxniijvj.exe	Avira: detection malicious, Label: HEUR/AGEN.1318579
Source: C:\hjflhukc\yanidfx.exe	Avira: detection malicious, Label: HEUR/AGEN.1318579
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Avira: detection malicious, Label: HEUR/AGEN.1318579

Multi AV Scanner detection for dropped file

Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	ReversingLabs: Detection: 92%
Source: C:\hjflhukc\xxxniijvj.exe	ReversingLabs: Detection: 92%
Source: C:\hjflhukc\yanidfx.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: 7qBBKk0P4l.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\hjflhukc\xxxniijvj.exe	Joe Sandbox ML: detected
Source: C:\hjflhukc\yanidfx.exe	Joe Sandbox ML: detected
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7qBBKk0P4l.exe

Joe Sandbox ML: detected

Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005FBECE GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	2_2_005FBECE
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0060AE3B CryptAcquireContextA,	2_2_0060AE3B
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0074BECE GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	3_2_0074BECE
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075AE3B CryptAcquireContextA,	3_2_0075AE3B

Source: 7qBBKk0P4l.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AE5C39
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_005F5C39
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00745C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00745C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00CE5C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00045C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00045C39

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: smokesystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadylaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadybranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womannorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadysystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemansystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencequarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencereceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokegeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokequarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experienceconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summersystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partysystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partybranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencefriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightnorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightgeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experienceneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadytrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fighttrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokebelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencebelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencebranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokenorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokehonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womantrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: watertrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadybelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencesystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knowntrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokereceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summertrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partytrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fighthonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: begintrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smoketrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemantrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partynorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womangeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followtrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womaninclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencetrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughttrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughthonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencelaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencehonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshtrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencefancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womansystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokebranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyneither.net replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 170

Source: global traffic

DNS traffic detected: number of DNS queries: 170

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net

Source: Joe Sandbox View	IP Address: 188.225.40.227 188.225.40.227
Source: Joe Sandbox View	IP Address: 34.246.200.160 34.246.200.160

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00AF8695 socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,closesocket,

0_2_00AF8695

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net

Source: global traffic	DNS traffic detected: DNS query: smokeclear.net
Source: global traffic	DNS traffic detected: DNS query: womangeneral.net
Source: global traffic	DNS traffic detected: DNS query: smokegeneral.net
Source: global traffic	DNS traffic detected: DNS query: womaninclude.net
Source: global traffic	DNS traffic detected: DNS query: smokeinclude.net
Source: global traffic	DNS traffic detected: DNS query: womannorth.net
Source: global traffic	DNS traffic detected: DNS query: smokenorth.net
Source: global traffic	DNS traffic detected: DNS query: partyclear.net
Source: global traffic	DNS traffic detected: DNS query: fightclear.net
Source: global traffic	DNS traffic detected: DNS query: partygeneral.net
Source: global traffic	DNS traffic detected: DNS query: fightgeneral.net
Source: global traffic	DNS traffic detected: DNS query: partyinclude.net
Source: global traffic	DNS traffic detected: DNS query: fightinclude.net
Source: global traffic	DNS traffic detected: DNS query: partynorth.net
Source: global traffic	DNS traffic detected: DNS query: fightnorth.net
Source: global traffic	DNS traffic detected: DNS query: freshbranch.net
Source: global traffic	DNS traffic detected: DNS query: experiencebranch.net
Source: global traffic	DNS traffic detected: DNS query: freshbelieve.net
Source: global traffic	DNS traffic detected: DNS query: experiencebelieve.net
Source: global traffic	DNS traffic detected: DNS query: freshreceive.net
Source: global traffic	DNS traffic detected: DNS query: experiencereceive.net
Source: global traffic	DNS traffic detected: DNS query: freshquarter.net
Source: global traffic	DNS traffic detected: DNS query: experiencequarter.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanbranch.net
Source: global traffic	DNS traffic detected: DNS query: alreadybranch.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanbelieve.net
Source: global traffic	DNS traffic detected: DNS query: alreadybelieve.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanreceive.net
Source: global traffic	DNS traffic detected: DNS query: alreadyreceive.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanquarter.net
Source: global traffic	DNS traffic detected: DNS query: alreadyquarter.net
Source: global traffic	DNS traffic detected: DNS query: followbranch.net
Source: global traffic	DNS traffic detected: DNS query: memberbranch.net
Source: global traffic	DNS traffic detected: DNS query: followbelieve.net
Source: global traffic	DNS traffic detected: DNS query: memberbelieve.net
Source: global traffic	DNS traffic detected: DNS query: followreceive.net
Source: global traffic	DNS traffic detected: DNS query: memberreceive.net
Source: global traffic	DNS traffic detected: DNS query: followquarter.net
Source: global traffic	DNS traffic detected: DNS query: memberquarter.net
Source: global traffic	DNS traffic detected: DNS query: beginbranch.net
Source: global traffic	DNS traffic detected: DNS query: knownbranch.net
Source: global traffic	DNS traffic detected: DNS query: beginbelieve.net
Source: global traffic	DNS traffic detected: DNS query: knownbelieve.net
Source: global traffic	DNS traffic detected: DNS query: beginreceive.net
Source: global traffic	DNS traffic detected: DNS query: knownreceive.net
Source: global traffic	DNS traffic detected: DNS query: beginquarter.net
Source: global traffic	DNS traffic detected: DNS query: knownquarter.net
Source: global traffic	DNS traffic detected: DNS query: summerbranch.net
Source: global traffic	DNS traffic detected: DNS query: crowdbranch.net
Source: global traffic	DNS traffic detected: DNS query: summerbelieve.net
Source: global traffic	DNS traffic detected: DNS query: crowdbelieve.net
Source: global traffic	DNS traffic detected: DNS query: summerreceive.net
Source: global traffic	DNS traffic detected: DNS query: crowdreceive.net
Source: global traffic	DNS traffic detected: DNS query: summerquarter.net
Source: global traffic	DNS traffic detected: DNS query: crowdquarter.net
Source: global traffic	DNS traffic detected: DNS query: thoughtbranch.net
Source: global traffic	DNS traffic detected: DNS query: waterbranch.net
Source: global traffic	DNS traffic detected: DNS query: thoughtbelieve.net
Source: global traffic	DNS traffic detected: DNS query: waterbelieve.net
Source: global traffic	DNS traffic detected: DNS query: thoughtreceive.net
Source: global traffic	DNS traffic detected: DNS query: waterreceive.net
Source: global traffic	DNS traffic detected: DNS query: thoughtquarter.net
Source: global traffic	DNS traffic detected: DNS query: waterquarter.net
Source: global traffic	DNS traffic detected: DNS query: womanbranch.net
Source: global traffic	DNS traffic detected: DNS query: smokebranch.net
Source: global traffic	DNS traffic detected: DNS query: womanbelieve.net
Source: global traffic	DNS traffic detected: DNS query: smokebelieve.net
Source: global traffic	DNS traffic detected: DNS query: womanreceive.net
Source: global traffic	DNS traffic detected: DNS query: smokereceive.net
Source: global traffic	DNS traffic detected: DNS query: womanquarter.net
Source: global traffic	DNS traffic detected: DNS query: smokequarter.net
Source: global traffic	DNS traffic detected: DNS query: partybranch.net
Source: global traffic	DNS traffic detected: DNS query: fightbranch.net
Source: global traffic	DNS traffic detected: DNS query: partybelieve.net
Source: global traffic	DNS traffic detected: DNS query: fightbelieve.net
Source: global traffic	DNS traffic detected: DNS query: partyreceive.net
Source: global traffic	DNS traffic detected: DNS query: fightreceive.net
Source: global traffic	DNS traffic detected: DNS query: partyquarter.net
Source: global traffic	DNS traffic detected: DNS query: fightquarter.net
Source: global traffic	DNS traffic detected: DNS query: freshhonor.net
Source: global traffic	DNS traffic detected: DNS query: experiencehonor.net
Source: global traffic	DNS traffic detected: DNS query: freshneither.net
Source: global traffic	DNS traffic detected: DNS query: experienceneither.net
Source: global traffic	DNS traffic detected: DNS query: freshsystem.net
Source: global traffic	DNS traffic detected: DNS query: experiencesystem.net
Source: global traffic	DNS traffic detected: DNS query: freshtrust.net
Source: global traffic	DNS traffic detected: DNS query: experiencetrust.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanhonor.net
Source: global traffic	DNS traffic detected: DNS query: alreadyhonor.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanneither.net
Source: global traffic	DNS traffic detected: DNS query: alreadyneither.net
Source: global traffic	DNS traffic detected: DNS query: gentlemansystem.net
Source: global traffic	DNS traffic detected: DNS query: alreadysystem.net
Source: global traffic	DNS traffic detected: DNS query: gentlemantrust.net
Source: global traffic	DNS traffic detected: DNS query: alreadytrust.net
Source: global traffic	DNS traffic detected: DNS query: followhonor.net
Source: global traffic	DNS traffic detected: DNS query: memberhonor.net
Source: global traffic	DNS traffic detected: DNS query: followneither.net
Source: global traffic	DNS traffic detected: DNS query: memberneither.net
Source: global traffic	DNS traffic detected: DNS query: followsystem.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 05 Aug 2024 14:36:46 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 14:36:53 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 14:36:58 GMTServer: Apache/2.4.61 (Unix)Content-Length: 196Content-Type: text/html; charset=iso-8859-1Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 05 Aug 2024 14:38:03 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 05 Aug 2024 14:38:03 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 14:38:10 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 14:38:15 GMTServer: Apache/2.4.61 (Unix)Content-Length: 196Content-Type: text/html; charset=iso-8859-1Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fasthosts.co.uk/
Source: yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2205368302.000000000194D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239801424.0000000001CFD000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://followfriend.net/index.php
Source: yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2205368302.000000000194D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239801424.0000000001CFD000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par
Source: yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/domain-names/search/?domain=$
Source: yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_
Source: yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-199510482-1

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	File created: C:\Windows\hjflhukc\	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

File deleted: C:\Windows\hjflhukc\hhziccmdjsti

Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE88A8	0_2_00AE88A8
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF111E	0_2_00AF111E
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AFFF2A	0_2_00AFFF2A
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE60AD	0_2_00AE60AD
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF0CE6	0_2_00AF0CE6
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF70E6	0_2_00AF70E6
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B024D3	0_2_00B024D3
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B084D7	0_2_00B084D7
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B0D831	0_2_00B0D831
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B03025	0_2_00B03025
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AFA805	0_2_00AFA805
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE69A8	0_2_00AE69A8
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE11B7	0_2_00AE11B7
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B07DC0	0_2_00B07DC0
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AEA928	0_2_00AEA928
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE9903	0_2_00AE9903
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF0113	0_2_00AF0113
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF8695	0_2_00AF8695
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE46CF	0_2_00AE46CF
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF1636	0_2_00AF1636
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF5FBA	0_2_00AF5FBA
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AECFBB	0_2_00AECFBB
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AFB3DB	0_2_00AFB3DB
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B0DFCC	0_2_00B0DFCC
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF9F24	0_2_00AF9F24
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B05F1E	0_2_00B05F1E
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF571F	0_2_00AF571F
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE774C	0_2_00AE774C
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_006184D7	2_2_006184D7
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F88A8	2_2_005F88A8
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0060FF2A	2_2_0060FF2A
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0060B3DB	2_2_0060B3DB
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00613025	2_2_00613025
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0061D831	2_2_0061D831
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0060A805	2_2_0060A805
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00600CE6	2_2_00600CE6
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_006070E6	2_2_006070E6
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_006124D3	2_2_006124D3
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F60AD	2_2_005F60AD
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F9903	2_2_005F9903
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00600113	2_2_00600113
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005FA928	2_2_005FA928
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0060111E	2_2_0060111E
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00617DC0	2_2_00617DC0
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F11B7	2_2_005F11B7
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F69A8	2_2_005F69A8
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00601636	2_2_00601636
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F46CF	2_2_005F46CF
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00608695	2_2_00608695
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F774C	2_2_005F774C
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00609F24	2_2_00609F24
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00615F1E	2_2_00615F1E
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0060571F	2_2_0060571F
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_0061DFCC	2_2_0061DFCC
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00605FBA	2_2_00605FBA
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005FCFBB	2_2_005FCFBB
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007684D7	3_2_007684D7
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007624D3	3_2_007624D3
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007488A8	3_2_007488A8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00758695	3_2_00758695
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075FF2A	3_2_0075FF2A
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075571F	3_2_0075571F
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075B3DB	3_2_0075B3DB
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0076D831	3_2_0076D831
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00763025	3_2_00763025
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075A805	3_2_0075A805
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007570E6	3_2_007570E6
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00750CE6	3_2_00750CE6
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007460AD	3_2_007460AD
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0074A928	3_2_0074A928
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00750113	3_2_00750113
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075111E	3_2_0075111E
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00749903	3_2_00749903
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00767DC0	3_2_00767DC0
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007411B7	3_2_007411B7
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007469A8	3_2_007469A8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007679A8	3_2_007679A8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00751636	3_2_00751636
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007446CF	3_2_007446CF
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0074774C	3_2_0074774C
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00759F24	3_2_00759F24
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00765F1E	3_2_00765F1E
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0076DFCC	3_2_0076DFCC
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0074CFBB	3_2_0074CFBB
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00755FBA	3_2_00755FBA
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0075A790	3_2_0075A790
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE88A8	4_2_00CE88A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF571F	4_2_00CF571F
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CFFF2A	4_2_00CFFF2A
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D024D3	4_2_00D024D3
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D084D7	4_2_00D084D7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF0CE6	4_2_00CF0CE6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF70E6	4_2_00CF70E6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE60AD	4_2_00CE60AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CFA805	4_2_00CFA805
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D0D831	4_2_00D0D831
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D03025	4_2_00D03025
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D07DC0	4_2_00D07DC0
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE69A8	4_2_00CE69A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE11B7	4_2_00CE11B7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE9903	4_2_00CE9903
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF111E	4_2_00CF111E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF0113	4_2_00CF0113
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CEA928	4_2_00CEA928
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE46CF	4_2_00CE46CF
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF8695	4_2_00CF8695
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF1636	4_2_00CF1636
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CFB3DB	4_2_00CFB3DB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D0DFCC	4_2_00D0DFCC
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF5FBA	4_2_00CF5FBA
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CECFBB	4_2_00CECFBB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE774C	4_2_00CE774C
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D05F1E	4_2_00D05F1E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF9F24	4_2_00CF9F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000488A8	11_2_000488A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0005571F	11_2_0005571F
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0005FF20	11_2_0005FF20
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0005A805	11_2_0005A805
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00063025	11_2_00063025
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0006D831	11_2_0006D831
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000460AD	11_2_000460AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000684D7	11_2_000684D7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000624D3	11_2_000624D3
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00050CE6	11_2_00050CE6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000570E6	11_2_000570E6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00049903	11_2_00049903
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00050113	11_2_00050113
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0005111E	11_2_0005111E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0004A928	11_2_0004A928
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000469A8	11_2_000469A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000411B7	11_2_000411B7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00067DC0	11_2_00067DC0
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00051636	11_2_00051636
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00058695	11_2_00058695
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000446CF	11_2_000446CF
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00065F1E	11_2_00065F1E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00059F24	11_2_00059F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0004774C	11_2_0004774C
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00055FBA	11_2_00055FBA
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0004CFBB	11_2_0004CFBB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0006DFCC	11_2_0006DFCC
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_0005B3DB	11_2_0005B3DB

Source: 7qBBKk0P4l.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7qBBKk0P4l.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: psjpq2s5tgtsjq0yguk.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yanidfx.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xxxniijvj.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal88.troj.winEXE@15/5@326/12

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	0_2_00B035AD
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	2_2_006135AD
Source: C:\hjflhukc\yanidfx.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	3_2_007635AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	4_2_00D035AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	11_2_000635AD

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00AF0806 CreateToolhelp32Snapshot,Process32First,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

0_2_00AF0806

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00B074E8 StartServiceCtrlDispatcherA,

0_2_00B074E8

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00B074E8 StartServiceCtrlDispatcherA,	0_2_00B074E8
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_006174E8 StartServiceCtrlDispatcherA,	2_2_006174E8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007674E8 StartServiceCtrlDispatcherA,	3_2_007674E8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00D074E8 StartServiceCtrlDispatcherA,	4_2_00D074E8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_000674E8 StartServiceCtrlDispatcherA,	11_2_000674E8

Source: C:\hjflhukc\yanidfx.exe

Mutant created: NULL

Source: 7qBBKk0P4l.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7qBBKk0P4l.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

File read: C:\Users\user\Desktop\7qBBKk0P4l.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7qBBKk0P4l.exe "C:\Users\user\Desktop\7qBBKk0P4l.exe"
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Process created: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe "C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe"
Source: unknown	Process created: C:\hjflhukc\yanidfx.exe C:\hjflhukc\yanidfx.exe
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Process created: C:\hjflhukc\yanidfx.exe "C:\hjflhukc\yanidfx.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\hjflhukc\xxxniijvj.exe	Process created: C:\hjflhukc\yanidfx.exe "c:\hjflhukc\yanidfx.exe"
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Source: C:\hjflhukc\xxxniijvj.exe	Process created: C:\hjflhukc\yanidfx.exe "c:\hjflhukc\yanidfx.exe"
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Process created: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe "C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe"	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Process created: C:\hjflhukc\yanidfx.exe "C:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Process created: C:\hjflhukc\yanidfx.exe "c:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Process created: C:\hjflhukc\yanidfx.exe "c:\hjflhukc\yanidfx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00B084D7 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_00B084D7

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AF2C94 push edi; iretd	0_2_00AF2C95
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_00602C94 push edi; iretd	2_2_00602C95
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00752C94 push edi; iretd	3_2_00752C95
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CF2C94 push edi; iretd	4_2_00CF2C95
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00052C94 push edi; iretd	11_2_00052C95

Source: 7qBBKk0P4l.exe	Static PE information: section name: .text entropy: 6.839663016682375
Source: psjpq2s5tgtsjq0yguk.exe.0.dr	Static PE information: section name: .text entropy: 6.839663016682375
Source: yanidfx.exe.2.dr	Static PE information: section name: .text entropy: 6.839663016682375
Source: xxxniijvj.exe.3.dr	Static PE information: section name: .text entropy: 6.839663016682375

Source: C:\hjflhukc\yanidfx.exe	File created: C:\hjflhukc\xxxniijvj.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	File created: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Jump to dropped file
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	File created: C:\hjflhukc\yanidfx.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00B074E8 StartServiceCtrlDispatcherA,

0_2_00B074E8

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	0_2_00AF9F24
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	2_2_00609F24
Source: C:\hjflhukc\yanidfx.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	3_2_00759F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	4_2_00CF9F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	11_2_00059F24

Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,RtlAllocateHeap,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		2_2_006184D7
Source: C:\hjflhukc\yanidfx.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,RtlAllocateHeap,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		3_2_007684D7

Source: C:\hjflhukc\xxxniijvj.exe	Window / User API: threadDelayed 541	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Window / User API: threadDelayed 1334	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Window / User API: threadDelayed 666	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Window / User API: threadDelayed 1208	Jump to behavior

Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_2-9436
Source: C:\hjflhukc\xxxniijvj.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_4-9407
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-8680

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-7742
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_2-8500
Source: C:\hjflhukc\xxxniijvj.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_4-8494
Source: C:\hjflhukc\yanidfx.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_3-8884

Source: C:\hjflhukc\yanidfx.exe TID: 4128	Thread sleep time: -31108s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 2884	Thread sleep count: 541 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 2884	Thread sleep time: -541000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 2884	Thread sleep count: 1334 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 2884	Thread sleep time: -1334000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe TID: 5672	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe TID: 5952	Thread sleep time: -31108s >= -30000s	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe TID: 5672	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 6996	Thread sleep count: 666 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 6996	Thread sleep time: -666000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 6996	Thread sleep count: 1208 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 6996	Thread sleep time: -1208000s >= -30000s	Jump to behavior

Source: C:\hjflhukc\yanidfx.exe	Last function: Thread delayed
Source: C:\hjflhukc\yanidfx.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 0_2_00AE5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AE5C39
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	Code function: 2_2_005F5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_005F5C39
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00745C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00745C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00CE5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00CE5C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00045C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00045C39

Source: C:\hjflhukc\yanidfx.exe	Thread delayed: delay time: 50000			Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Thread delayed: delay time: 50000			Jump to behavior

Source: psjpq2s5tgtsjq0yguk.exe, 00000002.00000002.1469244546.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	API call chain: ExitProcess graph end node	graph_0-8299
Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	API call chain: ExitProcess graph end node	graph_2-8920
Source: C:\hjflhukc\yanidfx.exe	API call chain: ExitProcess graph end node	graph_3-8590
Source: C:\hjflhukc\yanidfx.exe	API call chain: ExitProcess graph end node	graph_3-9196
Source: C:\hjflhukc\xxxniijvj.exe	API call chain: ExitProcess graph end node	graph_4-9106
Source: C:\hjflhukc\xxxniijvj.exe	API call chain: ExitProcess graph end node	graph_11-8845

Source: C:\hjflhukc\yanidfx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00B084D7 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_00B084D7

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00AEDE5A GetProcessHeap,RtlFreeHeap,

0_2_00AEDE5A

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00AEE769 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00AEE769

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00AE3E8C GetSystemTimeAsFileTime,__aulldiv,

0_2_00AE3E8C

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 0_2_00AE88A8 GetVersionExA,CreateDirectoryA,DeleteFileA,RemoveDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,GetTempPathA,CreateDirectoryA,GetTempPathA,SetFileAttributesA,

0_2_00AE88A8

Source: C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	4 Windows Service	4 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	4 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
7qBBKk0P4l.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
7qBBKk0P4l.exe	100%	Avira	HEUR/AGEN.1318579
7qBBKk0P4l.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\hjflhukc\xxxniijvj.exe	100%	Avira	HEUR/AGEN.1318579
C:\hjflhukc\yanidfx.exe	100%	Avira	HEUR/AGEN.1318579
C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	100%	Avira	HEUR/AGEN.1318579
C:\hjflhukc\xxxniijvj.exe	100%	Joe Sandbox ML
C:\hjflhukc\yanidfx.exe	100%	Joe Sandbox ML
C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	100%	Joe Sandbox ML
C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\hjflhukc\xxxniijvj.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\hjflhukc\yanidfx.exe	92%	ReversingLabs	Win32.Spyware.Nivdort

Source	Detection	Scanner	Label
https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par	0%	Avira URL Cloud	safe
https://fasthosts.co.uk/	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_	0%	Avira URL Cloud	safe
https://followfriend.net/index.php	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/domain-names/search/?domain=$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
crowdtrust.net	170.187.200.48	true	false	unknown
watersystem.net	64.190.63.222	true	false	unknown
thoughtsystem.net	213.171.195.105	true	false	unknown
membersystem.net	85.13.130.3	true	false	unknown
partygeneral.net	3.33.130.190	true	false	unknown
womanbelieve.net	15.197.142.173	true	false	unknown
womanhonor.net	54.244.188.177	true	false	unknown
membertrust.net	3.33.130.190	true	false	unknown
memberreceive.net	35.164.78.200	true	false	unknown
followfriend.net	188.225.40.227	true	false	unknown
partybelieve.net	15.197.192.55	true	false	unknown
freshfancy.net	81.169.145.88	true	false	unknown
alreadyfriend.net	15.197.192.55	true	false	unknown
thoughtbranch.net	34.246.200.160	true	false	unknown
beginhonor.net	unknown	unknown	true	unknown
memberlaughter.net	unknown	unknown	true	unknown
freshneither.net	unknown	unknown	true	unknown
thoughtneither.net	unknown	unknown	true	unknown
experiencefancy.net	unknown	unknown	true	unknown
followconsider.net	unknown	unknown	true	unknown
alreadyhonor.net	unknown	unknown	true	unknown
fighttrust.net	unknown	unknown	true	unknown
knownsystem.net	unknown	unknown	true	unknown
gentlemanhonor.net	unknown	unknown	true	unknown
memberfriend.net	unknown	unknown	true	unknown
freshtrust.net	unknown	unknown	true	unknown
experiencetrust.net	unknown	unknown	true	unknown
alreadybelieve.net	unknown	unknown	true	unknown
partyclear.net	unknown	unknown	true	unknown
waterquarter.net	unknown	unknown	true	unknown
fightbranch.net	unknown	unknown	true	unknown
knownlaughter.net	unknown	unknown	true	unknown
followtrust.net	unknown	unknown	true	unknown
experiencebelieve.net	unknown	unknown	true	unknown
summerhonor.net	unknown	unknown	true	unknown
thoughttrust.net	unknown	unknown	true	unknown
freshhonor.net	unknown	unknown	true	unknown
followfancy.net	unknown	unknown	true	unknown
freshfriend.net	unknown	unknown	true	unknown
freshconsider.net	unknown	unknown	true	unknown
summerquarter.net	unknown	unknown	true	unknown
gentlemantrust.net	unknown	unknown	true	unknown
fightinclude.net	unknown	unknown	true	unknown
gentlemanlaughter.net	unknown	unknown	true	unknown
memberbelieve.net	unknown	unknown	true	unknown
alreadylaughter.net	unknown	unknown	true	unknown
summerreceive.net	unknown	unknown	true	unknown
smokequarter.net	unknown	unknown	true	unknown
experiencesystem.net	unknown	unknown	true	unknown
thoughthonor.net	unknown	unknown	true	unknown
followbelieve.net	unknown	unknown	true	unknown
knowntrust.net	unknown	unknown	true	unknown
partybranch.net	unknown	unknown	true	unknown
crowdneither.net	unknown	unknown	true	unknown
womaninclude.net	unknown	unknown	true	unknown
smokebelieve.net	unknown	unknown	true	unknown
fightnorth.net	unknown	unknown	true	unknown
gentlemanneither.net	unknown	unknown	true	unknown
followquarter.net	unknown	unknown	true	unknown
knownhonor.net	unknown	unknown	true	unknown
womantrust.net	unknown	unknown	true	unknown
memberquarter.net	unknown	unknown	true	unknown
experiencefriend.net	unknown	unknown	true	unknown
waterbranch.net	unknown	unknown	true	unknown
smoketrust.net	unknown	unknown	true	unknown
gentlemanreceive.net	unknown	unknown	true	unknown
fightsystem.net	unknown	unknown	true	unknown
memberfancy.net	unknown	unknown	true	unknown
crowdhonor.net	unknown	unknown	true	unknown
summerbelieve.net	unknown	unknown	true	unknown
womanbranch.net	unknown	unknown	true	unknown
crowdbranch.net	unknown	unknown	true	unknown
beginbranch.net	unknown	unknown	true	unknown
experiencehonor.net	unknown	unknown	true	unknown
waterreceive.net	unknown	unknown	true	unknown
gentlemansystem.net	unknown	unknown	true	unknown
crowdsystem.net	unknown	unknown	true	unknown
knownbelieve.net	unknown	unknown	true	unknown
knownquarter.net	unknown	unknown	true	unknown
beginsystem.net	unknown	unknown	true	unknown
followsystem.net	unknown	unknown	true	unknown
crowdreceive.net	unknown	unknown	true	unknown
alreadyquarter.net	unknown	unknown	true	unknown
beginquarter.net	unknown	unknown	true	unknown
freshbelieve.net	unknown	unknown	true	unknown
alreadyconsider.net	unknown	unknown	true	unknown
alreadytrust.net	unknown	unknown	true	unknown
freshquarter.net	unknown	unknown	true	unknown
gentlemanfriend.net	unknown	unknown	true	unknown
beginbelieve.net	unknown	unknown	true	unknown
memberhonor.net	unknown	unknown	true	unknown
summersystem.net	unknown	unknown	true	unknown
partyquarter.net	unknown	unknown	true	unknown
alreadyfancy.net	unknown	unknown	true	unknown
fightneither.net	unknown	unknown	true	unknown
alreadybranch.net	unknown	unknown	true	unknown
partynorth.net	unknown	unknown	true	unknown
womangeneral.net	unknown	unknown	true	unknown
thoughtreceive.net	unknown	unknown	true	unknown
smokegeneral.net	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fasthosts.co.uk/	yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/domain-names/search/?domain=$	yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://followfriend.net/index.php	yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2205368302.000000000194D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239801424.0000000001CFD000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_	yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par	yanidfx.exe, 00000003.00000002.2205282054.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2205368302.000000000194D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239801424.0000000001CFD000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 0000000A.00000002.3239685017.0000000001207000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.13.130.3	membersystem.net	Germany	34788	NMM-ASD-02742FriedersdorfHauptstrasse68DE	false
188.225.40.227	followfriend.net	Russian Federation	9123	TIMEWEB-ASRU	false
34.246.200.160	thoughtbranch.net	United States	16509	AMAZON-02US	false
170.187.200.48	crowdtrust.net	United States	7018	ATT-INTERNET4US	false
35.164.78.200	memberreceive.net	United States	16509	AMAZON-02US	false
15.197.142.173	womanbelieve.net	United States	7430	TANDEMUS	false
54.244.188.177	womanhonor.net	United States	16509	AMAZON-02US	false
64.190.63.222	watersystem.net	United States	11696	NBS11696US	false
15.197.192.55	partybelieve.net	United States	7430	TANDEMUS	false
3.33.130.190	partygeneral.net	United States	8987	AMAZONEXPANSIONGB	false
213.171.195.105	thoughtsystem.net	United Kingdom	8560	ONEANDONE-ASBrauerstrasse48DE	false
81.169.145.88	freshfancy.net	Germany	6724	STRATOSTRATOAGDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488122
Start date and time:	2024-08-05 16:35:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7qBBKk0P4l.exe renamed because original name is a hash value
Original Sample Name:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470.exe
Detection:	MAL
Classification:	mal88.troj.winEXE@15/5@326/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 75 Number of non-executed functions: 81
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 7qBBKk0P4l.exe

Simulations

Behavior and APIs

Time	Type	Description
10:37:10	API Interceptor	3687x Sleep call for process: xxxniijvj.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.13.130.3	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
188.225.40.227	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	followfriend.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	followfriend.net/index.php
	BeR96suzTx.exe	Get hash	malicious	FormBook	Browse	www.skazhiraku.net/itq4/?ATvHA=k2MpXHpX2FlDSbL&m8=xx/ELnNnKvtlLUNVhX4h3nTX7+vGZrU3iKsqjiSQXnXFY1tr2Fuuzh2bLYvRiJP5MpAf
	Rh3zHXGC0W.exe	Get hash	malicious	FormBook	Browse	www.ikra-prem.space/g8kn/?3f=SObGRIQc2SXqBOlWxSNvpO1BE/+cxQu6skH9Iz/5ZN4shibJkSmH+F/+6dh/KvA+GdhZXNtYOg==&s2J=v6Ah24bh4tF
	doc88.exe	Get hash	malicious	FormBook	Browse	www.skazhiraku.net/itq4/?BJ=xx/ELnNnKvtlLUNVhX4h3nTX7+vGZrU3iKsqjiSQXnXFY1tr2Fuuzh2bLbPBtofBSMpY&k6Apv=4hB0VF
	p6le0wM39E.exe	Get hash	malicious	DCRat	Browse	cq80904.tmweb.ru/vmHttpdefaultDb.php?K5Glm1IjUwWQCq0Uioy42v=MLZsFTiDn8Em9rir7K7wImpq3&EXQnpxYJ4aMICQvs=R7D0m961u58njgszmOLxASR&0xIfyHrB=3XszmcYUw52afU&3fe0eef725958b7929a02603a5aa73a2=f84fad6cd29a3006db8b86eab6e3e434&36f380f5a045f0456c7866159c7edf74=AZ4YzM3YjZzgDNxkzM5UzMhNTNmVTNhNjN0MmZ4EmN4gzYmVjN4kTZ&K5Glm1IjUwWQCq0Uioy42v=MLZsFTiDn8Em9rir7K7wImpq3&EXQnpxYJ4aMICQvs=R7D0m961u58njgszmOLxASR&0xIfyHrB=3XszmcYUw52afU
	UYAfvxRha7.exe	Get hash	malicious	DCRat	Browse	cq80904.tmweb.ru/vmHttpdefaultDb.php?wNx8559dK63E8kRo7N3gYQ=50VYeNDsGBfOUR3suNfn4yWU&3fe0eef725958b7929a02603a5aa73a2=f84fad6cd29a3006db8b86eab6e3e434&36f380f5a045f0456c7866159c7edf74=AZ1MGNjVWZkZTMmRGOmRjNiZWMlNzYiNGZwEmY2UjNlRGZyMmZyQWM&wNx8559dK63E8kRo7N3gYQ=50VYeNDsGBfOUR3suNfn4yWU
34.246.200.160	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	7sAylAXBOb.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	7sAylAXBOb.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	5a5O0c0oJP.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	5a5O0c0oJP.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	Jla3M8Fe16.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
watersystem.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
crowdtrust.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
thoughtsystem.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
partygeneral.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
membersystem.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	View Invoice#98783859 Statement for dpo.lu.htm	Get hash	malicious	HTMLPhisher	Browse	13.32.27.44
	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	13.143.18.150
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	69.236.41.25
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	199.186.2.28
	botx.mips.elf	Get hash	malicious	Mirai	Browse	75.56.221.43
TIMEWEB-ASRU	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	188.225.40.227
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	188.225.40.227
	Runtime Broker.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	r6KYedz4VQ.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	Gz3zPqMdtn.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	cnGgzU2rkd.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	https://diigo.com/0wzrly?ID=QtERFQmXrhNlWxfeW9PbYZfS3+Email=ambre.boyon@gerflor.com	Get hash	malicious	Unknown	Browse	188.225.39.170
	5F6Ny9UaKt.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	LisectAVT_2403002C_62.dll	Get hash	malicious	Emotet	Browse	188.225.32.231
NMM-ASD-02742FriedersdorfHauptstrasse68DE	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	LisectAVT_2403002A_76.exe	Get hash	malicious	AgentTesla	Browse	85.13.147.213
	hNX3ktCRra.elf	Get hash	malicious	Unknown	Browse	85.13.140.189
	Fzfee1Lgc2.elf	Get hash	malicious	Unknown	Browse	85.13.155.154
	Yb6ztdvQaB.elf	Get hash	malicious	Unknown	Browse	85.13.132.87
	SLL8zVmaGj.elf	Get hash	malicious	Unknown	Browse	85.13.163.148
AMAZON-02US	826bGtzo6j.exe	Get hash	malicious	Unknown	Browse	54.231.235.128
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	Exv453QQIX.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	OneDriveSetup.exe	Get hash	malicious	ZTrat	Browse	3.126.224.214
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	http://verizonwireless-employmentvalidation.com	Get hash	malicious	Unknown	Browse	3.124.93.206
	UjCrfOAkJJiZyZh.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	75.2.115.196

Process:	C:\Users\user\Desktop\7qBBKk0P4l.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:o+k:op
MD5:	869F9B7357D5489D5FE37B208940AFD8
SHA1:	8D4C9419F43D41066C40C67ED43F63A268A7E7AC
SHA-256:	DEE53FC307F455BF9E72689A4472B6E5252C6B36B848C8F531DAD9714A8D3F80
SHA-512:	9B7E12978891487D2BD31DCF0BCF02CFC74331AEBA1372AE9B0DA3B4BD7B1B177F25FD4A9E798D48A7F7C569409647FD1D975C3E4D12631B0953A50BDF71C75D
Malicious:	false
Reputation:	low
Preview:	.RkQ.

C:\hjflhukc\hhziccmdjsti

Download File

Process:	C:\Users\user\Desktop\7qBBKk0P4l.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:o+k:op
MD5:	869F9B7357D5489D5FE37B208940AFD8
SHA1:	8D4C9419F43D41066C40C67ED43F63A268A7E7AC
SHA-256:	DEE53FC307F455BF9E72689A4472B6E5252C6B36B848C8F531DAD9714A8D3F80
SHA-512:	9B7E12978891487D2BD31DCF0BCF02CFC74331AEBA1372AE9B0DA3B4BD7B1B177F25FD4A9E798D48A7F7C569409647FD1D975C3E4D12631B0953A50BDF71C75D
Malicious:	false
Reputation:	low
Preview:	.RkQ.

C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe

Download File

Process:	C:\Users\user\Desktop\7qBBKk0P4l.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	7.1119041831804
Encrypted:	false
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
MD5:	94E7772B2B1BDA89B23A2FBA0E57742E
SHA1:	2AF48B80B7354B4A15EFF49AF3F3D70D3E5789A4
SHA-256:	3397920E23CF8435201E9E90796B2A8C9EC340E4733CBC8064999E462DC53470
SHA-512:	28F2B94180CBD451FDF887B6E47DC92596FDFB37D06B0F115B4C4A79524366681E05EB2624922A7311BCB9CA983D275BB10F29338628F8654FD673619669F101
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i............D..............q......q.....Rich....................PE..L...w..T.....................>....................@..........................@............@.....................................P................................w......................................................T............................text............................... ..`.rdata..............................@..@.data............>..................@....reloc...w.......x..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\hjflhukc\xxxniijvj.exe

Download File

Process:	C:\hjflhukc\yanidfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	7.1119041831804
Encrypted:	false
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
MD5:	94E7772B2B1BDA89B23A2FBA0E57742E
SHA1:	2AF48B80B7354B4A15EFF49AF3F3D70D3E5789A4
SHA-256:	3397920E23CF8435201E9E90796B2A8C9EC340E4733CBC8064999E462DC53470
SHA-512:	28F2B94180CBD451FDF887B6E47DC92596FDFB37D06B0F115B4C4A79524366681E05EB2624922A7311BCB9CA983D275BB10F29338628F8654FD673619669F101
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i............D..............q......q.....Rich....................PE..L...w..T.....................>....................@..........................@............@.....................................P................................w......................................................T............................text............................... ..`.rdata..............................@..@.data............>..................@....reloc...w.......x..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\hjflhukc\yanidfx.exe

Download File

Process:	C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	7.1119041831804
Encrypted:	false
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
MD5:	94E7772B2B1BDA89B23A2FBA0E57742E
SHA1:	2AF48B80B7354B4A15EFF49AF3F3D70D3E5789A4
SHA-256:	3397920E23CF8435201E9E90796B2A8C9EC340E4733CBC8064999E462DC53470
SHA-512:	28F2B94180CBD451FDF887B6E47DC92596FDFB37D06B0F115B4C4A79524366681E05EB2624922A7311BCB9CA983D275BB10F29338628F8654FD673619669F101
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i............D..............q......q.....Rich....................PE..L...w..T.....................>....................@..........................@............@.....................................P................................w......................................................T............................text............................... ..`.rdata..............................@..@.data............>..................@....reloc...w.......x..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1119041831804
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7qBBKk0P4l.exe
File size:	236'032 bytes
MD5:	94e7772b2b1bda89b23a2fba0e57742e
SHA1:	2af48b80b7354b4a15eff49af3f3d70d3e5789a4
SHA256:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470
SHA512:	28f2b94180cbd451fdf887b6e47dc92596fdfb37d06b0f115b4c4a79524366681e05eb2624922a7311bcb9ca983d275bb10f29338628f8654fd673619669f101
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
TLSH:	D234AE27EA481433C92B627C8F4F3BE555BF71735A216A0D87AD29C85CA13CDB23251B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............D................q.......q......Rich....................PE..L...w..T.....................>....................@

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42cffe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x5415F677 [Sun Sep 14 20:11:35 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f2a0245d6e1fa4eff8f7908b9115e5a5

Entrypoint Preview

Instruction
inc dword ptr [004364E0h]
mov eax, dword ptr [004364E0h]
movsx ecx, word ptr [00439A58h]
shl ecx, 05h
add ecx, eax
cmp ecx, 88FDF618h
jne 00007F4F3D1C8B15h
movsx ecx, word ptr [00439E9Eh]
movsx eax, word ptr [00438E72h]
shl ecx, 09h
add eax, eax
or ecx, 8B9FEAD2h
cmp eax, ecx
jl 00007F4F3D1C8AEEh
add dword ptr [004351D4h], 32000450h
jmp 00007F4F3D1C8AECh
and dword ptr [004355ACh], FE8EB909h
call 00007F4F3D1C17E8h
mov ax, word ptr [00439448h]
cwde
and dword ptr [004364CCh], eax
call 00007F4F3D1B17CEh
movsx eax, word ptr [0043A870h]
not eax
cmp eax, 89F860A1h
jle 00007F4F3D1C8B08h
mov ecx, dword ptr [00434EF8h]
mov eax, dword ptr [00438310h]
and ecx, 57A11F5Bh
or eax, 87C03C33h
inc dword ptr [00434EF8h]
cmp ecx, eax
jl 00007F4F3D1C8AE8h
mov ax, word ptr [00438B68h]
push esi
push 0042F15Ch
push 0042F154h
call 00007F4F3D1BE89Eh
add dword ptr [004340B0h], FDBF763Fh
pop ecx
pop ecx
call 00007F4F3D1C5445h
imul ecx, dword ptr [004347E0h], 0000ED7Bh

Rich Headers

Programming Language:

[C++] VS2013 UPD4 build 31101
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f198	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3c000	0x77e8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2d4a4	0x2d600	a008b9f965a55234d4e9fec1e12e9ec6	False	0.7345310347796143	data	6.839663016682375	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2f000	0x8be	0xa00	55aa2668bd66e2095758bac52ad4d6a9	False	0.4265625	data	4.9731112242142945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0xbaa0	0x3e00	bd6e729852a57125388e38f19ed205d8	False	0.9037298387096774	data	7.278103942872461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3c000	0x77e8	0x7800	623b73b7d554b0184d990dca084cd43a	False	0.77333984375	data	6.84069434637676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	GetBkColor, GetDCBrushColor, GetDCPenColor, GetClipRgn, GetMetaRgn, GetCurrentObject, GetDeviceCaps, GetObjectType, GetRandomRgn, GetStretchBltMode, GetSystemPaletteUse, GetTextCharacterExtra, GetTextAlign, GetTextColor, GetTextCharset, GetTextCharsetInfo, GetFontLanguageInfo
USER32.dll	GetMenuContextHelpId, GetCursor, GetWindowLongA, LoadIconA, GetWindowContextHelpId, SetWindowTextA, RemovePropA, GetPropA, GetScrollPos, EndPaint, GetDC, WindowFromDC, GetForegroundWindow, DrawTextA, GetMenuCheckMarkDimensions, GetMenuItemCount, GetMenuItemID, GetMenuState, GetMenu, IsWindowEnabled, EnableWindow, GetQueueStatus, SetFocus, GetDialogBaseUnits, CheckDlgButton, SetDlgItemTextA, GetDlgItemInt, GetDlgItem, EndDialog, MoveWindow, ShowWindow, CallWindowProcA, PostMessageA, SendMessageA, BeginPaint
KERNEL32.dll	MoveFileA, LocalFlags, GlobalHandle, GlobalFlags, GlobalSize, SizeofResource, LockResource, LoadResource, GetProcAddress, GetModuleHandleA, GetTickCount, GetVersion, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentProcess, GetProcessHeap, HeapAlloc, QueryPerformanceCounter, GetLastError, CloseHandle, IsDebuggerPresent, WriteFile, SetFilePointer, GetFileType, GetFileTime, GetDriveTypeA, FlushFileBuffers, FindClose, DeleteFileA, GetStdHandle

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T16:38:07.114356+0200	UDP	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	53	56830	1.1.1.1	192.168.2.8
2024-08-05T16:38:17.877671+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49740	80	192.168.2.8	188.225.40.227
2024-08-05T16:36:45.925960+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49706	34.246.200.160	192.168.2.8
2024-08-05T16:36:42.598232+0200	UDP	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	53	56810	1.1.1.1	192.168.2.8
2024-08-05T16:36:48.099598+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49708	80	192.168.2.8	15.197.192.55
2024-08-05T16:36:56.538931+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49719	80	192.168.2.8	54.244.188.177
2024-08-05T16:36:43.677692+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49705	80	192.168.2.8	35.164.78.200
2024-08-05T16:36:56.545343+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49719	54.244.188.177	192.168.2.8
2024-08-05T16:36:41.235057+0200	UDP	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	53	59367	1.1.1.1	192.168.2.8
2024-08-05T16:38:00.887942+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49728	80	192.168.2.8	35.164.78.200
2024-08-05T16:38:02.779063+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49729	80	192.168.2.8	34.246.200.160
2024-08-05T16:38:13.014870+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49737	80	192.168.2.8	54.244.188.177
2024-08-05T16:38:15.755898+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49738	80	192.168.2.8	81.169.145.88
2024-08-05T16:37:58.771271+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49727	80	192.168.2.8	3.33.130.190
2024-08-05T16:38:08.756166+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49732	80	192.168.2.8	85.13.130.3
2024-08-05T16:36:58.610225+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49720	80	192.168.2.8	81.169.145.88
2024-08-05T16:36:41.217947+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49704	80	192.168.2.8	3.33.130.190
2024-08-05T16:38:00.892788+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49728	35.164.78.200	192.168.2.8
2024-08-05T16:38:13.043633+0200	UDP	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	53	53468	1.1.1.1	192.168.2.8
2024-08-05T16:36:43.682520+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49705	35.164.78.200	192.168.2.8
2024-08-05T16:38:10.787983+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49734	80	192.168.2.8	170.187.200.48

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:36:40.554436922 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:40.559340000 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:40.559452057 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:40.559609890 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:40.564476013 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:41.217849970 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:41.217864990 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:41.217914104 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:41.217947006 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:41.217963934 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:41.218064070 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:41.232707977 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:42.934566975 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:36:42.939970016 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:36:42.940056086 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:36:42.940088987 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:36:42.944993019 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:36:43.672036886 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:36:43.677609921 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:36:43.677691936 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:36:43.677747011 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:36:43.682519913 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:36:45.093135118 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:36:45.101103067 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:36:45.101236105 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:36:45.101304054 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:36:45.106534004 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:36:45.917510986 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:36:45.917798996 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:36:45.917891979 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:36:45.918608904 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:36:45.925960064 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:36:46.438234091 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:36:46.443228006 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:36:46.443387985 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:36:46.448748112 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:36:46.453532934 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:36:46.941528082 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:36:46.941752911 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:36:46.943442106 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:36:46.943525076 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:36:46.946896076 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:36:47.629715919 CEST	49708	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:36:47.634953976 CEST	80	49708	15.197.192.55	192.168.2.8
Aug 5, 2024 16:36:47.635060072 CEST	49708	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:36:47.635165930 CEST	49708	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:36:47.640933037 CEST	80	49708	15.197.192.55	192.168.2.8
Aug 5, 2024 16:36:48.099404097 CEST	80	49708	15.197.192.55	192.168.2.8
Aug 5, 2024 16:36:48.099508047 CEST	80	49708	15.197.192.55	192.168.2.8
Aug 5, 2024 16:36:48.099597931 CEST	49708	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:36:48.099597931 CEST	49708	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:36:48.104832888 CEST	80	49708	15.197.192.55	192.168.2.8
Aug 5, 2024 16:36:49.886418104 CEST	49709	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:36:49.891345024 CEST	80	49709	85.13.130.3	192.168.2.8
Aug 5, 2024 16:36:49.891441107 CEST	49709	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:36:49.891526937 CEST	49709	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:36:49.896311998 CEST	80	49709	85.13.130.3	192.168.2.8
Aug 5, 2024 16:36:50.546163082 CEST	80	49709	85.13.130.3	192.168.2.8
Aug 5, 2024 16:36:50.546340942 CEST	80	49709	85.13.130.3	192.168.2.8
Aug 5, 2024 16:36:50.546397924 CEST	49709	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:36:50.546435118 CEST	49709	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:36:50.551281929 CEST	80	49709	85.13.130.3	192.168.2.8
Aug 5, 2024 16:36:50.577109098 CEST	49710	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:50.582719088 CEST	80	49710	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:50.582822084 CEST	49710	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:50.588196039 CEST	49710	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:50.593147993 CEST	80	49710	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:51.041480064 CEST	80	49710	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:51.041673899 CEST	49710	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:51.042150974 CEST	80	49710	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:51.042223930 CEST	49710	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:36:51.046708107 CEST	80	49710	3.33.130.190	192.168.2.8
Aug 5, 2024 16:36:53.278204918 CEST	49715	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:36:53.283113956 CEST	80	49715	170.187.200.48	192.168.2.8
Aug 5, 2024 16:36:53.283189058 CEST	49715	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:36:53.283257008 CEST	49715	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:36:53.288091898 CEST	80	49715	170.187.200.48	192.168.2.8
Aug 5, 2024 16:36:53.790329933 CEST	80	49715	170.187.200.48	192.168.2.8
Aug 5, 2024 16:36:53.790442944 CEST	49715	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:36:53.791500092 CEST	80	49715	170.187.200.48	192.168.2.8
Aug 5, 2024 16:36:53.791551113 CEST	49715	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:36:53.796842098 CEST	80	49715	170.187.200.48	192.168.2.8
Aug 5, 2024 16:36:54.105703115 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.110596895 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.110692978 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.110738039 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.115602016 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.854599953 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.854639053 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.854652882 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.854697943 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.856276035 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.856338978 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.857335091 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.857393980 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.857419968 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:36:54.863058090 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:36:54.887569904 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:36:54.893415928 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:36:54.893620014 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:36:54.893682003 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:36:54.905126095 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:36:55.556778908 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:36:55.556982994 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:36:55.557136059 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:36:55.557136059 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:36:55.562959909 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:36:55.796593904 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:36:55.801454067 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:36:55.803678989 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:36:55.803735971 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:36:55.808799028 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:36:56.538788080 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:36:56.538830042 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:36:56.538930893 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:36:56.539038897 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:36:56.545342922 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:36:57.675641060 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:36:57.680563927 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:36:57.680665016 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:36:57.680721998 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:36:57.943512917 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:36:58.610064030 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:36:58.610166073 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:36:58.610224962 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:36:58.610260010 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:36:58.615102053 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:37:00.353426933 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:00.358596087 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:00.358717918 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:00.358747959 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:00.364089966 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:00.906940937 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:00.906954050 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:00.906974077 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:00.907005072 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:00.907032013 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:00.907104969 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:01.218458891 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:01.227807045 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:01.227921009 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:01.231142044 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:01.231271982 CEST	80	49721	15.197.192.55	192.168.2.8
Aug 5, 2024 16:37:01.231324911 CEST	49721	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:37:01.870280981 CEST	49722	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:37:01.875133991 CEST	80	49722	188.225.40.227	192.168.2.8
Aug 5, 2024 16:37:01.875263929 CEST	49722	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:37:01.875263929 CEST	49722	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:37:01.880064964 CEST	80	49722	188.225.40.227	192.168.2.8
Aug 5, 2024 16:37:02.572331905 CEST	80	49722	188.225.40.227	192.168.2.8
Aug 5, 2024 16:37:02.572581053 CEST	49722	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:37:02.572679043 CEST	80	49722	188.225.40.227	192.168.2.8
Aug 5, 2024 16:37:02.572762012 CEST	49722	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:37:02.577877998 CEST	80	49722	188.225.40.227	192.168.2.8
Aug 5, 2024 16:37:58.261583090 CEST	49727	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:37:58.266720057 CEST	80	49727	3.33.130.190	192.168.2.8
Aug 5, 2024 16:37:58.266855955 CEST	49727	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:37:58.266943932 CEST	49727	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:37:58.273786068 CEST	80	49727	3.33.130.190	192.168.2.8
Aug 5, 2024 16:37:58.771012068 CEST	80	49727	3.33.130.190	192.168.2.8
Aug 5, 2024 16:37:58.771270990 CEST	49727	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:37:58.771368027 CEST	80	49727	3.33.130.190	192.168.2.8
Aug 5, 2024 16:37:58.771418095 CEST	49727	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:37:58.776276112 CEST	80	49727	3.33.130.190	192.168.2.8
Aug 5, 2024 16:38:00.091139078 CEST	49728	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:38:00.097194910 CEST	80	49728	35.164.78.200	192.168.2.8
Aug 5, 2024 16:38:00.097263098 CEST	49728	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:38:00.097331047 CEST	49728	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:38:00.102317095 CEST	80	49728	35.164.78.200	192.168.2.8
Aug 5, 2024 16:38:00.887597084 CEST	80	49728	35.164.78.200	192.168.2.8
Aug 5, 2024 16:38:00.887870073 CEST	80	49728	35.164.78.200	192.168.2.8
Aug 5, 2024 16:38:00.887942076 CEST	49728	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:38:00.888004065 CEST	49728	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:38:00.892787933 CEST	80	49728	35.164.78.200	192.168.2.8
Aug 5, 2024 16:38:02.007817030 CEST	49729	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:38:02.012882948 CEST	80	49729	34.246.200.160	192.168.2.8
Aug 5, 2024 16:38:02.012969971 CEST	49729	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:38:02.013025045 CEST	49729	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:38:02.019063950 CEST	80	49729	34.246.200.160	192.168.2.8
Aug 5, 2024 16:38:02.778914928 CEST	80	49729	34.246.200.160	192.168.2.8
Aug 5, 2024 16:38:02.778991938 CEST	80	49729	34.246.200.160	192.168.2.8
Aug 5, 2024 16:38:02.779062986 CEST	49729	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:38:02.782071114 CEST	49729	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:38:02.786952019 CEST	80	49729	34.246.200.160	192.168.2.8
Aug 5, 2024 16:38:03.288193941 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:03.293126106 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:03.293236017 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:03.293293953 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:03.298160076 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:04.008315086 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:04.008331060 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:04.008419037 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:04.008428097 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:04.008465052 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:04.008488894 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:04.009181976 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:04.009222031 CEST	49730	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:38:04.013334990 CEST	80	49730	15.197.142.173	192.168.2.8
Aug 5, 2024 16:38:04.809155941 CEST	49731	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:04.815531015 CEST	80	49731	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:04.815610886 CEST	49731	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:04.815686941 CEST	49731	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:04.822043896 CEST	80	49731	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:05.283921003 CEST	80	49731	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:05.284075022 CEST	49731	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:05.284178972 CEST	80	49731	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:05.284229994 CEST	49731	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:05.288949013 CEST	80	49731	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:08.095134020 CEST	49732	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:38:08.100043058 CEST	80	49732	85.13.130.3	192.168.2.8
Aug 5, 2024 16:38:08.100281000 CEST	49732	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:38:08.100370884 CEST	49732	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:38:08.105674982 CEST	80	49732	85.13.130.3	192.168.2.8
Aug 5, 2024 16:38:08.755995035 CEST	80	49732	85.13.130.3	192.168.2.8
Aug 5, 2024 16:38:08.756028891 CEST	80	49732	85.13.130.3	192.168.2.8
Aug 5, 2024 16:38:08.756165981 CEST	49732	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:38:08.756244898 CEST	49732	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:38:08.763381004 CEST	80	49732	85.13.130.3	192.168.2.8
Aug 5, 2024 16:38:08.771104097 CEST	49733	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:38:08.777775049 CEST	80	49733	3.33.130.190	192.168.2.8
Aug 5, 2024 16:38:08.777879000 CEST	49733	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:38:08.777964115 CEST	49733	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:38:08.784710884 CEST	80	49733	3.33.130.190	192.168.2.8
Aug 5, 2024 16:38:09.241031885 CEST	80	49733	3.33.130.190	192.168.2.8
Aug 5, 2024 16:38:09.241193056 CEST	49733	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:38:09.241404057 CEST	80	49733	3.33.130.190	192.168.2.8
Aug 5, 2024 16:38:09.241461039 CEST	49733	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:38:09.246305943 CEST	80	49733	3.33.130.190	192.168.2.8
Aug 5, 2024 16:38:10.131545067 CEST	49734	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:38:10.136418104 CEST	80	49734	170.187.200.48	192.168.2.8
Aug 5, 2024 16:38:10.136502981 CEST	49734	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:38:10.136539936 CEST	49734	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:38:10.141611099 CEST	80	49734	170.187.200.48	192.168.2.8
Aug 5, 2024 16:38:10.787756920 CEST	80	49734	170.187.200.48	192.168.2.8
Aug 5, 2024 16:38:10.787982941 CEST	49734	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:38:10.788003922 CEST	80	49734	170.187.200.48	192.168.2.8
Aug 5, 2024 16:38:10.788058043 CEST	49734	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:38:10.792826891 CEST	80	49734	170.187.200.48	192.168.2.8
Aug 5, 2024 16:38:10.995085001 CEST	49735	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:38:11.000150919 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.000273943 CEST	49735	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:38:11.000325918 CEST	49735	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:38:11.005131960 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.594600916 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.594660997 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.594698906 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.594733000 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.594772100 CEST	49735	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:38:11.594805956 CEST	49735	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:38:11.594913960 CEST	49735	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:38:11.595721006 CEST	49736	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:38:11.600110054 CEST	80	49735	213.171.195.105	192.168.2.8
Aug 5, 2024 16:38:11.600614071 CEST	80	49736	64.190.63.222	192.168.2.8
Aug 5, 2024 16:38:11.600693941 CEST	49736	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:38:11.600789070 CEST	49736	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:38:11.605868101 CEST	80	49736	64.190.63.222	192.168.2.8
Aug 5, 2024 16:38:12.236787081 CEST	80	49736	64.190.63.222	192.168.2.8
Aug 5, 2024 16:38:12.236902952 CEST	80	49736	64.190.63.222	192.168.2.8
Aug 5, 2024 16:38:12.236959934 CEST	49736	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:38:12.237001896 CEST	49736	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:38:12.242227077 CEST	80	49736	64.190.63.222	192.168.2.8
Aug 5, 2024 16:38:12.262264967 CEST	49737	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:38:12.267158985 CEST	80	49737	54.244.188.177	192.168.2.8
Aug 5, 2024 16:38:12.267226934 CEST	49737	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:38:12.267275095 CEST	49737	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:38:12.272150993 CEST	80	49737	54.244.188.177	192.168.2.8
Aug 5, 2024 16:38:13.014705896 CEST	80	49737	54.244.188.177	192.168.2.8
Aug 5, 2024 16:38:13.014767885 CEST	80	49737	54.244.188.177	192.168.2.8
Aug 5, 2024 16:38:13.014869928 CEST	49737	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:38:13.014969110 CEST	49737	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:38:13.019896030 CEST	80	49737	54.244.188.177	192.168.2.8
Aug 5, 2024 16:38:14.962218046 CEST	49738	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:38:14.967401981 CEST	80	49738	81.169.145.88	192.168.2.8
Aug 5, 2024 16:38:14.967499971 CEST	49738	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:38:14.967596054 CEST	49738	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:38:14.973997116 CEST	80	49738	81.169.145.88	192.168.2.8
Aug 5, 2024 16:38:15.755718946 CEST	80	49738	81.169.145.88	192.168.2.8
Aug 5, 2024 16:38:15.755784035 CEST	80	49738	81.169.145.88	192.168.2.8
Aug 5, 2024 16:38:15.755897999 CEST	49738	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:38:15.755933046 CEST	49738	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:38:15.762623072 CEST	80	49738	81.169.145.88	192.168.2.8
Aug 5, 2024 16:38:16.140883923 CEST	49739	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:16.145975113 CEST	80	49739	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:16.146081924 CEST	49739	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:16.146161079 CEST	49739	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:16.151073933 CEST	80	49739	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:16.644612074 CEST	80	49739	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:16.644659042 CEST	80	49739	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:16.644670010 CEST	80	49739	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:16.644800901 CEST	49739	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:16.644902945 CEST	49739	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:38:16.652700901 CEST	80	49739	15.197.192.55	192.168.2.8
Aug 5, 2024 16:38:17.192167997 CEST	49740	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:38:17.197321892 CEST	80	49740	188.225.40.227	192.168.2.8
Aug 5, 2024 16:38:17.197438002 CEST	49740	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:38:17.197480917 CEST	49740	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:38:17.202287912 CEST	80	49740	188.225.40.227	192.168.2.8
Aug 5, 2024 16:38:17.877573967 CEST	80	49740	188.225.40.227	192.168.2.8
Aug 5, 2024 16:38:17.877597094 CEST	80	49740	188.225.40.227	192.168.2.8
Aug 5, 2024 16:38:17.877671003 CEST	49740	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:38:17.877717018 CEST	49740	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:38:17.882576942 CEST	80	49740	188.225.40.227	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:36:39.353005886 CEST	51090	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:39.368855000 CEST	53	51090	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:39.370682955 CEST	60119	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:39.611361027 CEST	53	60119	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:39.612252951 CEST	55681	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:39.854981899 CEST	53	55681	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:39.856030941 CEST	59187	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:39.867891073 CEST	53	59187	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:39.868695974 CEST	62493	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:39.878309011 CEST	53	62493	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:39.879074097 CEST	58670	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:40.118793011 CEST	53	58670	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:40.119795084 CEST	51042	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:40.286669970 CEST	53	51042	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:40.287440062 CEST	59955	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:40.297940969 CEST	53	59955	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:40.298654079 CEST	60117	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:40.540282011 CEST	53	60117	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:40.541182995 CEST	55481	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:40.552257061 CEST	53	55481	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:41.218976021 CEST	59367	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:41.235057116 CEST	53	59367	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:41.236143112 CEST	59918	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:41.478492022 CEST	53	59918	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:41.479392052 CEST	50348	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:41.487771988 CEST	53	50348	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:41.488435984 CEST	56037	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:41.496058941 CEST	53	56037	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:41.496673107 CEST	55898	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:41.752202988 CEST	53	55898	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:41.753242016 CEST	51775	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.000659943 CEST	53	51775	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.001708984 CEST	57801	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.015692949 CEST	53	57801	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.016551018 CEST	50181	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.027812004 CEST	53	50181	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.028527021 CEST	49396	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.040721893 CEST	53	49396	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.041399002 CEST	61680	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.058551073 CEST	53	61680	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.059204102 CEST	51111	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.318908930 CEST	53	51111	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.319832087 CEST	52526	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.330058098 CEST	53	52526	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.331574917 CEST	51538	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.574553013 CEST	53	51538	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.575365067 CEST	54281	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.586019993 CEST	53	54281	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.586740017 CEST	56810	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.598232031 CEST	53	56810	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.599143982 CEST	51031	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.613347054 CEST	53	51031	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.614051104 CEST	49445	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.625917912 CEST	53	49445	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.627573967 CEST	62446	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.638657093 CEST	53	62446	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.639345884 CEST	49554	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.649710894 CEST	53	49554	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.650440931 CEST	62081	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.666552067 CEST	53	62081	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.667460918 CEST	64998	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.680490017 CEST	53	64998	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.683355093 CEST	56418	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.693288088 CEST	53	56418	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.694165945 CEST	50268	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.704880953 CEST	53	50268	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.705434084 CEST	62531	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.716902971 CEST	53	62531	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.717470884 CEST	65167	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.729437113 CEST	53	65167	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.730122089 CEST	54526	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.743010044 CEST	53	54526	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:42.743774891 CEST	50566	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:42.933907986 CEST	53	50566	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:43.678503990 CEST	59615	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:43.692328930 CEST	53	59615	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:43.700141907 CEST	57429	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:43.752058983 CEST	53	57429	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:43.752810001 CEST	61581	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:43.764357090 CEST	53	61581	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:43.765305996 CEST	60568	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:43.777448893 CEST	53	60568	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:43.778363943 CEST	56632	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.015759945 CEST	53	56632	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.017153978 CEST	57586	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.028564930 CEST	53	57586	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.029429913 CEST	60571	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.278059959 CEST	53	60571	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.279048920 CEST	64667	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.293302059 CEST	53	64667	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.294002056 CEST	62988	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.304867029 CEST	53	62988	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.305530071 CEST	60710	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.322139025 CEST	53	60710	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.322985888 CEST	59305	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.332329035 CEST	53	59305	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.332981110 CEST	61021	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.580202103 CEST	53	61021	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.581218958 CEST	57880	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.597767115 CEST	53	57880	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.598520994 CEST	54381	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.608977079 CEST	53	54381	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.609754086 CEST	57758	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.621057987 CEST	53	57758	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.621823072 CEST	56459	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.863224030 CEST	53	56459	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.864295006 CEST	63855	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.874325991 CEST	53	63855	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.875132084 CEST	52242	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:44.887716055 CEST	53	52242	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:44.888422966 CEST	61661	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:45.091850996 CEST	53	61661	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:45.918513060 CEST	58015	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:45.931898117 CEST	53	58015	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:45.932651043 CEST	53617	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:45.944937944 CEST	53	53617	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:45.945818901 CEST	63851	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:45.958379984 CEST	53	63851	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:45.959244967 CEST	62450	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:45.970640898 CEST	53	62450	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:45.971379042 CEST	54518	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:45.981431007 CEST	53	54518	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:45.982007027 CEST	61819	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:46.159359932 CEST	53	61819	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:46.160356045 CEST	62899	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:46.170938969 CEST	53	62899	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:46.171907902 CEST	61313	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:46.183216095 CEST	53	61313	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:46.184082985 CEST	58242	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:46.423681021 CEST	53	58242	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:46.424618959 CEST	58260	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:46.437474966 CEST	53	58260	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:46.942486048 CEST	61331	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:46.954034090 CEST	53	61331	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:46.954982996 CEST	64411	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.198570967 CEST	53	64411	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:47.199863911 CEST	58835	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.210464001 CEST	53	58835	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:47.211167097 CEST	52792	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.226707935 CEST	53	52792	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:47.227523088 CEST	53608	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.246351957 CEST	53	53608	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:47.247255087 CEST	57049	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.279947042 CEST	53	57049	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:47.280801058 CEST	53694	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.291918039 CEST	53	53694	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:47.292835951 CEST	55996	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:47.628916979 CEST	53	55996	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.100435019 CEST	53135	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.110498905 CEST	53	53135	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.111423016 CEST	58960	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.355052948 CEST	53	58960	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.356029987 CEST	54933	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.369045973 CEST	53	54933	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.369904995 CEST	49994	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.386740923 CEST	53	49994	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.387667894 CEST	65175	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.633297920 CEST	53	65175	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.634262085 CEST	54382	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.649682999 CEST	53	54382	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.650899887 CEST	63864	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.662101984 CEST	53	63864	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.663028955 CEST	62316	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.673151016 CEST	53	62316	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.673784971 CEST	59944	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.686657906 CEST	53	59944	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.687352896 CEST	64915	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.698379040 CEST	53	64915	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.699014902 CEST	58936	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.709713936 CEST	53	58936	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.710701942 CEST	63206	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.721396923 CEST	53	63206	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.722073078 CEST	58425	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.963458061 CEST	53	58425	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.964668989 CEST	57612	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:48.972209930 CEST	53	57612	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:48.973030090 CEST	59307	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.215868950 CEST	53	59307	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.217143059 CEST	63857	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.227722883 CEST	53	63857	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.228580952 CEST	52722	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.239301920 CEST	53	52722	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.240248919 CEST	61155	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.506944895 CEST	53	61155	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.507904053 CEST	58526	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.519426107 CEST	53	58526	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.520250082 CEST	56459	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.530726910 CEST	53	56459	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.531650066 CEST	62889	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.542201042 CEST	53	62889	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.543634892 CEST	53572	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.792819977 CEST	53	53572	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.793900967 CEST	59326	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.804862022 CEST	53	59326	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.805780888 CEST	65358	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.818869114 CEST	53	65358	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.821552038 CEST	57429	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.832920074 CEST	53	57429	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.833841085 CEST	62476	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.846533060 CEST	53	62476	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:49.850253105 CEST	55435	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:49.884671926 CEST	53	55435	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:50.547266960 CEST	65494	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:50.560969114 CEST	53	65494	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:50.561996937 CEST	55517	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:50.576527119 CEST	53	55517	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.042473078 CEST	53378	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.292993069 CEST	53	53378	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.294143915 CEST	57746	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.536947012 CEST	53	57746	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.537852049 CEST	62714	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.786314011 CEST	53	62714	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.787070990 CEST	59455	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.802022934 CEST	53	59455	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.802778959 CEST	59129	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.813405037 CEST	53	59129	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.814130068 CEST	52533	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.824346066 CEST	53	52533	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.825092077 CEST	51590	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:51.836872101 CEST	53	51590	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:51.837702990 CEST	56921	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.088181973 CEST	53	56921	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.089168072 CEST	50394	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.100846052 CEST	53	50394	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.101660967 CEST	50441	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.346534014 CEST	53	50441	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.347357035 CEST	62179	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.358089924 CEST	53	62179	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.358875990 CEST	63619	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.369129896 CEST	53	63619	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.370096922 CEST	57156	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.796561003 CEST	53	57156	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.797898054 CEST	58106	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.810426950 CEST	53	58106	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.811161041 CEST	56153	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:52.823853970 CEST	53	56153	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:52.829648972 CEST	57703	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:53.277653933 CEST	53	57703	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:53.791110039 CEST	52669	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:53.802386999 CEST	53	52669	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:53.803234100 CEST	53408	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:53.814697027 CEST	53	53408	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:53.815788984 CEST	56750	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:54.055990934 CEST	53	56750	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:54.056989908 CEST	57370	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:54.068696022 CEST	53	57370	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:54.069430113 CEST	57723	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:54.105180025 CEST	53	57723	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:54.858067989 CEST	52218	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:54.886974096 CEST	53	52218	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:55.557658911 CEST	64773	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:55.568685055 CEST	53	64773	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:55.569571972 CEST	52784	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:55.584660053 CEST	53	52784	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:55.585674047 CEST	52744	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:55.785990953 CEST	53	52744	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.539659023 CEST	65317	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.552134037 CEST	53	65317	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.553088903 CEST	59137	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.567317963 CEST	53	59137	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.568094969 CEST	63641	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.580863953 CEST	53	63641	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.581495047 CEST	64135	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.595370054 CEST	53	64135	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.595973969 CEST	57529	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.608808041 CEST	53	57529	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.609473944 CEST	62247	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.621980906 CEST	53	62247	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.622976065 CEST	49266	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.638958931 CEST	53	49266	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.639790058 CEST	63450	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.653503895 CEST	53	63450	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.654500961 CEST	49856	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.897937059 CEST	53	49856	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.899085045 CEST	58162	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:56.912920952 CEST	53	58162	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:56.913820982 CEST	59210	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.155175924 CEST	53	59210	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.156533957 CEST	64399	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.175685883 CEST	53	64399	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.176954031 CEST	60796	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.212047100 CEST	53	60796	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.212913990 CEST	64902	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.225847960 CEST	53	64902	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.226860046 CEST	62224	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.386040926 CEST	53	62224	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.387175083 CEST	57237	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.633265972 CEST	53	57237	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.634114027 CEST	61823	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.646018982 CEST	53	61823	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:57.646895885 CEST	63036	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:57.675052881 CEST	53	63036	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:58.610924959 CEST	62228	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:58.784452915 CEST	53	62228	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:58.785491943 CEST	59758	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.028749943 CEST	53	59758	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.029863119 CEST	55003	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.040896893 CEST	53	55003	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.041729927 CEST	53517	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.054090977 CEST	53	53517	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.055022955 CEST	64391	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.306061029 CEST	53	64391	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.307311058 CEST	63890	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.317742109 CEST	53	63890	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.318478107 CEST	55082	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.331271887 CEST	53	55082	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.332151890 CEST	59605	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.345051050 CEST	53	59605	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.345741987 CEST	52144	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.357047081 CEST	53	52144	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.357644081 CEST	61501	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.367822886 CEST	53	61501	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.368601084 CEST	63970	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.609183073 CEST	53	63970	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.610183001 CEST	54004	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:36:59.864170074 CEST	53	54004	1.1.1.1	192.168.2.8
Aug 5, 2024 16:36:59.865206957 CEST	58338	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:00.352580070 CEST	53	58338	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:00.907918930 CEST	62993	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.234253883 CEST	53	62993	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:01.235503912 CEST	53347	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.246416092 CEST	53	53347	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:01.247356892 CEST	49213	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.265527010 CEST	53	49213	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:01.266585112 CEST	49770	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.509727955 CEST	53	49770	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:01.510814905 CEST	60355	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.523408890 CEST	53	60355	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:01.524280071 CEST	52359	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.537791014 CEST	53	52359	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:01.538729906 CEST	65309	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:01.869175911 CEST	53	65309	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:02.573220015 CEST	63253	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:02.816730976 CEST	53	63253	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:02.818362951 CEST	64109	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:03.069011927 CEST	53	64109	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:03.069844961 CEST	63866	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:03.081201077 CEST	53	63866	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:03.082120895 CEST	55678	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:03.092972040 CEST	53	55678	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.428836107 CEST	60645	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:57.670433998 CEST	53	60645	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.674669027 CEST	51598	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:57.927356958 CEST	53	51598	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.928169966 CEST	49445	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:57.940391064 CEST	53	49445	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.941281080 CEST	53706	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:57.952907085 CEST	53	53706	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.953811884 CEST	55188	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:57.965336084 CEST	53	55188	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.966114044 CEST	53182	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:57.977690935 CEST	53	53182	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:57.978588104 CEST	50386	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:58.230727911 CEST	53	50386	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:58.231544971 CEST	63931	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:58.246515989 CEST	53	63931	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:58.247298956 CEST	54886	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:58.258975029 CEST	53	54886	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:58.772082090 CEST	55794	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:58.782063007 CEST	53	55794	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:58.783575058 CEST	56105	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:58.794399977 CEST	53	56105	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:58.795322895 CEST	55800	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.039271116 CEST	53	55800	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.040324926 CEST	55024	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.051409006 CEST	53	55024	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.052227974 CEST	58080	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.062588930 CEST	53	58080	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.063220978 CEST	63394	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.074398041 CEST	53	63394	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.075149059 CEST	61217	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.088793993 CEST	53	61217	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.089663982 CEST	57967	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.100234985 CEST	53	57967	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.101142883 CEST	61801	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.117769957 CEST	53	61801	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.118431091 CEST	57300	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.134715080 CEST	53	57300	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.135755062 CEST	53067	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.379652023 CEST	53	53067	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.387303114 CEST	61599	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.398346901 CEST	53	61599	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.399113894 CEST	51753	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.416244030 CEST	53	51753	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.417169094 CEST	62187	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.428545952 CEST	53	62187	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.429300070 CEST	50193	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.440690041 CEST	53	50193	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.441529989 CEST	62113	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.458669901 CEST	53	62113	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.459481001 CEST	51691	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.700623989 CEST	53	51691	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.701643944 CEST	54642	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.715399981 CEST	53	54642	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.756491899 CEST	49996	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.766896009 CEST	53	49996	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.767684937 CEST	64516	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.778212070 CEST	53	64516	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.778903008 CEST	60742	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.789803982 CEST	53	60742	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.790527105 CEST	50482	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.799540043 CEST	53	50482	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.800203085 CEST	58810	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.812242031 CEST	53	58810	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.813172102 CEST	58782	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:37:59.828253984 CEST	53	58782	1.1.1.1	192.168.2.8
Aug 5, 2024 16:37:59.829050064 CEST	51306	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:00.071831942 CEST	53	51306	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:00.075073004 CEST	64192	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:00.086347103 CEST	53	64192	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:00.888679981 CEST	56546	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:00.900537014 CEST	53	56546	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:00.901315928 CEST	57464	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:00.913670063 CEST	53	57464	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:00.914385080 CEST	57885	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.155545950 CEST	53	57885	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.156696081 CEST	53715	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.167927980 CEST	53	53715	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.168790102 CEST	51417	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.180170059 CEST	53	51417	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.180885077 CEST	62768	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.352588892 CEST	53	62768	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.353596926 CEST	51146	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.597661972 CEST	53	51146	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.598681927 CEST	60563	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.618999958 CEST	53	60563	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.619714975 CEST	61925	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.632441044 CEST	53	61925	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.633131027 CEST	58695	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.644659996 CEST	53	58695	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.645250082 CEST	57613	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.661240101 CEST	53	57613	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.662019968 CEST	52625	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.679740906 CEST	53	52625	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.680368900 CEST	57855	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.693149090 CEST	53	57855	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.693762064 CEST	58984	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.707020044 CEST	53	58984	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.707885027 CEST	60869	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.720268965 CEST	53	60869	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.720900059 CEST	52379	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.970777988 CEST	53	52379	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.971864939 CEST	58881	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:01.985738039 CEST	53	58881	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:01.986692905 CEST	49653	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:02.006782055 CEST	53	49653	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:02.786472082 CEST	50401	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:02.954701900 CEST	53	50401	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:02.955905914 CEST	53791	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:02.966984034 CEST	53	53791	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:02.967715025 CEST	57473	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:02.981306076 CEST	53	57473	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:02.981921911 CEST	61397	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:02.994856119 CEST	53	61397	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:02.995558977 CEST	58392	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:03.006686926 CEST	53	58392	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:03.008308887 CEST	57308	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:03.019572020 CEST	53	57308	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:03.020165920 CEST	55694	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:03.031160116 CEST	53	55694	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:03.032104015 CEST	62164	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:03.275041103 CEST	53	62164	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:03.276165009 CEST	60304	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:03.286937952 CEST	53	60304	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.009152889 CEST	55503	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.019555092 CEST	53	55503	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.020471096 CEST	58413	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.270334959 CEST	53	58413	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.271404982 CEST	50051	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.285171986 CEST	53	50051	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.286155939 CEST	54259	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.297135115 CEST	53	54259	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.298084021 CEST	58007	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.542114973 CEST	53	58007	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.543216944 CEST	52782	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.795299053 CEST	53	52782	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:04.796159983 CEST	53143	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:04.808367014 CEST	53	53143	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:05.284837008 CEST	57061	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:05.527439117 CEST	53	57061	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:05.528462887 CEST	51525	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:05.770265102 CEST	53	51525	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:05.771229982 CEST	58633	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:05.782088041 CEST	53	58633	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:05.782999039 CEST	58378	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:05.795113087 CEST	53	58378	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:05.796008110 CEST	49281	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.037519932 CEST	53	49281	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.038474083 CEST	63639	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.051501036 CEST	53	63639	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.052314997 CEST	51355	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.067466021 CEST	53	51355	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.068372965 CEST	63198	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.079953909 CEST	53	63198	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.080666065 CEST	56784	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.092104912 CEST	53	56784	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.092946053 CEST	54834	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.104203939 CEST	53	54834	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.105006933 CEST	50213	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.350621939 CEST	53	50213	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.351753950 CEST	55882	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.366333961 CEST	53	55882	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.367357016 CEST	65036	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.610652924 CEST	53	65036	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.611430883 CEST	53568	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.853066921 CEST	53	53568	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.854162931 CEST	50231	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:06.866261959 CEST	53	50231	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:06.867189884 CEST	56830	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.114356041 CEST	53	56830	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.115150928 CEST	61624	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.126018047 CEST	53	61624	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.126703978 CEST	56929	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.138246059 CEST	53	56929	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.139151096 CEST	49836	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.150002956 CEST	53	49836	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.150753021 CEST	56208	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.403168917 CEST	53	56208	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.404272079 CEST	59974	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.647264004 CEST	53	59974	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.648349047 CEST	51291	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.813163042 CEST	53	51291	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.814178944 CEST	59320	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.828260899 CEST	53	59320	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.829015017 CEST	59696	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:07.840544939 CEST	53	59696	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:07.841326952 CEST	50270	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:08.082031965 CEST	53	50270	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:08.083017111 CEST	50332	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:08.094218969 CEST	53	50332	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:08.756918907 CEST	61174	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:08.770143032 CEST	53	61174	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.241879940 CEST	56317	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.252569914 CEST	53	56317	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.253295898 CEST	62020	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.494096994 CEST	53	62020	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.495203972 CEST	53884	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.507671118 CEST	53	53884	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.508620977 CEST	58512	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.522731066 CEST	53	58512	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.523475885 CEST	64319	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.537250042 CEST	53	64319	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.537851095 CEST	55994	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.550298929 CEST	53	55994	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.550875902 CEST	56841	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.563360929 CEST	53	56841	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.563930035 CEST	57111	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.575318098 CEST	53	57111	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.575917959 CEST	64611	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.585946083 CEST	53	64611	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.586576939 CEST	49454	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:09.828493118 CEST	53	49454	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:09.829626083 CEST	57256	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.079885960 CEST	53	57256	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.080786943 CEST	52179	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.093116999 CEST	53	52179	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.093772888 CEST	60853	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.106477022 CEST	53	60853	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.107048988 CEST	61258	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.118125916 CEST	53	61258	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.118805885 CEST	56070	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.130733967 CEST	53	56070	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.788712025 CEST	52029	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.950330019 CEST	53	52029	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.951293945 CEST	64759	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.964117050 CEST	53	64759	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.965055943 CEST	62415	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.979084969 CEST	53	62415	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:10.980199099 CEST	60963	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:10.994060040 CEST	53	60963	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:12.237627029 CEST	57324	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:12.250061989 CEST	53	57324	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:12.250858068 CEST	56329	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:12.261554956 CEST	53	56329	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.015707016 CEST	51761	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.026566982 CEST	53	51761	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.027214050 CEST	53468	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.043632984 CEST	53	53468	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.044538021 CEST	60572	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.056206942 CEST	53	60572	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.057059050 CEST	62151	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.298180103 CEST	53	62151	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.299190998 CEST	65051	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.310750008 CEST	53	65051	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.311497927 CEST	56435	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.555214882 CEST	53	56435	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.556307077 CEST	59358	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.567203999 CEST	53	59358	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.567822933 CEST	50471	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.817608118 CEST	53	50471	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.821393967 CEST	54765	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.832412958 CEST	53	54765	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.833159924 CEST	57953	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:13.994288921 CEST	53	57953	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:13.995239973 CEST	55094	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.244328976 CEST	53	55094	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:14.245342016 CEST	54772	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.256731987 CEST	53	54772	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:14.257494926 CEST	62761	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.290611029 CEST	53	62761	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:14.291631937 CEST	60607	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.536237955 CEST	53	60607	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:14.537060976 CEST	65385	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.550556898 CEST	53	65385	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:14.551336050 CEST	49803	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.794930935 CEST	53	49803	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:14.796035051 CEST	59539	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:14.960773945 CEST	53	59539	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:15.756539106 CEST	60607	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:15.768749952 CEST	53	60607	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:15.770070076 CEST	51639	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:15.783431053 CEST	53	51639	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:15.784178019 CEST	57507	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.027815104 CEST	53	57507	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.028703928 CEST	59966	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.040061951 CEST	53	59966	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.041012049 CEST	61649	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.052799940 CEST	53	61649	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.053503990 CEST	61671	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.063801050 CEST	53	61671	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.064435005 CEST	52713	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.076200008 CEST	53	52713	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.077012062 CEST	56453	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.090326071 CEST	53	56453	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.091434002 CEST	61707	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.103250980 CEST	53	61707	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.104024887 CEST	51771	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.117063999 CEST	53	51771	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.117809057 CEST	63424	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.129182100 CEST	53	63424	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.129972935 CEST	59763	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.140059948 CEST	53	59763	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.645587921 CEST	51687	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.660269976 CEST	53	51687	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.661075115 CEST	54056	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.902749062 CEST	53	54056	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.903548956 CEST	56306	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.914294958 CEST	53	56306	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.915522099 CEST	62751	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:16.926187038 CEST	53	62751	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:16.927206039 CEST	56796	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:17.175543070 CEST	53	56796	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:17.176739931 CEST	60247	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:17.191059113 CEST	53	60247	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:17.878387928 CEST	60349	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:18.120208025 CEST	53	60349	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:18.121047020 CEST	59912	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:18.132384062 CEST	53	59912	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:18.133156061 CEST	54690	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:18.145858049 CEST	53	54690	1.1.1.1	192.168.2.8
Aug 5, 2024 16:38:18.146609068 CEST	58731	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:38:18.157897949 CEST	53	58731	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 16:36:39.353005886 CEST	192.168.2.8	1.1.1.1	0x8c84	Standard query (0)	smokeclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.370682955 CEST	192.168.2.8	1.1.1.1	0x40e4	Standard query (0)	womangeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.612252951 CEST	192.168.2.8	1.1.1.1	0xa5da	Standard query (0)	smokegeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.856030941 CEST	192.168.2.8	1.1.1.1	0x7cf8	Standard query (0)	womaninclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.868695974 CEST	192.168.2.8	1.1.1.1	0x5a13	Standard query (0)	smokeinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.879074097 CEST	192.168.2.8	1.1.1.1	0xf8a9	Standard query (0)	womannorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.119795084 CEST	192.168.2.8	1.1.1.1	0x15ed	Standard query (0)	smokenorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.287440062 CEST	192.168.2.8	1.1.1.1	0x9c70	Standard query (0)	partyclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.298654079 CEST	192.168.2.8	1.1.1.1	0xfcb8	Standard query (0)	fightclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.541182995 CEST	192.168.2.8	1.1.1.1	0x31f9	Standard query (0)	partygeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.218976021 CEST	192.168.2.8	1.1.1.1	0xf574	Standard query (0)	fightgeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.236143112 CEST	192.168.2.8	1.1.1.1	0xe786	Standard query (0)	partyinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.479392052 CEST	192.168.2.8	1.1.1.1	0x427e	Standard query (0)	fightinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.488435984 CEST	192.168.2.8	1.1.1.1	0xe47b	Standard query (0)	partynorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.496673107 CEST	192.168.2.8	1.1.1.1	0xe3e2	Standard query (0)	fightnorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.753242016 CEST	192.168.2.8	1.1.1.1	0xa396	Standard query (0)	freshbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.001708984 CEST	192.168.2.8	1.1.1.1	0x5075	Standard query (0)	experiencebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.016551018 CEST	192.168.2.8	1.1.1.1	0x1d11	Standard query (0)	freshbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.028527021 CEST	192.168.2.8	1.1.1.1	0x770	Standard query (0)	experiencebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.041399002 CEST	192.168.2.8	1.1.1.1	0x311a	Standard query (0)	freshreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.059204102 CEST	192.168.2.8	1.1.1.1	0x13bf	Standard query (0)	experiencereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.319832087 CEST	192.168.2.8	1.1.1.1	0xba01	Standard query (0)	freshquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.331574917 CEST	192.168.2.8	1.1.1.1	0xea77	Standard query (0)	experiencequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.575365067 CEST	192.168.2.8	1.1.1.1	0x6dd9	Standard query (0)	gentlemanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.586740017 CEST	192.168.2.8	1.1.1.1	0x32cb	Standard query (0)	alreadybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.599143982 CEST	192.168.2.8	1.1.1.1	0x5306	Standard query (0)	gentlemanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.614051104 CEST	192.168.2.8	1.1.1.1	0x6caf	Standard query (0)	alreadybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.627573967 CEST	192.168.2.8	1.1.1.1	0xbe45	Standard query (0)	gentlemanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.639345884 CEST	192.168.2.8	1.1.1.1	0x1493	Standard query (0)	alreadyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.650440931 CEST	192.168.2.8	1.1.1.1	0x35cc	Standard query (0)	gentlemanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.667460918 CEST	192.168.2.8	1.1.1.1	0x7027	Standard query (0)	alreadyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.683355093 CEST	192.168.2.8	1.1.1.1	0xf224	Standard query (0)	followbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.694165945 CEST	192.168.2.8	1.1.1.1	0xc09	Standard query (0)	memberbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.705434084 CEST	192.168.2.8	1.1.1.1	0x44dc	Standard query (0)	followbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.717470884 CEST	192.168.2.8	1.1.1.1	0x8bd7	Standard query (0)	memberbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.730122089 CEST	192.168.2.8	1.1.1.1	0xd2f9	Standard query (0)	followreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.743774891 CEST	192.168.2.8	1.1.1.1	0x2355	Standard query (0)	memberreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.678503990 CEST	192.168.2.8	1.1.1.1	0x8114	Standard query (0)	followquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.700141907 CEST	192.168.2.8	1.1.1.1	0x6443	Standard query (0)	memberquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.752810001 CEST	192.168.2.8	1.1.1.1	0x3845	Standard query (0)	beginbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.765305996 CEST	192.168.2.8	1.1.1.1	0xe433	Standard query (0)	knownbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.778363943 CEST	192.168.2.8	1.1.1.1	0xea7a	Standard query (0)	beginbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.017153978 CEST	192.168.2.8	1.1.1.1	0x3ab3	Standard query (0)	knownbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.029429913 CEST	192.168.2.8	1.1.1.1	0x8097	Standard query (0)	beginreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.279048920 CEST	192.168.2.8	1.1.1.1	0x35b6	Standard query (0)	knownreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.294002056 CEST	192.168.2.8	1.1.1.1	0x861b	Standard query (0)	beginquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.305530071 CEST	192.168.2.8	1.1.1.1	0x3333	Standard query (0)	knownquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.322985888 CEST	192.168.2.8	1.1.1.1	0x390b	Standard query (0)	summerbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.332981110 CEST	192.168.2.8	1.1.1.1	0x5141	Standard query (0)	crowdbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.581218958 CEST	192.168.2.8	1.1.1.1	0x14b6	Standard query (0)	summerbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.598520994 CEST	192.168.2.8	1.1.1.1	0x6331	Standard query (0)	crowdbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.609754086 CEST	192.168.2.8	1.1.1.1	0x82bd	Standard query (0)	summerreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.621823072 CEST	192.168.2.8	1.1.1.1	0x96c8	Standard query (0)	crowdreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.864295006 CEST	192.168.2.8	1.1.1.1	0x1938	Standard query (0)	summerquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.875132084 CEST	192.168.2.8	1.1.1.1	0x99e7	Standard query (0)	crowdquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.888422966 CEST	192.168.2.8	1.1.1.1	0x207b	Standard query (0)	thoughtbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.918513060 CEST	192.168.2.8	1.1.1.1	0xff51	Standard query (0)	waterbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.932651043 CEST	192.168.2.8	1.1.1.1	0x1daa	Standard query (0)	thoughtbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.945818901 CEST	192.168.2.8	1.1.1.1	0x6c04	Standard query (0)	waterbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.959244967 CEST	192.168.2.8	1.1.1.1	0x9a33	Standard query (0)	thoughtreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.971379042 CEST	192.168.2.8	1.1.1.1	0x3af	Standard query (0)	waterreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.982007027 CEST	192.168.2.8	1.1.1.1	0x7187	Standard query (0)	thoughtquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.160356045 CEST	192.168.2.8	1.1.1.1	0xf8f4	Standard query (0)	waterquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.171907902 CEST	192.168.2.8	1.1.1.1	0x2f0b	Standard query (0)	womanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.184082985 CEST	192.168.2.8	1.1.1.1	0xe4f5	Standard query (0)	smokebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.424618959 CEST	192.168.2.8	1.1.1.1	0x6d7e	Standard query (0)	womanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.942486048 CEST	192.168.2.8	1.1.1.1	0x3dbc	Standard query (0)	smokebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.954982996 CEST	192.168.2.8	1.1.1.1	0x359	Standard query (0)	womanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.199863911 CEST	192.168.2.8	1.1.1.1	0xd753	Standard query (0)	smokereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.211167097 CEST	192.168.2.8	1.1.1.1	0x8ff9	Standard query (0)	womanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.227523088 CEST	192.168.2.8	1.1.1.1	0xb38f	Standard query (0)	smokequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.247255087 CEST	192.168.2.8	1.1.1.1	0x4110	Standard query (0)	partybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.280801058 CEST	192.168.2.8	1.1.1.1	0x90da	Standard query (0)	fightbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.292835951 CEST	192.168.2.8	1.1.1.1	0x37af	Standard query (0)	partybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.100435019 CEST	192.168.2.8	1.1.1.1	0xd84	Standard query (0)	fightbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.111423016 CEST	192.168.2.8	1.1.1.1	0xff68	Standard query (0)	partyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.356029987 CEST	192.168.2.8	1.1.1.1	0x9407	Standard query (0)	fightreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.369904995 CEST	192.168.2.8	1.1.1.1	0x4f4	Standard query (0)	partyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.387667894 CEST	192.168.2.8	1.1.1.1	0xd298	Standard query (0)	fightquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.634262085 CEST	192.168.2.8	1.1.1.1	0x8360	Standard query (0)	freshhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.650899887 CEST	192.168.2.8	1.1.1.1	0xc4d5	Standard query (0)	experiencehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.663028955 CEST	192.168.2.8	1.1.1.1	0x93ee	Standard query (0)	freshneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.673784971 CEST	192.168.2.8	1.1.1.1	0x1d2c	Standard query (0)	experienceneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.687352896 CEST	192.168.2.8	1.1.1.1	0x8c51	Standard query (0)	freshsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.699014902 CEST	192.168.2.8	1.1.1.1	0xbb44	Standard query (0)	experiencesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.710701942 CEST	192.168.2.8	1.1.1.1	0x620f	Standard query (0)	freshtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.722073078 CEST	192.168.2.8	1.1.1.1	0x966b	Standard query (0)	experiencetrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.964668989 CEST	192.168.2.8	1.1.1.1	0xa003	Standard query (0)	gentlemanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.973030090 CEST	192.168.2.8	1.1.1.1	0x849d	Standard query (0)	alreadyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.217143059 CEST	192.168.2.8	1.1.1.1	0xede0	Standard query (0)	gentlemanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.228580952 CEST	192.168.2.8	1.1.1.1	0xae85	Standard query (0)	alreadyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.240248919 CEST	192.168.2.8	1.1.1.1	0xe524	Standard query (0)	gentlemansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.507904053 CEST	192.168.2.8	1.1.1.1	0xc5ff	Standard query (0)	alreadysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.520250082 CEST	192.168.2.8	1.1.1.1	0xbf93	Standard query (0)	gentlemantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.531650066 CEST	192.168.2.8	1.1.1.1	0x220c	Standard query (0)	alreadytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.543634892 CEST	192.168.2.8	1.1.1.1	0xe85	Standard query (0)	followhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.793900967 CEST	192.168.2.8	1.1.1.1	0x9bce	Standard query (0)	memberhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.805780888 CEST	192.168.2.8	1.1.1.1	0x2ad0	Standard query (0)	followneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.821552038 CEST	192.168.2.8	1.1.1.1	0x7a61	Standard query (0)	memberneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.833841085 CEST	192.168.2.8	1.1.1.1	0xacd1	Standard query (0)	followsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.850253105 CEST	192.168.2.8	1.1.1.1	0x2f34	Standard query (0)	membersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:50.547266960 CEST	192.168.2.8	1.1.1.1	0xb845	Standard query (0)	followtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:50.561996937 CEST	192.168.2.8	1.1.1.1	0x6ea7	Standard query (0)	membertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.042473078 CEST	192.168.2.8	1.1.1.1	0x7501	Standard query (0)	beginhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.294143915 CEST	192.168.2.8	1.1.1.1	0x582d	Standard query (0)	knownhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.537852049 CEST	192.168.2.8	1.1.1.1	0xabde	Standard query (0)	beginneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.787070990 CEST	192.168.2.8	1.1.1.1	0x1f4e	Standard query (0)	knownneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.802778959 CEST	192.168.2.8	1.1.1.1	0x8c0a	Standard query (0)	beginsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.814130068 CEST	192.168.2.8	1.1.1.1	0xf37	Standard query (0)	knownsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.825092077 CEST	192.168.2.8	1.1.1.1	0xb68a	Standard query (0)	begintrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.837702990 CEST	192.168.2.8	1.1.1.1	0xba61	Standard query (0)	knowntrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.089168072 CEST	192.168.2.8	1.1.1.1	0x3292	Standard query (0)	summerhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.101660967 CEST	192.168.2.8	1.1.1.1	0x8c2b	Standard query (0)	crowdhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.347357035 CEST	192.168.2.8	1.1.1.1	0xf4e6	Standard query (0)	summerneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.358875990 CEST	192.168.2.8	1.1.1.1	0x5b04	Standard query (0)	crowdneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.370096922 CEST	192.168.2.8	1.1.1.1	0xc28c	Standard query (0)	summersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.797898054 CEST	192.168.2.8	1.1.1.1	0xd01	Standard query (0)	crowdsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.811161041 CEST	192.168.2.8	1.1.1.1	0x3194	Standard query (0)	summertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.829648972 CEST	192.168.2.8	1.1.1.1	0xd224	Standard query (0)	crowdtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:53.791110039 CEST	192.168.2.8	1.1.1.1	0xc030	Standard query (0)	thoughthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:53.803234100 CEST	192.168.2.8	1.1.1.1	0xd321	Standard query (0)	waterhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:53.815788984 CEST	192.168.2.8	1.1.1.1	0x5f01	Standard query (0)	thoughtneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.056989908 CEST	192.168.2.8	1.1.1.1	0x30c5	Standard query (0)	waterneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.069430113 CEST	192.168.2.8	1.1.1.1	0x46cc	Standard query (0)	thoughtsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.858067989 CEST	192.168.2.8	1.1.1.1	0x8445	Standard query (0)	watersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:55.557658911 CEST	192.168.2.8	1.1.1.1	0x4f9f	Standard query (0)	thoughttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:55.569571972 CEST	192.168.2.8	1.1.1.1	0x2034	Standard query (0)	watertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:55.585674047 CEST	192.168.2.8	1.1.1.1	0xe854	Standard query (0)	womanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.539659023 CEST	192.168.2.8	1.1.1.1	0x896d	Standard query (0)	smokehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.553088903 CEST	192.168.2.8	1.1.1.1	0x538b	Standard query (0)	womanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.568094969 CEST	192.168.2.8	1.1.1.1	0x64f2	Standard query (0)	smokeneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.581495047 CEST	192.168.2.8	1.1.1.1	0x2764	Standard query (0)	womansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.595973969 CEST	192.168.2.8	1.1.1.1	0x3175	Standard query (0)	smokesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.609473944 CEST	192.168.2.8	1.1.1.1	0x5f99	Standard query (0)	womantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.622976065 CEST	192.168.2.8	1.1.1.1	0x792d	Standard query (0)	smoketrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.639790058 CEST	192.168.2.8	1.1.1.1	0x2562	Standard query (0)	partyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.654500961 CEST	192.168.2.8	1.1.1.1	0x6fe9	Standard query (0)	fighthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.899085045 CEST	192.168.2.8	1.1.1.1	0x31d5	Standard query (0)	partyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.913820982 CEST	192.168.2.8	1.1.1.1	0x93b1	Standard query (0)	fightneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.156533957 CEST	192.168.2.8	1.1.1.1	0x59d2	Standard query (0)	partysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.176954031 CEST	192.168.2.8	1.1.1.1	0x827e	Standard query (0)	fightsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.212913990 CEST	192.168.2.8	1.1.1.1	0xd58c	Standard query (0)	partytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.226860046 CEST	192.168.2.8	1.1.1.1	0x85f1	Standard query (0)	fighttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.387175083 CEST	192.168.2.8	1.1.1.1	0xe118	Standard query (0)	freshlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.634114027 CEST	192.168.2.8	1.1.1.1	0xb103	Standard query (0)	experiencelaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.646895885 CEST	192.168.2.8	1.1.1.1	0x4b	Standard query (0)	freshfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:58.610924959 CEST	192.168.2.8	1.1.1.1	0x58e2	Standard query (0)	experiencefancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:58.785491943 CEST	192.168.2.8	1.1.1.1	0xd46b	Standard query (0)	freshconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.029863119 CEST	192.168.2.8	1.1.1.1	0xed3a	Standard query (0)	experienceconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.041729927 CEST	192.168.2.8	1.1.1.1	0x8b5f	Standard query (0)	freshfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.055022955 CEST	192.168.2.8	1.1.1.1	0xdf34	Standard query (0)	experiencefriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.307311058 CEST	192.168.2.8	1.1.1.1	0x48d	Standard query (0)	gentlemanlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.318478107 CEST	192.168.2.8	1.1.1.1	0xfc4e	Standard query (0)	alreadylaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.332151890 CEST	192.168.2.8	1.1.1.1	0xadac	Standard query (0)	gentlemanfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.345741987 CEST	192.168.2.8	1.1.1.1	0x697f	Standard query (0)	alreadyfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.357644081 CEST	192.168.2.8	1.1.1.1	0x74bf	Standard query (0)	gentlemanconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.368601084 CEST	192.168.2.8	1.1.1.1	0xd76e	Standard query (0)	alreadyconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.610183001 CEST	192.168.2.8	1.1.1.1	0xf840	Standard query (0)	gentlemanfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.865206957 CEST	192.168.2.8	1.1.1.1	0xdef4	Standard query (0)	alreadyfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:00.907918930 CEST	192.168.2.8	1.1.1.1	0x2a0a	Standard query (0)	followlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.235503912 CEST	192.168.2.8	1.1.1.1	0xd999	Standard query (0)	memberlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.247356892 CEST	192.168.2.8	1.1.1.1	0xde29	Standard query (0)	followfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.266585112 CEST	192.168.2.8	1.1.1.1	0xa401	Standard query (0)	memberfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.510814905 CEST	192.168.2.8	1.1.1.1	0x65b5	Standard query (0)	followconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.524280071 CEST	192.168.2.8	1.1.1.1	0x2520	Standard query (0)	memberconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.538729906 CEST	192.168.2.8	1.1.1.1	0xc37a	Standard query (0)	followfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:02.573220015 CEST	192.168.2.8	1.1.1.1	0xf611	Standard query (0)	memberfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:02.818362951 CEST	192.168.2.8	1.1.1.1	0xc68f	Standard query (0)	beginlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:03.069844961 CEST	192.168.2.8	1.1.1.1	0x5750	Standard query (0)	knownlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:03.082120895 CEST	192.168.2.8	1.1.1.1	0x610c	Standard query (0)	beginfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.428836107 CEST	192.168.2.8	1.1.1.1	0x5c02	Standard query (0)	smokeclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.674669027 CEST	192.168.2.8	1.1.1.1	0x308f	Standard query (0)	womangeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.928169966 CEST	192.168.2.8	1.1.1.1	0xc24a	Standard query (0)	smokegeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.941281080 CEST	192.168.2.8	1.1.1.1	0x6718	Standard query (0)	womaninclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.953811884 CEST	192.168.2.8	1.1.1.1	0x72bf	Standard query (0)	smokeinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.966114044 CEST	192.168.2.8	1.1.1.1	0xc648	Standard query (0)	womannorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.978588104 CEST	192.168.2.8	1.1.1.1	0x9804	Standard query (0)	smokenorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.231544971 CEST	192.168.2.8	1.1.1.1	0x3a25	Standard query (0)	partyclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.247298956 CEST	192.168.2.8	1.1.1.1	0x8d4b	Standard query (0)	fightclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.772082090 CEST	192.168.2.8	1.1.1.1	0x6cd6	Standard query (0)	fightgeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.783575058 CEST	192.168.2.8	1.1.1.1	0xc2f	Standard query (0)	partyinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.795322895 CEST	192.168.2.8	1.1.1.1	0xd7	Standard query (0)	fightinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.040324926 CEST	192.168.2.8	1.1.1.1	0x7ed8	Standard query (0)	partynorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.052227974 CEST	192.168.2.8	1.1.1.1	0xef46	Standard query (0)	fightnorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.063220978 CEST	192.168.2.8	1.1.1.1	0x344f	Standard query (0)	freshbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.075149059 CEST	192.168.2.8	1.1.1.1	0x3fb	Standard query (0)	experiencebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.089663982 CEST	192.168.2.8	1.1.1.1	0x5901	Standard query (0)	freshbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.101142883 CEST	192.168.2.8	1.1.1.1	0x880f	Standard query (0)	experiencebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.118431091 CEST	192.168.2.8	1.1.1.1	0xe3b4	Standard query (0)	freshreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.135755062 CEST	192.168.2.8	1.1.1.1	0x8b82	Standard query (0)	experiencereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.387303114 CEST	192.168.2.8	1.1.1.1	0x168d	Standard query (0)	freshquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.399113894 CEST	192.168.2.8	1.1.1.1	0x9d3c	Standard query (0)	experiencequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.417169094 CEST	192.168.2.8	1.1.1.1	0xb3ea	Standard query (0)	gentlemanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.429300070 CEST	192.168.2.8	1.1.1.1	0x7de8	Standard query (0)	alreadybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.441529989 CEST	192.168.2.8	1.1.1.1	0x5c5e	Standard query (0)	gentlemanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.459481001 CEST	192.168.2.8	1.1.1.1	0xb3f9	Standard query (0)	alreadybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.701643944 CEST	192.168.2.8	1.1.1.1	0x768a	Standard query (0)	gentlemanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.756491899 CEST	192.168.2.8	1.1.1.1	0x4c79	Standard query (0)	alreadyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.767684937 CEST	192.168.2.8	1.1.1.1	0xc27e	Standard query (0)	gentlemanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.778903008 CEST	192.168.2.8	1.1.1.1	0xab1a	Standard query (0)	alreadyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.790527105 CEST	192.168.2.8	1.1.1.1	0xe776	Standard query (0)	followbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.800203085 CEST	192.168.2.8	1.1.1.1	0xb007	Standard query (0)	memberbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.813172102 CEST	192.168.2.8	1.1.1.1	0x137f	Standard query (0)	followbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.829050064 CEST	192.168.2.8	1.1.1.1	0x7dc0	Standard query (0)	memberbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.075073004 CEST	192.168.2.8	1.1.1.1	0xa9e1	Standard query (0)	followreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.888679981 CEST	192.168.2.8	1.1.1.1	0xa60e	Standard query (0)	followquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.901315928 CEST	192.168.2.8	1.1.1.1	0x5060	Standard query (0)	memberquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.914385080 CEST	192.168.2.8	1.1.1.1	0xd899	Standard query (0)	beginbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.156696081 CEST	192.168.2.8	1.1.1.1	0x604d	Standard query (0)	knownbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.168790102 CEST	192.168.2.8	1.1.1.1	0xae39	Standard query (0)	beginbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.180885077 CEST	192.168.2.8	1.1.1.1	0xa4a5	Standard query (0)	knownbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.353596926 CEST	192.168.2.8	1.1.1.1	0x2f8a	Standard query (0)	beginreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.598681927 CEST	192.168.2.8	1.1.1.1	0x4f81	Standard query (0)	knownreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.619714975 CEST	192.168.2.8	1.1.1.1	0xea2c	Standard query (0)	beginquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.633131027 CEST	192.168.2.8	1.1.1.1	0x364f	Standard query (0)	knownquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.645250082 CEST	192.168.2.8	1.1.1.1	0x542e	Standard query (0)	summerbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.662019968 CEST	192.168.2.8	1.1.1.1	0x6d8d	Standard query (0)	crowdbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.680368900 CEST	192.168.2.8	1.1.1.1	0x567c	Standard query (0)	summerbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.693762064 CEST	192.168.2.8	1.1.1.1	0xee5d	Standard query (0)	crowdbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.707885027 CEST	192.168.2.8	1.1.1.1	0x5b10	Standard query (0)	summerreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.720900059 CEST	192.168.2.8	1.1.1.1	0xbc0	Standard query (0)	crowdreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.971864939 CEST	192.168.2.8	1.1.1.1	0x573e	Standard query (0)	summerquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.986692905 CEST	192.168.2.8	1.1.1.1	0x6268	Standard query (0)	crowdquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.786472082 CEST	192.168.2.8	1.1.1.1	0x54c6	Standard query (0)	waterbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.955905914 CEST	192.168.2.8	1.1.1.1	0xc3cc	Standard query (0)	thoughtbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.967715025 CEST	192.168.2.8	1.1.1.1	0x1dd1	Standard query (0)	waterbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.981921911 CEST	192.168.2.8	1.1.1.1	0xf04f	Standard query (0)	thoughtreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.995558977 CEST	192.168.2.8	1.1.1.1	0xa661	Standard query (0)	waterreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.008308887 CEST	192.168.2.8	1.1.1.1	0x25bd	Standard query (0)	thoughtquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.020165920 CEST	192.168.2.8	1.1.1.1	0xd781	Standard query (0)	waterquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.032104015 CEST	192.168.2.8	1.1.1.1	0x9a24	Standard query (0)	womanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.276165009 CEST	192.168.2.8	1.1.1.1	0x193e	Standard query (0)	smokebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.009152889 CEST	192.168.2.8	1.1.1.1	0x8ded	Standard query (0)	smokebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.020471096 CEST	192.168.2.8	1.1.1.1	0x5480	Standard query (0)	womanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.271404982 CEST	192.168.2.8	1.1.1.1	0x40c5	Standard query (0)	smokereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.286155939 CEST	192.168.2.8	1.1.1.1	0x223	Standard query (0)	womanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.298084021 CEST	192.168.2.8	1.1.1.1	0x76d5	Standard query (0)	smokequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.543216944 CEST	192.168.2.8	1.1.1.1	0x5501	Standard query (0)	partybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.796159983 CEST	192.168.2.8	1.1.1.1	0x4cf5	Standard query (0)	fightbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.284837008 CEST	192.168.2.8	1.1.1.1	0x561b	Standard query (0)	fightbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.528462887 CEST	192.168.2.8	1.1.1.1	0xa0ac	Standard query (0)	partyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.771229982 CEST	192.168.2.8	1.1.1.1	0xdc5d	Standard query (0)	fightreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.782999039 CEST	192.168.2.8	1.1.1.1	0xcd94	Standard query (0)	partyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.796008110 CEST	192.168.2.8	1.1.1.1	0xe5eb	Standard query (0)	fightquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.038474083 CEST	192.168.2.8	1.1.1.1	0x1901	Standard query (0)	freshhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.052314997 CEST	192.168.2.8	1.1.1.1	0xf747	Standard query (0)	experiencehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.068372965 CEST	192.168.2.8	1.1.1.1	0x7f18	Standard query (0)	freshneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.080666065 CEST	192.168.2.8	1.1.1.1	0xec21	Standard query (0)	experienceneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.092946053 CEST	192.168.2.8	1.1.1.1	0x5746	Standard query (0)	freshsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.105006933 CEST	192.168.2.8	1.1.1.1	0x2cf2	Standard query (0)	experiencesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.351753950 CEST	192.168.2.8	1.1.1.1	0xcdc	Standard query (0)	freshtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.367357016 CEST	192.168.2.8	1.1.1.1	0x7c1e	Standard query (0)	experiencetrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.611430883 CEST	192.168.2.8	1.1.1.1	0xab9c	Standard query (0)	gentlemanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.854162931 CEST	192.168.2.8	1.1.1.1	0x7b7e	Standard query (0)	alreadyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.867189884 CEST	192.168.2.8	1.1.1.1	0x4d18	Standard query (0)	gentlemanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.115150928 CEST	192.168.2.8	1.1.1.1	0xa064	Standard query (0)	alreadyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.126703978 CEST	192.168.2.8	1.1.1.1	0x3444	Standard query (0)	gentlemansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.139151096 CEST	192.168.2.8	1.1.1.1	0x63c3	Standard query (0)	alreadysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.150753021 CEST	192.168.2.8	1.1.1.1	0x3d4e	Standard query (0)	gentlemantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.404272079 CEST	192.168.2.8	1.1.1.1	0xcc57	Standard query (0)	alreadytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.648349047 CEST	192.168.2.8	1.1.1.1	0x9fa3	Standard query (0)	followhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.814178944 CEST	192.168.2.8	1.1.1.1	0xfa02	Standard query (0)	memberhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.829015017 CEST	192.168.2.8	1.1.1.1	0x1b16	Standard query (0)	followneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.841326952 CEST	192.168.2.8	1.1.1.1	0x9a4b	Standard query (0)	memberneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:08.083017111 CEST	192.168.2.8	1.1.1.1	0x72ec	Standard query (0)	followsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:08.756918907 CEST	192.168.2.8	1.1.1.1	0xeadd	Standard query (0)	followtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.241879940 CEST	192.168.2.8	1.1.1.1	0x6c32	Standard query (0)	beginhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.253295898 CEST	192.168.2.8	1.1.1.1	0x60b6	Standard query (0)	knownhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.495203972 CEST	192.168.2.8	1.1.1.1	0x3075	Standard query (0)	beginneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.508620977 CEST	192.168.2.8	1.1.1.1	0x5a00	Standard query (0)	knownneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.523475885 CEST	192.168.2.8	1.1.1.1	0xe56c	Standard query (0)	beginsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.537851095 CEST	192.168.2.8	1.1.1.1	0xbe2e	Standard query (0)	knownsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.550875902 CEST	192.168.2.8	1.1.1.1	0x2439	Standard query (0)	begintrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.563930035 CEST	192.168.2.8	1.1.1.1	0xff4b	Standard query (0)	knowntrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.575917959 CEST	192.168.2.8	1.1.1.1	0xca31	Standard query (0)	summerhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.586576939 CEST	192.168.2.8	1.1.1.1	0x6712	Standard query (0)	crowdhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.829626083 CEST	192.168.2.8	1.1.1.1	0xda55	Standard query (0)	summerneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.080786943 CEST	192.168.2.8	1.1.1.1	0x1776	Standard query (0)	crowdneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.093772888 CEST	192.168.2.8	1.1.1.1	0xe088	Standard query (0)	summersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.107048988 CEST	192.168.2.8	1.1.1.1	0xd1aa	Standard query (0)	crowdsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.118805885 CEST	192.168.2.8	1.1.1.1	0x9af6	Standard query (0)	summertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.788712025 CEST	192.168.2.8	1.1.1.1	0xdaf2	Standard query (0)	thoughthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.951293945 CEST	192.168.2.8	1.1.1.1	0x7387	Standard query (0)	waterhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.965055943 CEST	192.168.2.8	1.1.1.1	0xae34	Standard query (0)	thoughtneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.980199099 CEST	192.168.2.8	1.1.1.1	0xaa28	Standard query (0)	waterneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:12.237627029 CEST	192.168.2.8	1.1.1.1	0xf6d	Standard query (0)	thoughttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:12.250858068 CEST	192.168.2.8	1.1.1.1	0x291c	Standard query (0)	watertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.015707016 CEST	192.168.2.8	1.1.1.1	0xaffe	Standard query (0)	smokehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.027214050 CEST	192.168.2.8	1.1.1.1	0xb17c	Standard query (0)	womanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.044538021 CEST	192.168.2.8	1.1.1.1	0xcebd	Standard query (0)	smokeneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.057059050 CEST	192.168.2.8	1.1.1.1	0x5376	Standard query (0)	womansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.299190998 CEST	192.168.2.8	1.1.1.1	0x53f	Standard query (0)	smokesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.311497927 CEST	192.168.2.8	1.1.1.1	0xc9f4	Standard query (0)	womantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.556307077 CEST	192.168.2.8	1.1.1.1	0xd5	Standard query (0)	smoketrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.567822933 CEST	192.168.2.8	1.1.1.1	0xb081	Standard query (0)	partyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.821393967 CEST	192.168.2.8	1.1.1.1	0x5b70	Standard query (0)	fighthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.833159924 CEST	192.168.2.8	1.1.1.1	0x30f8	Standard query (0)	partyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.995239973 CEST	192.168.2.8	1.1.1.1	0xb098	Standard query (0)	fightneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.245342016 CEST	192.168.2.8	1.1.1.1	0x4234	Standard query (0)	partysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.257494926 CEST	192.168.2.8	1.1.1.1	0x3889	Standard query (0)	fightsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.291631937 CEST	192.168.2.8	1.1.1.1	0x9fe3	Standard query (0)	partytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.537060976 CEST	192.168.2.8	1.1.1.1	0x2a72	Standard query (0)	fighttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.551336050 CEST	192.168.2.8	1.1.1.1	0x7288	Standard query (0)	freshlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.796035051 CEST	192.168.2.8	1.1.1.1	0xcb3d	Standard query (0)	experiencelaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:15.756539106 CEST	192.168.2.8	1.1.1.1	0x17c9	Standard query (0)	experiencefancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:15.770070076 CEST	192.168.2.8	1.1.1.1	0xf21b	Standard query (0)	freshconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:15.784178019 CEST	192.168.2.8	1.1.1.1	0x2631	Standard query (0)	experienceconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.028703928 CEST	192.168.2.8	1.1.1.1	0x526f	Standard query (0)	freshfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.041012049 CEST	192.168.2.8	1.1.1.1	0x1d4a	Standard query (0)	experiencefriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.053503990 CEST	192.168.2.8	1.1.1.1	0xf291	Standard query (0)	gentlemanlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.064435005 CEST	192.168.2.8	1.1.1.1	0x2b29	Standard query (0)	alreadylaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.077012062 CEST	192.168.2.8	1.1.1.1	0x9313	Standard query (0)	gentlemanfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.091434002 CEST	192.168.2.8	1.1.1.1	0xedee	Standard query (0)	alreadyfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.104024887 CEST	192.168.2.8	1.1.1.1	0x1d3	Standard query (0)	gentlemanconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.117809057 CEST	192.168.2.8	1.1.1.1	0xa2b9	Standard query (0)	alreadyconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.129972935 CEST	192.168.2.8	1.1.1.1	0xea7d	Standard query (0)	gentlemanfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.645587921 CEST	192.168.2.8	1.1.1.1	0xa449	Standard query (0)	followlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.661075115 CEST	192.168.2.8	1.1.1.1	0x23e7	Standard query (0)	memberlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.903548956 CEST	192.168.2.8	1.1.1.1	0x5e39	Standard query (0)	followfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.915522099 CEST	192.168.2.8	1.1.1.1	0x1717	Standard query (0)	memberfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.927206039 CEST	192.168.2.8	1.1.1.1	0xac98	Standard query (0)	followconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:17.176739931 CEST	192.168.2.8	1.1.1.1	0x269f	Standard query (0)	memberconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:17.878387928 CEST	192.168.2.8	1.1.1.1	0xebfa	Standard query (0)	memberfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.121047020 CEST	192.168.2.8	1.1.1.1	0xaf2a	Standard query (0)	beginlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.133156061 CEST	192.168.2.8	1.1.1.1	0x2632	Standard query (0)	knownlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.146609068 CEST	192.168.2.8	1.1.1.1	0x7fb	Standard query (0)	beginfancy.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 16:36:39.368855000 CEST	1.1.1.1	192.168.2.8	0x8c84	Name error (3)	smokeclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.611361027 CEST	1.1.1.1	192.168.2.8	0x40e4	Name error (3)	womangeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.854981899 CEST	1.1.1.1	192.168.2.8	0xa5da	Name error (3)	smokegeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.867891073 CEST	1.1.1.1	192.168.2.8	0x7cf8	Name error (3)	womaninclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:39.878309011 CEST	1.1.1.1	192.168.2.8	0x5a13	Name error (3)	smokeinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.118793011 CEST	1.1.1.1	192.168.2.8	0xf8a9	Name error (3)	womannorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.286669970 CEST	1.1.1.1	192.168.2.8	0x15ed	Name error (3)	smokenorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.297940969 CEST	1.1.1.1	192.168.2.8	0x9c70	Name error (3)	partyclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.540282011 CEST	1.1.1.1	192.168.2.8	0xfcb8	Name error (3)	fightclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.552257061 CEST	1.1.1.1	192.168.2.8	0x31f9	No error (0)	partygeneral.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:40.552257061 CEST	1.1.1.1	192.168.2.8	0x31f9	No error (0)	partygeneral.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.235057116 CEST	1.1.1.1	192.168.2.8	0xf574	Name error (3)	fightgeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.478492022 CEST	1.1.1.1	192.168.2.8	0xe786	Name error (3)	partyinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.487771988 CEST	1.1.1.1	192.168.2.8	0x427e	Name error (3)	fightinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.496058941 CEST	1.1.1.1	192.168.2.8	0xe47b	Name error (3)	partynorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:41.752202988 CEST	1.1.1.1	192.168.2.8	0xe3e2	Name error (3)	fightnorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.000659943 CEST	1.1.1.1	192.168.2.8	0xa396	Name error (3)	freshbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.015692949 CEST	1.1.1.1	192.168.2.8	0x5075	Name error (3)	experiencebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.027812004 CEST	1.1.1.1	192.168.2.8	0x1d11	Name error (3)	freshbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.040721893 CEST	1.1.1.1	192.168.2.8	0x770	Name error (3)	experiencebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.058551073 CEST	1.1.1.1	192.168.2.8	0x311a	Name error (3)	freshreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.318908930 CEST	1.1.1.1	192.168.2.8	0x13bf	Name error (3)	experiencereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.330058098 CEST	1.1.1.1	192.168.2.8	0xba01	Name error (3)	freshquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.574553013 CEST	1.1.1.1	192.168.2.8	0xea77	Name error (3)	experiencequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.586019993 CEST	1.1.1.1	192.168.2.8	0x6dd9	Name error (3)	gentlemanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.598232031 CEST	1.1.1.1	192.168.2.8	0x32cb	Name error (3)	alreadybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.613347054 CEST	1.1.1.1	192.168.2.8	0x5306	Name error (3)	gentlemanbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.625917912 CEST	1.1.1.1	192.168.2.8	0x6caf	Name error (3)	alreadybelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.638657093 CEST	1.1.1.1	192.168.2.8	0xbe45	Name error (3)	gentlemanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.649710894 CEST	1.1.1.1	192.168.2.8	0x1493	Name error (3)	alreadyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.666552067 CEST	1.1.1.1	192.168.2.8	0x35cc	Name error (3)	gentlemanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.680490017 CEST	1.1.1.1	192.168.2.8	0x7027	Name error (3)	alreadyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.693288088 CEST	1.1.1.1	192.168.2.8	0xf224	Name error (3)	followbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.704880953 CEST	1.1.1.1	192.168.2.8	0xc09	Name error (3)	memberbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.716902971 CEST	1.1.1.1	192.168.2.8	0x44dc	Name error (3)	followbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.729437113 CEST	1.1.1.1	192.168.2.8	0x8bd7	Name error (3)	memberbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.743010044 CEST	1.1.1.1	192.168.2.8	0xd2f9	Name error (3)	followreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:42.933907986 CEST	1.1.1.1	192.168.2.8	0x2355	No error (0)	memberreceive.net		35.164.78.200	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.692328930 CEST	1.1.1.1	192.168.2.8	0x8114	Name error (3)	followquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.752058983 CEST	1.1.1.1	192.168.2.8	0x6443	Name error (3)	memberquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.764357090 CEST	1.1.1.1	192.168.2.8	0x3845	Name error (3)	beginbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:43.777448893 CEST	1.1.1.1	192.168.2.8	0xe433	Name error (3)	knownbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.015759945 CEST	1.1.1.1	192.168.2.8	0xea7a	Name error (3)	beginbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.028564930 CEST	1.1.1.1	192.168.2.8	0x3ab3	Name error (3)	knownbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.278059959 CEST	1.1.1.1	192.168.2.8	0x8097	Name error (3)	beginreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.293302059 CEST	1.1.1.1	192.168.2.8	0x35b6	Name error (3)	knownreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.304867029 CEST	1.1.1.1	192.168.2.8	0x861b	Name error (3)	beginquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.322139025 CEST	1.1.1.1	192.168.2.8	0x3333	Name error (3)	knownquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.332329035 CEST	1.1.1.1	192.168.2.8	0x390b	Name error (3)	summerbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.580202103 CEST	1.1.1.1	192.168.2.8	0x5141	Name error (3)	crowdbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.597767115 CEST	1.1.1.1	192.168.2.8	0x14b6	Name error (3)	summerbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.608977079 CEST	1.1.1.1	192.168.2.8	0x6331	Name error (3)	crowdbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.621057987 CEST	1.1.1.1	192.168.2.8	0x82bd	Name error (3)	summerreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.863224030 CEST	1.1.1.1	192.168.2.8	0x96c8	Name error (3)	crowdreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.874325991 CEST	1.1.1.1	192.168.2.8	0x1938	Name error (3)	summerquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:44.887716055 CEST	1.1.1.1	192.168.2.8	0x99e7	Name error (3)	crowdquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.091850996 CEST	1.1.1.1	192.168.2.8	0x207b	No error (0)	thoughtbranch.net		34.246.200.160	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.931898117 CEST	1.1.1.1	192.168.2.8	0xff51	Name error (3)	waterbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.944937944 CEST	1.1.1.1	192.168.2.8	0x1daa	Name error (3)	thoughtbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.958379984 CEST	1.1.1.1	192.168.2.8	0x6c04	Name error (3)	waterbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.970640898 CEST	1.1.1.1	192.168.2.8	0x9a33	Name error (3)	thoughtreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:45.981431007 CEST	1.1.1.1	192.168.2.8	0x3af	Name error (3)	waterreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.159359932 CEST	1.1.1.1	192.168.2.8	0x7187	Name error (3)	thoughtquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.170938969 CEST	1.1.1.1	192.168.2.8	0xf8f4	Name error (3)	waterquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.183216095 CEST	1.1.1.1	192.168.2.8	0x2f0b	Name error (3)	womanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.423681021 CEST	1.1.1.1	192.168.2.8	0xe4f5	Name error (3)	smokebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.437474966 CEST	1.1.1.1	192.168.2.8	0x6d7e	No error (0)	womanbelieve.net		15.197.142.173	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.437474966 CEST	1.1.1.1	192.168.2.8	0x6d7e	No error (0)	womanbelieve.net		3.33.152.147	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:46.954034090 CEST	1.1.1.1	192.168.2.8	0x3dbc	Name error (3)	smokebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.198570967 CEST	1.1.1.1	192.168.2.8	0x359	Name error (3)	womanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.210464001 CEST	1.1.1.1	192.168.2.8	0xd753	Name error (3)	smokereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.226707935 CEST	1.1.1.1	192.168.2.8	0x8ff9	Name error (3)	womanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.246351957 CEST	1.1.1.1	192.168.2.8	0xb38f	Name error (3)	smokequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.279947042 CEST	1.1.1.1	192.168.2.8	0x4110	Name error (3)	partybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.291918039 CEST	1.1.1.1	192.168.2.8	0x90da	Name error (3)	fightbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:47.628916979 CEST	1.1.1.1	192.168.2.8	0x37af	No error (0)	partybelieve.net		15.197.192.55	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.110498905 CEST	1.1.1.1	192.168.2.8	0xd84	Name error (3)	fightbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.355052948 CEST	1.1.1.1	192.168.2.8	0xff68	Name error (3)	partyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.369045973 CEST	1.1.1.1	192.168.2.8	0x9407	Name error (3)	fightreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.386740923 CEST	1.1.1.1	192.168.2.8	0x4f4	Name error (3)	partyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.633297920 CEST	1.1.1.1	192.168.2.8	0xd298	Name error (3)	fightquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.649682999 CEST	1.1.1.1	192.168.2.8	0x8360	Name error (3)	freshhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.662101984 CEST	1.1.1.1	192.168.2.8	0xc4d5	Name error (3)	experiencehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.673151016 CEST	1.1.1.1	192.168.2.8	0x93ee	Name error (3)	freshneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.686657906 CEST	1.1.1.1	192.168.2.8	0x1d2c	Name error (3)	experienceneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.698379040 CEST	1.1.1.1	192.168.2.8	0x8c51	Name error (3)	freshsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.709713936 CEST	1.1.1.1	192.168.2.8	0xbb44	Name error (3)	experiencesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.721396923 CEST	1.1.1.1	192.168.2.8	0x620f	Name error (3)	freshtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.963458061 CEST	1.1.1.1	192.168.2.8	0x966b	Name error (3)	experiencetrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:48.972209930 CEST	1.1.1.1	192.168.2.8	0xa003	Name error (3)	gentlemanhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.215868950 CEST	1.1.1.1	192.168.2.8	0x849d	Name error (3)	alreadyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.227722883 CEST	1.1.1.1	192.168.2.8	0xede0	Name error (3)	gentlemanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.239301920 CEST	1.1.1.1	192.168.2.8	0xae85	Name error (3)	alreadyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.506944895 CEST	1.1.1.1	192.168.2.8	0xe524	Name error (3)	gentlemansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.519426107 CEST	1.1.1.1	192.168.2.8	0xc5ff	Name error (3)	alreadysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.530726910 CEST	1.1.1.1	192.168.2.8	0xbf93	Name error (3)	gentlemantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.542201042 CEST	1.1.1.1	192.168.2.8	0x220c	Name error (3)	alreadytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.792819977 CEST	1.1.1.1	192.168.2.8	0xe85	Name error (3)	followhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.804862022 CEST	1.1.1.1	192.168.2.8	0x9bce	Name error (3)	memberhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.818869114 CEST	1.1.1.1	192.168.2.8	0x2ad0	Name error (3)	followneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.832920074 CEST	1.1.1.1	192.168.2.8	0x7a61	Name error (3)	memberneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.846533060 CEST	1.1.1.1	192.168.2.8	0xacd1	Name error (3)	followsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:49.884671926 CEST	1.1.1.1	192.168.2.8	0x2f34	No error (0)	membersystem.net		85.13.130.3	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:50.560969114 CEST	1.1.1.1	192.168.2.8	0xb845	Name error (3)	followtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:50.576527119 CEST	1.1.1.1	192.168.2.8	0x6ea7	No error (0)	membertrust.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:50.576527119 CEST	1.1.1.1	192.168.2.8	0x6ea7	No error (0)	membertrust.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.292993069 CEST	1.1.1.1	192.168.2.8	0x7501	Name error (3)	beginhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.536947012 CEST	1.1.1.1	192.168.2.8	0x582d	Name error (3)	knownhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.786314011 CEST	1.1.1.1	192.168.2.8	0xabde	Name error (3)	beginneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.802022934 CEST	1.1.1.1	192.168.2.8	0x1f4e	Name error (3)	knownneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.813405037 CEST	1.1.1.1	192.168.2.8	0x8c0a	Name error (3)	beginsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.824346066 CEST	1.1.1.1	192.168.2.8	0xf37	Name error (3)	knownsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:51.836872101 CEST	1.1.1.1	192.168.2.8	0xb68a	Name error (3)	begintrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.088181973 CEST	1.1.1.1	192.168.2.8	0xba61	Name error (3)	knowntrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.100846052 CEST	1.1.1.1	192.168.2.8	0x3292	Name error (3)	summerhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.346534014 CEST	1.1.1.1	192.168.2.8	0x8c2b	Name error (3)	crowdhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.358089924 CEST	1.1.1.1	192.168.2.8	0xf4e6	Name error (3)	summerneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.369129896 CEST	1.1.1.1	192.168.2.8	0x5b04	Name error (3)	crowdneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.796561003 CEST	1.1.1.1	192.168.2.8	0xc28c	Name error (3)	summersystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.810426950 CEST	1.1.1.1	192.168.2.8	0xd01	Name error (3)	crowdsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:52.823853970 CEST	1.1.1.1	192.168.2.8	0x3194	Name error (3)	summertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:53.277653933 CEST	1.1.1.1	192.168.2.8	0xd224	No error (0)	crowdtrust.net		170.187.200.48	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:53.802386999 CEST	1.1.1.1	192.168.2.8	0xc030	Name error (3)	thoughthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:53.814697027 CEST	1.1.1.1	192.168.2.8	0xd321	Name error (3)	waterhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.055990934 CEST	1.1.1.1	192.168.2.8	0x5f01	Name error (3)	thoughtneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.068696022 CEST	1.1.1.1	192.168.2.8	0x30c5	Name error (3)	waterneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.105180025 CEST	1.1.1.1	192.168.2.8	0x46cc	No error (0)	thoughtsystem.net		213.171.195.105	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:54.886974096 CEST	1.1.1.1	192.168.2.8	0x8445	No error (0)	watersystem.net		64.190.63.222	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:55.568685055 CEST	1.1.1.1	192.168.2.8	0x4f9f	Name error (3)	thoughttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:55.584660053 CEST	1.1.1.1	192.168.2.8	0x2034	Name error (3)	watertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:55.785990953 CEST	1.1.1.1	192.168.2.8	0xe854	No error (0)	womanhonor.net		54.244.188.177	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.552134037 CEST	1.1.1.1	192.168.2.8	0x896d	Name error (3)	smokehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.567317963 CEST	1.1.1.1	192.168.2.8	0x538b	Name error (3)	womanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.580863953 CEST	1.1.1.1	192.168.2.8	0x64f2	Name error (3)	smokeneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.595370054 CEST	1.1.1.1	192.168.2.8	0x2764	Name error (3)	womansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.608808041 CEST	1.1.1.1	192.168.2.8	0x3175	Name error (3)	smokesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.621980906 CEST	1.1.1.1	192.168.2.8	0x5f99	Name error (3)	womantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.638958931 CEST	1.1.1.1	192.168.2.8	0x792d	Name error (3)	smoketrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.653503895 CEST	1.1.1.1	192.168.2.8	0x2562	Name error (3)	partyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.897937059 CEST	1.1.1.1	192.168.2.8	0x6fe9	Name error (3)	fighthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:56.912920952 CEST	1.1.1.1	192.168.2.8	0x31d5	Name error (3)	partyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.155175924 CEST	1.1.1.1	192.168.2.8	0x93b1	Name error (3)	fightneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.175685883 CEST	1.1.1.1	192.168.2.8	0x59d2	Name error (3)	partysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.225847960 CEST	1.1.1.1	192.168.2.8	0xd58c	Name error (3)	partytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.386040926 CEST	1.1.1.1	192.168.2.8	0x85f1	Name error (3)	fighttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.633265972 CEST	1.1.1.1	192.168.2.8	0xe118	Name error (3)	freshlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.646018982 CEST	1.1.1.1	192.168.2.8	0xb103	Name error (3)	experiencelaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:57.675052881 CEST	1.1.1.1	192.168.2.8	0x4b	No error (0)	freshfancy.net		81.169.145.88	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:58.784452915 CEST	1.1.1.1	192.168.2.8	0x58e2	Name error (3)	experiencefancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.028749943 CEST	1.1.1.1	192.168.2.8	0xd46b	Name error (3)	freshconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.040896893 CEST	1.1.1.1	192.168.2.8	0xed3a	Name error (3)	experienceconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.054090977 CEST	1.1.1.1	192.168.2.8	0x8b5f	Name error (3)	freshfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.306061029 CEST	1.1.1.1	192.168.2.8	0xdf34	Name error (3)	experiencefriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.317742109 CEST	1.1.1.1	192.168.2.8	0x48d	Name error (3)	gentlemanlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.331271887 CEST	1.1.1.1	192.168.2.8	0xfc4e	Name error (3)	alreadylaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.345051050 CEST	1.1.1.1	192.168.2.8	0xadac	Name error (3)	gentlemanfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.357047081 CEST	1.1.1.1	192.168.2.8	0x697f	Name error (3)	alreadyfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.367822886 CEST	1.1.1.1	192.168.2.8	0x74bf	Name error (3)	gentlemanconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.609183073 CEST	1.1.1.1	192.168.2.8	0xd76e	Name error (3)	alreadyconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:36:59.864170074 CEST	1.1.1.1	192.168.2.8	0xf840	Name error (3)	gentlemanfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:00.352580070 CEST	1.1.1.1	192.168.2.8	0xdef4	No error (0)	alreadyfriend.net		15.197.192.55	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.234253883 CEST	1.1.1.1	192.168.2.8	0x2a0a	Name error (3)	followlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.246416092 CEST	1.1.1.1	192.168.2.8	0xd999	Name error (3)	memberlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.265527010 CEST	1.1.1.1	192.168.2.8	0xde29	Name error (3)	followfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.509727955 CEST	1.1.1.1	192.168.2.8	0xa401	Name error (3)	memberfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.523408890 CEST	1.1.1.1	192.168.2.8	0x65b5	Name error (3)	followconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.537791014 CEST	1.1.1.1	192.168.2.8	0x2520	Name error (3)	memberconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:01.869175911 CEST	1.1.1.1	192.168.2.8	0xc37a	No error (0)	followfriend.net		188.225.40.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:02.816730976 CEST	1.1.1.1	192.168.2.8	0xf611	Name error (3)	memberfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:03.069011927 CEST	1.1.1.1	192.168.2.8	0xc68f	Name error (3)	beginlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:03.081201077 CEST	1.1.1.1	192.168.2.8	0x5750	Name error (3)	knownlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:03.092972040 CEST	1.1.1.1	192.168.2.8	0x610c	Name error (3)	beginfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.670433998 CEST	1.1.1.1	192.168.2.8	0x5c02	Name error (3)	smokeclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.927356958 CEST	1.1.1.1	192.168.2.8	0x308f	Name error (3)	womangeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.940391064 CEST	1.1.1.1	192.168.2.8	0xc24a	Name error (3)	smokegeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.952907085 CEST	1.1.1.1	192.168.2.8	0x6718	Name error (3)	womaninclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.965336084 CEST	1.1.1.1	192.168.2.8	0x72bf	Name error (3)	smokeinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:57.977690935 CEST	1.1.1.1	192.168.2.8	0xc648	Name error (3)	womannorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.230727911 CEST	1.1.1.1	192.168.2.8	0x9804	Name error (3)	smokenorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.246515989 CEST	1.1.1.1	192.168.2.8	0x3a25	Name error (3)	partyclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.258975029 CEST	1.1.1.1	192.168.2.8	0x8d4b	Name error (3)	fightclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.782063007 CEST	1.1.1.1	192.168.2.8	0x6cd6	Name error (3)	fightgeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:58.794399977 CEST	1.1.1.1	192.168.2.8	0xc2f	Name error (3)	partyinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.039271116 CEST	1.1.1.1	192.168.2.8	0xd7	Name error (3)	fightinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.051409006 CEST	1.1.1.1	192.168.2.8	0x7ed8	Name error (3)	partynorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.062588930 CEST	1.1.1.1	192.168.2.8	0xef46	Name error (3)	fightnorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.074398041 CEST	1.1.1.1	192.168.2.8	0x344f	Name error (3)	freshbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.088793993 CEST	1.1.1.1	192.168.2.8	0x3fb	Name error (3)	experiencebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.100234985 CEST	1.1.1.1	192.168.2.8	0x5901	Name error (3)	freshbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.117769957 CEST	1.1.1.1	192.168.2.8	0x880f	Name error (3)	experiencebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.134715080 CEST	1.1.1.1	192.168.2.8	0xe3b4	Name error (3)	freshreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.379652023 CEST	1.1.1.1	192.168.2.8	0x8b82	Name error (3)	experiencereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.398346901 CEST	1.1.1.1	192.168.2.8	0x168d	Name error (3)	freshquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.416244030 CEST	1.1.1.1	192.168.2.8	0x9d3c	Name error (3)	experiencequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.428545952 CEST	1.1.1.1	192.168.2.8	0xb3ea	Name error (3)	gentlemanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.440690041 CEST	1.1.1.1	192.168.2.8	0x7de8	Name error (3)	alreadybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.458669901 CEST	1.1.1.1	192.168.2.8	0x5c5e	Name error (3)	gentlemanbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.700623989 CEST	1.1.1.1	192.168.2.8	0xb3f9	Name error (3)	alreadybelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.715399981 CEST	1.1.1.1	192.168.2.8	0x768a	Name error (3)	gentlemanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.766896009 CEST	1.1.1.1	192.168.2.8	0x4c79	Name error (3)	alreadyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.778212070 CEST	1.1.1.1	192.168.2.8	0xc27e	Name error (3)	gentlemanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.789803982 CEST	1.1.1.1	192.168.2.8	0xab1a	Name error (3)	alreadyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.799540043 CEST	1.1.1.1	192.168.2.8	0xe776	Name error (3)	followbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.812242031 CEST	1.1.1.1	192.168.2.8	0xb007	Name error (3)	memberbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:37:59.828253984 CEST	1.1.1.1	192.168.2.8	0x137f	Name error (3)	followbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.071831942 CEST	1.1.1.1	192.168.2.8	0x7dc0	Name error (3)	memberbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.086347103 CEST	1.1.1.1	192.168.2.8	0xa9e1	Name error (3)	followreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.900537014 CEST	1.1.1.1	192.168.2.8	0xa60e	Name error (3)	followquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:00.913670063 CEST	1.1.1.1	192.168.2.8	0x5060	Name error (3)	memberquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.155545950 CEST	1.1.1.1	192.168.2.8	0xd899	Name error (3)	beginbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.167927980 CEST	1.1.1.1	192.168.2.8	0x604d	Name error (3)	knownbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.180170059 CEST	1.1.1.1	192.168.2.8	0xae39	Name error (3)	beginbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.352588892 CEST	1.1.1.1	192.168.2.8	0xa4a5	Name error (3)	knownbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.597661972 CEST	1.1.1.1	192.168.2.8	0x2f8a	Name error (3)	beginreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.618999958 CEST	1.1.1.1	192.168.2.8	0x4f81	Name error (3)	knownreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.632441044 CEST	1.1.1.1	192.168.2.8	0xea2c	Name error (3)	beginquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.644659996 CEST	1.1.1.1	192.168.2.8	0x364f	Name error (3)	knownquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.661240101 CEST	1.1.1.1	192.168.2.8	0x542e	Name error (3)	summerbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.679740906 CEST	1.1.1.1	192.168.2.8	0x6d8d	Name error (3)	crowdbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.693149090 CEST	1.1.1.1	192.168.2.8	0x567c	Name error (3)	summerbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.707020044 CEST	1.1.1.1	192.168.2.8	0xee5d	Name error (3)	crowdbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.720268965 CEST	1.1.1.1	192.168.2.8	0x5b10	Name error (3)	summerreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.970777988 CEST	1.1.1.1	192.168.2.8	0xbc0	Name error (3)	crowdreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:01.985738039 CEST	1.1.1.1	192.168.2.8	0x573e	Name error (3)	summerquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.006782055 CEST	1.1.1.1	192.168.2.8	0x6268	Name error (3)	crowdquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.954701900 CEST	1.1.1.1	192.168.2.8	0x54c6	Name error (3)	waterbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.966984034 CEST	1.1.1.1	192.168.2.8	0xc3cc	Name error (3)	thoughtbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.981306076 CEST	1.1.1.1	192.168.2.8	0x1dd1	Name error (3)	waterbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:02.994856119 CEST	1.1.1.1	192.168.2.8	0xf04f	Name error (3)	thoughtreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.006686926 CEST	1.1.1.1	192.168.2.8	0xa661	Name error (3)	waterreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.019572020 CEST	1.1.1.1	192.168.2.8	0x25bd	Name error (3)	thoughtquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.031160116 CEST	1.1.1.1	192.168.2.8	0xd781	Name error (3)	waterquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.275041103 CEST	1.1.1.1	192.168.2.8	0x9a24	Name error (3)	womanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:03.286937952 CEST	1.1.1.1	192.168.2.8	0x193e	Name error (3)	smokebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.019555092 CEST	1.1.1.1	192.168.2.8	0x8ded	Name error (3)	smokebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.270334959 CEST	1.1.1.1	192.168.2.8	0x5480	Name error (3)	womanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.285171986 CEST	1.1.1.1	192.168.2.8	0x40c5	Name error (3)	smokereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.297135115 CEST	1.1.1.1	192.168.2.8	0x223	Name error (3)	womanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.542114973 CEST	1.1.1.1	192.168.2.8	0x76d5	Name error (3)	smokequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.795299053 CEST	1.1.1.1	192.168.2.8	0x5501	Name error (3)	partybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:04.808367014 CEST	1.1.1.1	192.168.2.8	0x4cf5	Name error (3)	fightbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.527439117 CEST	1.1.1.1	192.168.2.8	0x561b	Name error (3)	fightbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.770265102 CEST	1.1.1.1	192.168.2.8	0xa0ac	Name error (3)	partyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.782088041 CEST	1.1.1.1	192.168.2.8	0xdc5d	Name error (3)	fightreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:05.795113087 CEST	1.1.1.1	192.168.2.8	0xcd94	Name error (3)	partyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.037519932 CEST	1.1.1.1	192.168.2.8	0xe5eb	Name error (3)	fightquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.051501036 CEST	1.1.1.1	192.168.2.8	0x1901	Name error (3)	freshhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.067466021 CEST	1.1.1.1	192.168.2.8	0xf747	Name error (3)	experiencehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.079953909 CEST	1.1.1.1	192.168.2.8	0x7f18	Name error (3)	freshneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.092104912 CEST	1.1.1.1	192.168.2.8	0xec21	Name error (3)	experienceneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.104203939 CEST	1.1.1.1	192.168.2.8	0x5746	Name error (3)	freshsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.350621939 CEST	1.1.1.1	192.168.2.8	0x2cf2	Name error (3)	experiencesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.366333961 CEST	1.1.1.1	192.168.2.8	0xcdc	Name error (3)	freshtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.610652924 CEST	1.1.1.1	192.168.2.8	0x7c1e	Name error (3)	experiencetrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.853066921 CEST	1.1.1.1	192.168.2.8	0xab9c	Name error (3)	gentlemanhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:06.866261959 CEST	1.1.1.1	192.168.2.8	0x7b7e	Name error (3)	alreadyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.114356041 CEST	1.1.1.1	192.168.2.8	0x4d18	Name error (3)	gentlemanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.126018047 CEST	1.1.1.1	192.168.2.8	0xa064	Name error (3)	alreadyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.138246059 CEST	1.1.1.1	192.168.2.8	0x3444	Name error (3)	gentlemansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.150002956 CEST	1.1.1.1	192.168.2.8	0x63c3	Name error (3)	alreadysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.403168917 CEST	1.1.1.1	192.168.2.8	0x3d4e	Name error (3)	gentlemantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.647264004 CEST	1.1.1.1	192.168.2.8	0xcc57	Name error (3)	alreadytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.813163042 CEST	1.1.1.1	192.168.2.8	0x9fa3	Name error (3)	followhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.828260899 CEST	1.1.1.1	192.168.2.8	0xfa02	Name error (3)	memberhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:07.840544939 CEST	1.1.1.1	192.168.2.8	0x1b16	Name error (3)	followneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:08.082031965 CEST	1.1.1.1	192.168.2.8	0x9a4b	Name error (3)	memberneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:08.094218969 CEST	1.1.1.1	192.168.2.8	0x72ec	Name error (3)	followsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:08.770143032 CEST	1.1.1.1	192.168.2.8	0xeadd	Name error (3)	followtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.252569914 CEST	1.1.1.1	192.168.2.8	0x6c32	Name error (3)	beginhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.494096994 CEST	1.1.1.1	192.168.2.8	0x60b6	Name error (3)	knownhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.507671118 CEST	1.1.1.1	192.168.2.8	0x3075	Name error (3)	beginneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.522731066 CEST	1.1.1.1	192.168.2.8	0x5a00	Name error (3)	knownneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.537250042 CEST	1.1.1.1	192.168.2.8	0xe56c	Name error (3)	beginsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.550298929 CEST	1.1.1.1	192.168.2.8	0xbe2e	Name error (3)	knownsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.563360929 CEST	1.1.1.1	192.168.2.8	0x2439	Name error (3)	begintrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.575318098 CEST	1.1.1.1	192.168.2.8	0xff4b	Name error (3)	knowntrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.585946083 CEST	1.1.1.1	192.168.2.8	0xca31	Name error (3)	summerhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:09.828493118 CEST	1.1.1.1	192.168.2.8	0x6712	Name error (3)	crowdhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.079885960 CEST	1.1.1.1	192.168.2.8	0xda55	Name error (3)	summerneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.093116999 CEST	1.1.1.1	192.168.2.8	0x1776	Name error (3)	crowdneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.106477022 CEST	1.1.1.1	192.168.2.8	0xe088	Name error (3)	summersystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.118125916 CEST	1.1.1.1	192.168.2.8	0xd1aa	Name error (3)	crowdsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.130733967 CEST	1.1.1.1	192.168.2.8	0x9af6	Name error (3)	summertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.950330019 CEST	1.1.1.1	192.168.2.8	0xdaf2	Name error (3)	thoughthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.964117050 CEST	1.1.1.1	192.168.2.8	0x7387	Name error (3)	waterhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.979084969 CEST	1.1.1.1	192.168.2.8	0xae34	Name error (3)	thoughtneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:10.994060040 CEST	1.1.1.1	192.168.2.8	0xaa28	Name error (3)	waterneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:12.250061989 CEST	1.1.1.1	192.168.2.8	0xf6d	Name error (3)	thoughttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:12.261554956 CEST	1.1.1.1	192.168.2.8	0x291c	Name error (3)	watertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.026566982 CEST	1.1.1.1	192.168.2.8	0xaffe	Name error (3)	smokehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.043632984 CEST	1.1.1.1	192.168.2.8	0xb17c	Name error (3)	womanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.056206942 CEST	1.1.1.1	192.168.2.8	0xcebd	Name error (3)	smokeneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.298180103 CEST	1.1.1.1	192.168.2.8	0x5376	Name error (3)	womansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.310750008 CEST	1.1.1.1	192.168.2.8	0x53f	Name error (3)	smokesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.555214882 CEST	1.1.1.1	192.168.2.8	0xc9f4	Name error (3)	womantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.567203999 CEST	1.1.1.1	192.168.2.8	0xd5	Name error (3)	smoketrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.817608118 CEST	1.1.1.1	192.168.2.8	0xb081	Name error (3)	partyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.832412958 CEST	1.1.1.1	192.168.2.8	0x5b70	Name error (3)	fighthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:13.994288921 CEST	1.1.1.1	192.168.2.8	0x30f8	Name error (3)	partyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.244328976 CEST	1.1.1.1	192.168.2.8	0xb098	Name error (3)	fightneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.256731987 CEST	1.1.1.1	192.168.2.8	0x4234	Name error (3)	partysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.536237955 CEST	1.1.1.1	192.168.2.8	0x9fe3	Name error (3)	partytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.550556898 CEST	1.1.1.1	192.168.2.8	0x2a72	Name error (3)	fighttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.794930935 CEST	1.1.1.1	192.168.2.8	0x7288	Name error (3)	freshlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:14.960773945 CEST	1.1.1.1	192.168.2.8	0xcb3d	Name error (3)	experiencelaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:15.768749952 CEST	1.1.1.1	192.168.2.8	0x17c9	Name error (3)	experiencefancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:15.783431053 CEST	1.1.1.1	192.168.2.8	0xf21b	Name error (3)	freshconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.027815104 CEST	1.1.1.1	192.168.2.8	0x2631	Name error (3)	experienceconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.040061951 CEST	1.1.1.1	192.168.2.8	0x526f	Name error (3)	freshfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.052799940 CEST	1.1.1.1	192.168.2.8	0x1d4a	Name error (3)	experiencefriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.063801050 CEST	1.1.1.1	192.168.2.8	0xf291	Name error (3)	gentlemanlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.076200008 CEST	1.1.1.1	192.168.2.8	0x2b29	Name error (3)	alreadylaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.090326071 CEST	1.1.1.1	192.168.2.8	0x9313	Name error (3)	gentlemanfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.103250980 CEST	1.1.1.1	192.168.2.8	0xedee	Name error (3)	alreadyfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.117063999 CEST	1.1.1.1	192.168.2.8	0x1d3	Name error (3)	gentlemanconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.129182100 CEST	1.1.1.1	192.168.2.8	0xa2b9	Name error (3)	alreadyconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.140059948 CEST	1.1.1.1	192.168.2.8	0xea7d	Name error (3)	gentlemanfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.660269976 CEST	1.1.1.1	192.168.2.8	0xa449	Name error (3)	followlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.902749062 CEST	1.1.1.1	192.168.2.8	0x23e7	Name error (3)	memberlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.914294958 CEST	1.1.1.1	192.168.2.8	0x5e39	Name error (3)	followfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:16.926187038 CEST	1.1.1.1	192.168.2.8	0x1717	Name error (3)	memberfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:17.175543070 CEST	1.1.1.1	192.168.2.8	0xac98	Name error (3)	followconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:17.191059113 CEST	1.1.1.1	192.168.2.8	0x269f	Name error (3)	memberconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.120208025 CEST	1.1.1.1	192.168.2.8	0xebfa	Name error (3)	memberfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.132384062 CEST	1.1.1.1	192.168.2.8	0xaf2a	Name error (3)	beginlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.145858049 CEST	1.1.1.1	192.168.2.8	0x2632	Name error (3)	knownlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:38:18.157897949 CEST	1.1.1.1	192.168.2.8	0x7fb	Name error (3)	beginfancy.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

partygeneral.net

memberreceive.net

thoughtbranch.net

womanbelieve.net

partybelieve.net

membersystem.net

membertrust.net

crowdtrust.net

thoughtsystem.net

watersystem.net

womanhonor.net

freshfancy.net

alreadyfriend.net

followfriend.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	3.33.130.190	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:40.559609890 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partygeneral.net
Aug 5, 2024 16:36:41.217849970 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:36:40 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	35.164.78.200	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:42.940088987 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: memberreceive.net
Aug 5, 2024 16:36:43.672036886 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:36:43 GMT Content-Type: text/html Connection: close Set-Cookie: btst=7c34a62bd93b3d9cf221de17cf0be2e2\|8.46.123.33\|1722868603\|1722868603\|0\|1\|0; path=/; domain=.memberreceive.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	34.246.200.160	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:45.101304054 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtbranch.net
Aug 5, 2024 16:36:45.917510986 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:36:45 GMT Content-Type: text/html Connection: close Set-Cookie: btst=dec91b6a3b5276c42277e59e91626051\|8.46.123.33\|1722868605\|1722868605\|0\|1\|0; path=/; domain=.thoughtbranch.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	15.197.142.173	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:46.448748112 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanbelieve.net
Aug 5, 2024 16:36:46.941528082 CEST	266	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Mon, 05 Aug 2024 14:36:46 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49708	15.197.192.55	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:47.635165930 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partybelieve.net
Aug 5, 2024 16:36:48.099404097 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:36:48 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49709	85.13.130.3	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:49.891526937 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membersystem.net
Aug 5, 2024 16:36:50.546163082 CEST	452	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 14:36:50 GMT Server: Apache Location: https://all-inkl.com/index.php Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 6c 2d 69 6e 6b 6c 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://all-inkl.com/index.php">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49710	3.33.130.190	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:50.588196039 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membertrust.net
Aug 5, 2024 16:36:51.041480064 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:36:50 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49715	170.187.200.48	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:53.283257008 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: crowdtrust.net
Aug 5, 2024 16:36:53.790329933 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 14:36:53 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	213.171.195.105	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:54.110738039 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtsystem.net
Aug 5, 2024 16:36:54.854599953 CEST	1236	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Mon, 05 Aug 2024 14:36:54 GMT content-type: text/html content-length: 2873 last-modified: Tue, 16 Jul 2024 14:31:13 GMT etag: "66968431-b39" accept-ranges: bytes connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 6d 61 69 6e 20 70 61 72 6b 69 6e 67 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 73 2f 63 73 73 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 66 61 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Domain parking page</title> <link rel="stylesheet" href="/styles/css/index.css"> <link rel="shortcut icon" href="https://static.fasthosts.co.uk/icons/favicon.ico" type="image/x-icon" /> ... Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-199510482-1"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-199510482-1'); </script> </head><body> <div class="container"> <nav class="logo"> <a href="https://fasthosts.co.uk/" rel="nofollow"> <img src="/assets/fasthosts-logo-secondary.svg" alt="Fasthosts"></img> </a> </nav> <main> <h2>Welcome to <span class="domain
Aug 5, 2024 16:36:54.854639053 CEST	1236	IN	Data Raw: 56 61 72 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 69 73 20 70 61 72 6b 65 64 20 66 6f 72 20 46 52 45 45 20 62 79 0a 20 20 20 20 20 20 20 Data Ascii: Var"></span></h2> <p> This domain name is parked for FREE by <strong><a href="https://fasthosts.co.uk/" rel="nofollow">fasthosts.co.uk</a></strong> </p> <div class="row"> <div class="card card--is-cta
Aug 5, 2024 16:36:54.854652882 CEST	448	IN	Data Raw: 66 61 73 74 68 6f 73 74 73 2e 63 6f 2e 75 6b 2f 63 6f 6e 74 61 63 74 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 64 6f 6d 61 69 6e 70 61 72 6b 69 6e 67 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 72 65 66 65 72 72 61 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d Data Ascii: fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_parking_contact">Contact us</a> </main> </div> <script> const cleanHostname = document.location.hostname.indexOf("www.") && document.location.hos
Aug 5, 2024 16:36:54.856276035 CEST	187	IN	Data Raw: 61 22 29 2e 68 72 65 66 20 3d 20 60 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 73 74 68 6f 73 74 73 2e 63 6f 2e 75 6b 2f 64 6f 6d 61 69 6e 2d 6e 61 6d 65 73 2f 73 65 61 72 63 68 2f 3f 64 6f 6d 61 69 6e 3d 24 7b 63 6c 65 61 6e 48 6f 73 74 6e 61 6d Data Ascii: a").href = `https://www.fasthosts.co.uk/domain-names/search/?domain=${cleanHostname}&utm_source=domainparking&utm_medium=referral&utm_campaign=fh_parking_dac` </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49718	64.190.63.222	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:54.893682003 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: watersystem.net
Aug 5, 2024 16:36:55.556778908 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49719	54.244.188.177	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:55.803735971 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanhonor.net
Aug 5, 2024 16:36:56.538788080 CEST	379	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:36:56 GMT Content-Type: text/html Connection: close Set-Cookie: btst=e4a1af7da9e412ba0271885a2c80464f\|8.46.123.33\|1722868616\|1722868616\|0\|1\|0; path=/; domain=.womanhonor.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49720	81.169.145.88	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:36:57.680721998 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: freshfancy.net
Aug 5, 2024 16:36:58.610064030 CEST	374	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 14:36:58 GMT Server: Apache/2.4.61 (Unix) Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49721	15.197.192.55	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:37:00.358747959 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: alreadyfriend.net
Aug 5, 2024 16:37:00.906940937 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:37:00 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>
Aug 5, 2024 16:37:01.227807045 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:37:00 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49722	188.225.40.227	80	3120	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:37:01.875263929 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: followfriend.net
Aug 5, 2024 16:37:02.572331905 CEST	373	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Mon, 05 Aug 2024 14:37:02 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: https://followfriend.net/index.php Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49727	3.33.130.190	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:37:58.266943932 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partygeneral.net
Aug 5, 2024 16:37:58.771012068 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:37:58 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49728	35.164.78.200	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:00.097331047 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: memberreceive.net
Aug 5, 2024 16:38:00.887597084 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:38:00 GMT Content-Type: text/html Connection: close Set-Cookie: btst=aadcae1f12773c796f272798cf7090a4\|8.46.123.33\|1722868680\|1722868680\|0\|1\|0; path=/; domain=.memberreceive.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49729	34.246.200.160	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:02.013025045 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtbranch.net
Aug 5, 2024 16:38:02.778914928 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:38:02 GMT Content-Type: text/html Connection: close Set-Cookie: btst=bae3360cd5ee8165131b6b50ebc8380c\|8.46.123.33\|1722868682\|1722868682\|0\|1\|0; path=/; domain=.thoughtbranch.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49730	15.197.142.173	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:03.293293953 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanbelieve.net
Aug 5, 2024 16:38:04.008315086 CEST	266	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Mon, 05 Aug 2024 14:38:03 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Aug 5, 2024 16:38:04.009181976 CEST	266	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Mon, 05 Aug 2024 14:38:03 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49731	15.197.192.55	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:04.815686941 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partybelieve.net
Aug 5, 2024 16:38:05.283921003 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:38:05 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49732	85.13.130.3	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:08.100370884 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membersystem.net
Aug 5, 2024 16:38:08.755995035 CEST	452	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 14:38:08 GMT Server: Apache Location: https://all-inkl.com/index.php Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 6c 2d 69 6e 6b 6c 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://all-inkl.com/index.php">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49733	3.33.130.190	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:08.777964115 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membertrust.net
Aug 5, 2024 16:38:09.241031885 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:38:09 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49734	170.187.200.48	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:10.136539936 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: crowdtrust.net
Aug 5, 2024 16:38:10.787756920 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 14:38:10 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49735	213.171.195.105	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:11.000325918 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtsystem.net
Aug 5, 2024 16:38:11.594600916 CEST	1236	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Mon, 05 Aug 2024 14:38:11 GMT content-type: text/html content-length: 2873 last-modified: Tue, 16 Jul 2024 13:11:33 GMT etag: "66967185-b39" accept-ranges: bytes connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 6d 61 69 6e 20 70 61 72 6b 69 6e 67 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 73 2f 63 73 73 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 66 61 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Domain parking page</title> <link rel="stylesheet" href="/styles/css/index.css"> <link rel="shortcut icon" href="https://static.fasthosts.co.uk/icons/favicon.ico" type="image/x-icon" /> ... Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-199510482-1"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-199510482-1'); </script> </head><body> <div class="container"> <nav class="logo"> <a href="https://fasthosts.co.uk/" rel="nofollow"> <img src="/assets/fasthosts-logo-secondary.svg" alt="Fasthosts"></img> </a> </nav> <main> <h2>Welcome to <span class="domain
Aug 5, 2024 16:38:11.594660997 CEST	1236	IN	Data Raw: 56 61 72 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 69 73 20 70 61 72 6b 65 64 20 66 6f 72 20 46 52 45 45 20 62 79 0a 20 20 20 20 20 20 20 Data Ascii: Var"></span></h2> <p> This domain name is parked for FREE by <strong><a href="https://fasthosts.co.uk/" rel="nofollow">fasthosts.co.uk</a></strong> </p> <div class="row"> <div class="card card--is-cta
Aug 5, 2024 16:38:11.594698906 CEST	635	IN	Data Raw: 66 61 73 74 68 6f 73 74 73 2e 63 6f 2e 75 6b 2f 63 6f 6e 74 61 63 74 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 64 6f 6d 61 69 6e 70 61 72 6b 69 6e 67 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 72 65 66 65 72 72 61 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d Data Ascii: fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_parking_contact">Contact us</a> </main> </div> <script> const cleanHostname = document.location.hostname.indexOf("www.") && document.location.hos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49736	64.190.63.222	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:11.600789070 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: watersystem.net
Aug 5, 2024 16:38:12.236787081 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49737	54.244.188.177	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:12.267275095 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanhonor.net
Aug 5, 2024 16:38:13.014705896 CEST	379	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:38:12 GMT Content-Type: text/html Connection: close Set-Cookie: btst=606a76b356da1ad614efd10971699cc1\|8.46.123.33\|1722868692\|1722868692\|0\|1\|0; path=/; domain=.womanhonor.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49738	81.169.145.88	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:14.967596054 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: freshfancy.net
Aug 5, 2024 16:38:15.755718946 CEST	374	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 14:38:15 GMT Server: Apache/2.4.61 (Unix) Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49739	15.197.192.55	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:16.146161079 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: alreadyfriend.net
Aug 5, 2024 16:38:16.644612074 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:38:16 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49740	188.225.40.227	80	5676	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:38:17.197480917 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: followfriend.net
Aug 5, 2024 16:38:17.877573967 CEST	373	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Mon, 05 Aug 2024 14:38:17 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: https://followfriend.net/index.php Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.1</center></body></html>

Target ID:	0
Start time:	10:36:34
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\7qBBKk0P4l.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7qBBKk0P4l.exe"
Imagebase:	0xae0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:36:34
Start date:	05/08/2024
Path:	C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe
Wow64 process (32bit):	true
Commandline:	"C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe"
Imagebase:	0x5f0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:36:34
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	C:\hjflhukc\yanidfx.exe
Imagebase:	0x740000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:36:36
Start date:	05/08/2024
Path:	C:\hjflhukc\xxxniijvj.exe
Wow64 process (32bit):	true
Commandline:	tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Imagebase:	0xce0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:36:37
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	"C:\hjflhukc\yanidfx.exe"
Imagebase:	0x740000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:37:20
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:37:53
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	"c:\hjflhukc\yanidfx.exe"
Imagebase:	0x740000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:37:54
Start date:	05/08/2024
Path:	C:\hjflhukc\xxxniijvj.exe
Wow64 process (32bit):	true
Commandline:	tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Imagebase:	0x40000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:39:30
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	"c:\hjflhukc\yanidfx.exe"
Imagebase:	0x740000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	52%
Total number of Nodes:	1325
Total number of Limit Nodes:	6

Executed Functions

Function 00AE88A8 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00B1B028), ref: 00AE893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00AE8AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 00AE8D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 00AE8D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00AE8DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00AE8E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00AE9158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00AE91F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 00AE936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 00AE94DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 00AE963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 00AE97B0

Strings

C:\hjflhukc\, xrefs: 00AE8DF6, 00AE9174, 00AE947F, 00AE9666
\, xrefs: 00AE93D0
C:\Users\user, xrefs: 00AE9016, 00AE908E
gKV`, xrefs: 00AE8CE7

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\hjflhukc\$\$gKV`
API String ID: 1691758827-3473430694
Opcode ID: 6b818874474e34db344dff643213ac6fafd0a58ca53b48f54fe57c8e4e997ca6
Instruction ID: b091e947be82a6bfbb18001accb1df8e30d7160340dd86870bea50a430373694
Opcode Fuzzy Hash: 6b818874474e34db344dff643213ac6fafd0a58ca53b48f54fe57c8e4e997ca6
Instruction Fuzzy Hash: FB82FEB2554244CFC718DF65ED969EA37B8FB54300BC0C06AE906DB2B1EF349A81CB55

Function 00AFFF2A Relevance: 19.9, APIs: 6, Strings: 5, Instructions: 627
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hM6, xrefs: 00B00706
~z0, xrefs: 00B006C2
^d/, xrefs: 00B00102
241, xrefs: 00B00787
C:\Users\user, xrefs: 00B0058A

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: 241$C:\Users\user$^d/$hM6$~z0
API String ID: 0-2828660445
Opcode ID: 479cb0ab703f1ccfe305bf80004536bc0629c86cf389fcc0f2ca324d21d40431
Instruction ID: a0466577c618f0c0c74cab8b47ef98a534bcfb24894ca11b558e53461b61fad7
Opcode Fuzzy Hash: 479cb0ab703f1ccfe305bf80004536bc0629c86cf389fcc0f2ca324d21d40431
Instruction Fuzzy Hash: 7B420BB2550240EFE318AF65FC86AF63BB5FB84750B90C01AE6069B2B1EF709841CB55

Function 00AF111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF11F7
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00AF1267
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00AF128B
GetTickCount.KERNEL32 ref: 00AF12D1
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00AF153B
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00AF157E
CloseHandle.KERNEL32(00000000), ref: 00AF158F

Strings

Ra);, xrefs: 00AF1514

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$CloseCreate$ChangeCountFindHandleNotificationReadTickWrite
String ID: Ra);
API String ID: 688250028-4229484525
Opcode ID: fe21292815c86a253471cf2048e3bd1852c26217e86b2d73e0ab407f0091f930
Instruction ID: d218f08df6602f9347ca60d4a927dc57dd7852f7a3500240beb95203dbcf5ced
Opcode Fuzzy Hash: fe21292815c86a253471cf2048e3bd1852c26217e86b2d73e0ab407f0091f930
Instruction Fuzzy Hash: F9B1DCB2515644EED7188FA8FD919FA37F8FB48751790C01AFA01CB2A0EF349942CB19

Function 00AE5C39 Relevance: 7.7, APIs: 5, Instructions: 247
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00AE5DEC
FindFirstFileA.KERNELBASE(?,?), ref: 00AE5EB2
DeleteFileA.KERNELBASE(?), ref: 00AE5FE2
FindNextFileA.KERNELBASE(00000000,?), ref: 00AE6020
FindClose.KERNEL32(00000000), ref: 00AE6042

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 31f2c16ab366cdc0ab6de3137e7aee629baef201ffb4349a0f6564cd97d8f971
Instruction ID: 720691f905755582425e743559d20848d0153dab1973189af6a9a6b0792144c7
Opcode Fuzzy Hash: 31f2c16ab366cdc0ab6de3137e7aee629baef201ffb4349a0f6564cd97d8f971
Instruction Fuzzy Hash: 51A1CE75911A55CBC718CF65FC96AF937B8FB58301790C12AE806CB6B0EF349982CB85

Function 00AEE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00AE8954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00AE8954), ref: 00AEE865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00AEE895
FreeSid.ADVAPI32(?), ref: 00AEE8DC

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d5d286eb8782e52a25460eff1d576535795f0a2f012468d747ea55cad723f0c1
Instruction ID: 525941d05075b79a6372121721dc7f0bb88c810711e4d1945d4dc0c9ba6ea2ce
Opcode Fuzzy Hash: d5d286eb8782e52a25460eff1d576535795f0a2f012468d747ea55cad723f0c1
Instruction Fuzzy Hash: 8E415775915244EFCB04CFA6FD85AE977B5FB08305BD0C46AE402D7260EF349981CB55

Function 00AEDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00AF8109,?,00AF8109,00000000), ref: 00AEDE6C
RtlFreeHeap.NTDLL(00000000,?,00AF8109,00000000), ref: 00AEDE73

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: dde2917b80831e3ce67f1f47d83daa8e71d9c327ee2ea7967ce01023c00640a6
Instruction ID: 5e65d03695b0a2e54cbe0fab5c621e85a3351473c18528a4304f12fc17998fba
Opcode Fuzzy Hash: dde2917b80831e3ce67f1f47d83daa8e71d9c327ee2ea7967ce01023c00640a6
Instruction Fuzzy Hash: 3AE0C232640244EFEE00CFD6FC4BA853BE8FB22741F80C120F105DB530CF2199508A84

Function 00AF54A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00AEDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00AF5628
CloseHandle.KERNEL32(00AEDA33,?,?,?,?,00000000), ref: 00AF5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00AF5665

Strings

D, xrefs: 00AF55A3

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: be9ac7867f739c3b47bdb832113312da8706fc7e3ca1b03804f015bd3ef954e1
Instruction ID: a5155a35e5a9c1ea7ce9652752831ee2c0a794b635bfad553a6f6fc7158f1428
Opcode Fuzzy Hash: be9ac7867f739c3b47bdb832113312da8706fc7e3ca1b03804f015bd3ef954e1
Instruction Fuzzy Hash: C441CD72900648DBC728DFA5FD599FA77B5FB84300B94C12AEA02CB161EF748811CB25

Function 00AF54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00AEDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00AF5628
CloseHandle.KERNEL32(00AEDA33,?,?,?,?,00000000), ref: 00AF5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00AF5665

Strings

D, xrefs: 00AF55A3

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: d254c2f174f9747095af1da124de738c8c72af8582723b9adbc9c41e5dc19e4c
Instruction ID: 872b344674b967570d5493b6de4bfaae2c4409c137b7bd4d4d99828fb269884e
Opcode Fuzzy Hash: d254c2f174f9747095af1da124de738c8c72af8582723b9adbc9c41e5dc19e4c
Instruction Fuzzy Hash: 8041AA71501648DBCB28DFA5FD9A9FA37B9FB84700B80C01AEA129B170EF708941CB65

Function 00AEC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AEB7CD: WaitForSingleObject.KERNEL32(00AFAEAC,00004E20,00000001,?,00AEBFA2,00000001,-AF16B4FB,?,00AFAEAC,00AE66DE), ref: 00AEB81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,00AE67E3,?,00000004,?,00000000,?), ref: 00AEC746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 00AEC90B
CloseHandle.KERNEL32(00000000,?,?,?,00000001), ref: 00AEC983

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$CloseCreateHandleObjectSingleWaitWrite
String ID:
API String ID: 3361265286-0
Opcode ID: 08a88e8129bca0be5e4f43e4a0948973a812a70dbaf76b5a59acf4acc7c5651c
Instruction ID: 72a6095098b6e0ee098cb5ee9ee27ec052b9bf9689062dd1e55dc07e1e7aa380
Opcode Fuzzy Hash: 08a88e8129bca0be5e4f43e4a0948973a812a70dbaf76b5a59acf4acc7c5651c
Instruction Fuzzy Hash: 0C91A975511245DBC718CF29FE959EA7BF5FB98320B90C02AE406DB2B1EF349942CB44

Function 00AF20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,00AF09C2,?,?,?), ref: 00AF20F0
CharLowerBuffA.USER32(?,00000000,?,00AF09C2,?,?,?), ref: 00AF2131

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 1a6479f596ac5f8ea33107638ad06a7a14f620ff19c44c6402e4a4f249f33105
Instruction ID: 07ca70e876180d78e7d17c483fd5cdfc193eacd82179094175cca954c17d4550
Opcode Fuzzy Hash: 1a6479f596ac5f8ea33107638ad06a7a14f620ff19c44c6402e4a4f249f33105
Instruction Fuzzy Hash: 0FF067315142089BCB098F46E8564B637F2FB54700790D029F8068B670EF34AD80ABAA

Function 00B023A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00B0A3A7,?,?,?,00B0D0BE), ref: 00B023F6
RtlAllocateHeap.NTDLL(00000000,?,00B0A3A7,?,?,?,00B0D0BE), ref: 00B023FD

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 625c3c809cbfd678d3f0bf16aa4eae6dbdd46c5fb80aa4977013e7ab69c942ef
Instruction ID: e28f510bee660ca928bdd4cb7f3e3aed3bd8803192140339ca460e50166e0402
Opcode Fuzzy Hash: 625c3c809cbfd678d3f0bf16aa4eae6dbdd46c5fb80aa4977013e7ab69c942ef
Instruction Fuzzy Hash: 4DF03076500201AFCA108FA9FD4D99A3BA4F315754BA48412F445DB0A5DF78E8488B54

Function 00AF15E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00AF160D

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: da6fa2b0c3ce6adb2378237efb38333f87051fc86bdb6b66efcb35ed03c8ceaf
Instruction ID: 2222837082c77fd83876bff37bae1be555893058d11ade8464a77d98890fdcc4
Opcode Fuzzy Hash: da6fa2b0c3ce6adb2378237efb38333f87051fc86bdb6b66efcb35ed03c8ceaf
Instruction Fuzzy Hash: 4FD012240143489A87106FA4DD068A53BB9FF047007C19015F9409B130DF70E900C75B

Non-executed Functions

Function 00B0D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 00B0D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00B0D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 00B0DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00B0DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00B0DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 00B0DC1C
CloseHandle.KERNEL32(?), ref: 00B0DC33
CloseHandle.KERNEL32(?), ref: 00B0DC66
CloseHandle.KERNEL32(?), ref: 00B0DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 00B0DD4F
CloseHandle.KERNEL32(?), ref: 00B0DD9F
CloseHandle.KERNEL32(?), ref: 00B0DDB2
CloseHandle.KERNEL32(?), ref: 00B0DE41
CloseHandle.KERNEL32(00000000), ref: 00B0DE67
CloseHandle.KERNEL32(?), ref: 00B0DE7E

Strings

D, xrefs: 00B0DB1A

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: 30f52d4db2d134c62fac97dda1e408ba6ce187860a15b6d03793e9ddb57372b6
Instruction ID: 396673d2ca907e3f87c0eb8cd3a18fa2df92dcee7315d91f61d1fbc438d85aab
Opcode Fuzzy Hash: 30f52d4db2d134c62fac97dda1e408ba6ce187860a15b6d03793e9ddb57372b6
Instruction Fuzzy Hash: 88026476A11604DFCB14CFA8ED969EA7BF5FB48300794C16AE802D72B0EF30A951CB55

Function 00B084D7 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 688memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000,00000100), ref: 00B086E1
LoadLibraryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000,00000100), ref: 00B0876A
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B08854
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000,00000100), ref: 00B08891
HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000), ref: 00B088DD
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000,00000100), ref: 00B08908
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000), ref: 00B0897A
HeapAlloc.KERNEL32(?,00000000,00000100,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000), ref: 00B089C3
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000,00000100), ref: 00B08A10
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000), ref: 00B090B2
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00AFB7C4,?,?,00000000,00000100), ref: 00B090D7

Strings

Q:3q, xrefs: 00B085DB
SAcA, xrefs: 00B08614

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Free$HeapLibrary$Alloc$AddressLoadProcProcess
String ID: Q:3q$SAcA
API String ID: 1560921867-494069912
Opcode ID: c26e89faf21cc4bdb9dc68b38069fc19a5c1efb4380413a83a36a343a118a8e2
Instruction ID: e73db311542a3ce0b8ec07bae890600a59f61238dccedf7be1349f5904d11ba4
Opcode Fuzzy Hash: c26e89faf21cc4bdb9dc68b38069fc19a5c1efb4380413a83a36a343a118a8e2
Instruction Fuzzy Hash: 05529976614640CBC718CF68FD96AE93BF5FB58311B90C46AE842CB2B1EF309A41CB55

Function 00AF8695 Relevance: 22.0, APIs: 10, Strings: 2, Instructions: 1045networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00AF9154
setsockopt.WS2_32(00000000,0000FFFF,00001006,00000000,00000004), ref: 00AF91DB
gethostbyname.WS2_32(?), ref: 00AF9261
inet_ntoa.WS2_32(?), ref: 00AF92CF
inet_addr.WS2_32(00000000), ref: 00AF92D6
htons.WS2_32(00000050), ref: 00AF92FB
connect.WS2_32(00000000,?,00000010), ref: 00AF9316
send.WS2_32(00000000,00000000,00000000,00000000), ref: 00AF93A1
recv.WS2_32(00000000,?,00000400,00000000), ref: 00AF947C
closesocket.WS2_32(00000000), ref: 00AF97C6

Strings

;$Rb, xrefs: 00AF8C35
/, xrefs: 00AF8982

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonsinet_addrinet_ntoarecvsendsetsockoptsocket
String ID: /$;$Rb
API String ID: 4203722200-1076244922
Opcode ID: 8c03276cca62be44fac13869246256d3102d47b77a78570ec06fbafd15d92d72
Instruction ID: 17d18cd69697a18ea6ec2e814850036078e08e6255dd2db00fd8136818c30c9a
Opcode Fuzzy Hash: 8c03276cca62be44fac13869246256d3102d47b77a78570ec06fbafd15d92d72
Instruction Fuzzy Hash: 2E92DC72915248CFD718DFA4ED92AFA37B4FB54710B90C42AE906DB2B1EF34A941CB50

Function 00B035AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00B03685
CreateServiceA.ADVAPI32(00000000,01244448,01244448,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00B036D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00B03728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00B0374C
CloseServiceHandle.ADVAPI32(00000000), ref: 00B0375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 00B037D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00B03836
CloseServiceHandle.ADVAPI32(00000000), ref: 00B03847
CloseServiceHandle.ADVAPI32(00000000), ref: 00B038B1

Strings

qh~B, xrefs: 00B0360F
3ch, xrefs: 00B03701

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 6c1f03273e700e19a896b61b25e0aecab67f945c318d127a098585869ffaefd0
Instruction ID: da631749396df371f50aa1de8bff62fd0d5c73c258204612badbd131aa194398
Opcode Fuzzy Hash: 6c1f03273e700e19a896b61b25e0aecab67f945c318d127a098585869ffaefd0
Instruction Fuzzy Hash: 5C918BB6514200EBC3188F64ED999F97BF9FB49B017C0C15AE802D72B1EF75A941CB91

Function 00AE11B7 Relevance: 13.6, Strings: 9, Instructions: 2310COMMON

Download Yara Rule

Strings

o, xrefs: 00AE3187
l, xrefs: 00AE2CFA
l, xrefs: 00AE2D0A
T8G, xrefs: 00AE29C2
%, xrefs: 00AE2C72
c< n, xrefs: 00AE27BB
"Ib, xrefs: 00AE2B38
jQn, xrefs: 00AE12C5
0, xrefs: 00AE3191

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: "Ib$%$0$c< n$jQn$l$l$o$T8G
API String ID: 0-3181560568
Opcode ID: b42a9b982aa71b01fa2fe320b8e2079de9e8f2dff8ad59f00bead5681404bd5e
Instruction ID: c0a393018f88919f62b8dc33f9047b43ef5f128cc10d427b56023c0ab358219f
Opcode Fuzzy Hash: b42a9b982aa71b01fa2fe320b8e2079de9e8f2dff8ad59f00bead5681404bd5e
Instruction Fuzzy Hash: 4023DB76910291CBCB18CF6AED956F97BF5FB58301B94C12AE802DB270EF349981CB45

Function 00AF1636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00AF16B2
Process32First.KERNEL32(00000000,00000128), ref: 00AF17BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00AF1932
Module32First.KERNEL32(00000000,00000224), ref: 00AF1991
CloseHandle.KERNEL32(?,0000000A), ref: 00AF1A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00AF1ACE
CloseHandle.KERNEL32(00000000), ref: 00AF1AF5

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: bdf432647d611a295e7128fd2a00f46f49575390a753fc1c514e62e26350023b
Instruction ID: 9abe24635c26d497524f318a66681ec2c0d90fbefb627543de983702f5d49070
Opcode Fuzzy Hash: bdf432647d611a295e7128fd2a00f46f49575390a753fc1c514e62e26350023b
Instruction Fuzzy Hash: 59C1DC76911604CBD718DFA4ED96AFA33B4FB58311B80C11AFA06C72A0EF749981CF85

Function 00AF0806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00AF08C2
Process32First.KERNEL32(00000000,00000128), ref: 00AF0966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00AF0A15
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00AF0A64
CloseHandle.KERNEL32(00000000), ref: 00AF0A82
Process32Next.KERNEL32(00000000,00000128), ref: 00AF0AD2
CloseHandle.KERNEL32(00000000), ref: 00AF0B10

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d256b029402396f8f67d00b4665875e60dcfc8bf4bd507a445aecf87919c8046
Instruction ID: 7b42d4e135e5b282958e0643c3cb53b3abaed756b25c9ce74d31ab7f110a0e0c
Opcode Fuzzy Hash: d256b029402396f8f67d00b4665875e60dcfc8bf4bd507a445aecf87919c8046
Instruction Fuzzy Hash: 5181A576521615DBC314CF68FD91AFA37B8FB58702BC0C12AE906D76B1EF3499818B84

Function 00AF9F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00AF9FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 00AFA049
GetLastError.KERNEL32 ref: 00AFA061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 00AFA162
CloseServiceHandle.ADVAPI32(00000000), ref: 00AFA3B6

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: a09f169a2afd64a119e49af928808213439b85e38c3ca799fa1fa2ed762016d5
Instruction ID: 068fc256ee2f74352699c60f0a8d632f758ef5102c2c32be6cef7a01bfc4ae98
Opcode Fuzzy Hash: a09f169a2afd64a119e49af928808213439b85e38c3ca799fa1fa2ed762016d5
Instruction Fuzzy Hash: D7D1CBB6901604DFC318CFA4FD95AF977F4FB54310B95C12AE9069B2A0EF34A981CB81

Function 00AE60AD Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 513COMMON

Download Yara Rule

Strings

, xrefs: 00AE6516
-4/, xrefs: 00AE61E4
, xrefs: 00AE6809

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: $ $-4/
API String ID: 0-196967448
Opcode ID: 381312236562799a3070e8a32a5d940b61dc76fcad60fb578e6f1c8fda96664d
Instruction ID: 617e856b345f2b3e152ac01ce1f1a3b9133c7df30dac4809e5d4adb84eb1a364
Opcode Fuzzy Hash: 381312236562799a3070e8a32a5d940b61dc76fcad60fb578e6f1c8fda96664d
Instruction Fuzzy Hash: EA223072A09244CFC718DFA5FD966FA37B4FB58710B90C42AE406CB2A1EF34A940CB55

Function 00AE9903 Relevance: 7.3, Strings: 5, Instructions: 1018COMMON

Download Yara Rule

Strings

, xrefs: 00AEA648
5Nv, xrefs: 00AEA271
vE{, xrefs: 00AEA18D, 00AEA193
8%A, xrefs: 00AEA337
L08s, xrefs: 00AE9A59

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: $5Nv$8%A$L08s$vE{
API String ID: 0-1922508855
Opcode ID: fba840d0c2ac261f3b84ad5379522c4f17c1be86ce61b40d5b4fb87299ae7f88
Instruction ID: 248aa863c9aa62a880fbd12d424d16903fb7e48b0b99b9812a1233cbc09992fd
Opcode Fuzzy Hash: fba840d0c2ac261f3b84ad5379522c4f17c1be86ce61b40d5b4fb87299ae7f88
Instruction Fuzzy Hash: EE92E076904295CFCB18CFA9ED919EA77F4FB58310B94C12AE806DB270EF34A941CB45

Function 00AF571F Relevance: 6.2, APIs: 4, Instructions: 213processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00AF5804
Process32First.KERNEL32(00000000,00000128), ref: 00AF58E2
Process32Next.KERNEL32(00000000,00000128), ref: 00AF59E8
CloseHandle.KERNEL32(00000000), ref: 00AF5A7E

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9a5908fbe94e9d69ea7648ec560f97859b614f4d869723eb3127a90de3601b71
Instruction ID: ec3a60b34677ed3ac5cf2780b55370e071f39b0c97073e93c9a69bf12c1b4966
Opcode Fuzzy Hash: 9a5908fbe94e9d69ea7648ec560f97859b614f4d869723eb3127a90de3601b71
Instruction Fuzzy Hash: 63919976A15644CBC718DBB9ECAA5F937F4FB48351B90C52AEA02C7260EF309952CF40

Function 00AECFBB Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 675threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00B06E81,00000000,00000000,00000000), ref: 00AED636
CloseHandle.KERNEL32(00000000), ref: 00AED65B

Part of subcall function 00B04589: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B04637
Part of subcall function 00B04589: CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00B04655
Part of subcall function 00B04589: CloseHandle.KERNEL32(00000000,?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B0468D
Part of subcall function 00B04589: WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B046A1
Part of subcall function 00B04589: CloseHandle.KERNEL32(?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B04712

Strings

$}\N, xrefs: 00AECFD8, 00AECFDE

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseCreateHandle$Thread$EventObjectSingleWait
String ID: $}\N
API String ID: 784754931-3579273913
Opcode ID: 780143fe9e7fcd8acc443d036c13bd7210e43e75e9efdd0ac5072ae7701b0a3e
Instruction ID: dd6f07a5b765fcd0a02c45245753a2820619379fdd37e2795a4c65a2fae5d270
Opcode Fuzzy Hash: 780143fe9e7fcd8acc443d036c13bd7210e43e75e9efdd0ac5072ae7701b0a3e
Instruction Fuzzy Hash: F652DB76A14240DBC718DFA9ED926F937F5FB58301B90C02AE812DB2B1EF34A941CB55

Function 00AE69A8 Relevance: 5.9, Strings: 4, Instructions: 901COMMON

Download Yara Rule

Strings

cZ), xrefs: 00AE6C06
vE{, xrefs: 00AE74B5, 00AE74C9
W/=D, xrefs: 00AE6BA1
:JDX, xrefs: 00AE6DCA

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: :JDX$W/=D$cZ)$vE{
API String ID: 0-1531476030
Opcode ID: 2662bb3cb6a3088dbc700ac06cfd34e97ebb1be79338f7bae376dd7a05aeba81
Instruction ID: 1096cf0b8b4b4816da39279a401b181d92295be722b84e589a5908aae19b667c
Opcode Fuzzy Hash: 2662bb3cb6a3088dbc700ac06cfd34e97ebb1be79338f7bae376dd7a05aeba81
Instruction Fuzzy Hash: 7672BC72904295DFDB18CF69ED819EE77F5FB58310B94852AE805E72A0EF30DA41CB90

Function 00AFB3DB Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 588COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,?), ref: 00AFB528

Part of subcall function 00B042B6: lstrlen.KERNEL32(?,?,00AE2347,?), ref: 00B04320

Strings

myiW, xrefs: 00AFB70F

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID: myiW
API String ID: 4141851928-4061706148
Opcode ID: 7dd5cdad2f02c8956391420f6ec835089780871c35b40ec4c121f3c28e1b06aa
Instruction ID: ae330696e992f8b43bb6ccfac5e57c850fcccbf4a0ff7df28a393cedc6748a84
Opcode Fuzzy Hash: 7dd5cdad2f02c8956391420f6ec835089780871c35b40ec4c121f3c28e1b06aa
Instruction Fuzzy Hash: 3B42A071910249DFCB14EFA5EE929FA73B8FB14704B80805AF506E71B2EF349A45CB61

Function 00AE3E8C Relevance: 3.1, APIs: 2, Instructions: 112timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00AE3EEA
__aulldiv.LIBCMT ref: 00AE3F36

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Time$FileSystem__aulldiv
String ID:
API String ID: 2838486344-0
Opcode ID: b539dca2e3fb56bc3cdbe04f30b10674743fc785c9e5e63b96ffe737308c0c5b
Instruction ID: 0cb42b0f94b95592c2a26d7ee9bb8b0c8a035f546dc41a7c6802f73222be2536
Opcode Fuzzy Hash: b539dca2e3fb56bc3cdbe04f30b10674743fc785c9e5e63b96ffe737308c0c5b
Instruction Fuzzy Hash: F64122B6925290CBC714CF19FC856FA33F4FB54711790842AE806CB661EF75D981CB84

Function 00AF5FBA Relevance: 1.9, Strings: 1, Instructions: 688COMMON

Download Yara Rule

Strings

B&>, xrefs: 00AF6019

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: B&>
API String ID: 0-1526646359
Opcode ID: 7da333cb9203537ce1899ada62bea97d36f8f19bef4ce8cf57112b27326b83e4
Instruction ID: 0687741419968206cb3f5399526c5c9775a77193d4b1a3bc72a15defb3504d5a
Opcode Fuzzy Hash: 7da333cb9203537ce1899ada62bea97d36f8f19bef4ce8cf57112b27326b83e4
Instruction Fuzzy Hash: 6552CA75905244CBC708DFA8FD92AFA37B5F758701B90C02AEA41DB2A1EF34A981CB55

Function 00B024D3 Relevance: 1.8, APIs: 1, Instructions: 520sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000008AE), ref: 00B02D0A

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0a03a217733032e4a3c654b151e19ae4ccf51ae6320ed957415783e961b279c7
Instruction ID: 2288c8b4186df4aa188b001cdd7f3bd908b60d13093d1a5c2b409dea0775bf73
Opcode Fuzzy Hash: 0a03a217733032e4a3c654b151e19ae4ccf51ae6320ed957415783e961b279c7
Instruction Fuzzy Hash: F032BD71914244DFD718DF64ED96AEA7BF4FB18300F90C06AE406EB2A1EF34AA45CB54

Function 00AE46CF Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

"d@, xrefs: 00AE4C45

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: "d@
API String ID: 0-2935523628
Opcode ID: edfc591341aa23ed3ac435275d5773ec1803918b005c49758bef8e47ec369ccf
Instruction ID: c83c38ba47d184fdf2f2cbcecd18a6a8d5174b22f0d3b400fc9f711182dce628
Opcode Fuzzy Hash: edfc591341aa23ed3ac435275d5773ec1803918b005c49758bef8e47ec369ccf
Instruction Fuzzy Hash: C3E17576515681CBC308CF29FC915AA77F5FB983013E0C22AE846CB275EF38A981CB45

Function 00B074E8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00B07525

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: f1bc6b1dffc5f2e5fb6668a1a35de195228f43b4e9cb26cf2c2cb17aa586d648
Instruction ID: 3b8a704a60c19c79a0cef7df7a3fdd8c88d2eca81f6e649a2ce2c64ac56c9925
Opcode Fuzzy Hash: f1bc6b1dffc5f2e5fb6668a1a35de195228f43b4e9cb26cf2c2cb17aa586d648
Instruction Fuzzy Hash: E4F0FEB29102049FD704DF58E9496E97BF8F714316F94866AD415D3250EF759614CF80

Function 00AF0CE6 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

'S, xrefs: 00AF10BE

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: 'S
API String ID: 0-46969972
Opcode ID: 5a70fdda63b66160eb71b7f0d60f633e2281a870959913114c24d093a1f99c01
Instruction ID: 98691370efb5dd0d627a25b2740680c0d28fffad226271031e3f6a8bf7a08b76
Opcode Fuzzy Hash: 5a70fdda63b66160eb71b7f0d60f633e2281a870959913114c24d093a1f99c01
Instruction Fuzzy Hash: 4FA1DD75615249CBC728CFA9FE919FA77B5FB44300790C52AE906C7671EF34A980CB84

Function 00B07DC0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0229e0f1d05a6f21c0a4e358d29948c3741dfa869a9b38c258144b38b395081c
Instruction ID: 4463b713b47811d4601273a10851e4c0d1ad53c7e40f928dd45e5eba094763be
Opcode Fuzzy Hash: 0229e0f1d05a6f21c0a4e358d29948c3741dfa869a9b38c258144b38b395081c
Instruction Fuzzy Hash: CAE1AA71A14240DFCB08DF68ED969B97BF5FB58300790C46AE846CB2A6EF34A941CB54

Function 00AF0113 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0babb7e23a10fc589c5811a72ea7d4ba6bebbe4952935ec12c754b35bb2fde5
Instruction ID: af1d0e98beb7d4894179c3bbb86102b49c51e497e16ee66abd5f93a7be7f6569
Opcode Fuzzy Hash: a0babb7e23a10fc589c5811a72ea7d4ba6bebbe4952935ec12c754b35bb2fde5
Instruction Fuzzy Hash: 6DE19D76A11204CFDB18CF68ED969F977F1FB98311794C02AE806DB261EF38A941CB54

Function 00B03025 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660b5b627f70f608f318fbb334713fe71888ae491a4415122b58516940597265
Instruction ID: 05619dfabfb463657ce84575ccd0fa03d8913cffeb251b81236a336304e605d5
Opcode Fuzzy Hash: 660b5b627f70f608f318fbb334713fe71888ae491a4415122b58516940597265
Instruction Fuzzy Hash: ADD1C976621601CBC718CF69EC955E97BF5FB897117A0C02AE856CB3B0EF34AA41CB44

Function 00AF70E6 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc809072156b297571fb97aea8e1d0cd18533e52c95abcd56b20dd85c65243a
Instruction ID: 60e10fcca2fb7e92fae7667eacf8849754810acb76fec57eee4869a6db0db21b
Opcode Fuzzy Hash: 4bc809072156b297571fb97aea8e1d0cd18533e52c95abcd56b20dd85c65243a
Instruction Fuzzy Hash: EFC100B5518249CBD724CFA8EC85AF937B4FB18710B90C51AFA42C72B0EF749881CB85

Function 00AFA805 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 47dd40dab6a0d7343bf0295394b5c0b254b7b66debd96cf0471b9edf1d32e0e1
Instruction ID: 65daff2c383d2b607d1e6cee0c251970233d8545fc005743fa49c82cfe6b423f
Opcode Fuzzy Hash: 47dd40dab6a0d7343bf0295394b5c0b254b7b66debd96cf0471b9edf1d32e0e1
Instruction Fuzzy Hash: BFB1A97A528240CBC308CF64FDA25F577B1FB68311395C01AE846CB2B1EF34A981CB95

Function 00B05F1E Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd25bf06d6fd7ffe8850432327461c18f89e3c01ee551b88579809839b236de
Instruction ID: 1b669a6282cd3b3e54014dfa077a0acd1d6d3476840211654a8c71359c47e2e5
Opcode Fuzzy Hash: 8bd25bf06d6fd7ffe8850432327461c18f89e3c01ee551b88579809839b236de
Instruction Fuzzy Hash: 15B18776915650CFD358CF29FD914A97BF5FB99301390C52AE812CB670EF30A981CB41

Function 00AE774C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c081e4acb5526f0916ff5281db488546c16c3ebd98b98569b5c664e77b5fa75e
Instruction ID: e630686f41821142f95d4db7e13250a81c6f9ce64f5acd7659b1c97f5661d6c3
Opcode Fuzzy Hash: c081e4acb5526f0916ff5281db488546c16c3ebd98b98569b5c664e77b5fa75e
Instruction Fuzzy Hash: 5BB19972625284CFD318CF68ED925A87BF5FB653007C4C12AE885CB271EF34AA45CB95

Function 00AEA928 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e665c18e20e2fb76c3ae0e6462cb6d2861a5f3125e6358faf220c845fb0ca138
Instruction ID: 7ec0e774d78ddc9629552d412303e5dc84154ebf13c039fc51fb38832489a564
Opcode Fuzzy Hash: e665c18e20e2fb76c3ae0e6462cb6d2861a5f3125e6358faf220c845fb0ca138
Instruction Fuzzy Hash: 4681A872551280CBC318CF69FD815E63BB4FB68311BD0C52AE815CB271EF34A941CB86

Function 00B0DFCC Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252acb072f3ec41d7c03dd5d0142205f41ba9d1911c6706d0a2bceb44efab98a
Instruction ID: 2f1f66bd72e74adc4230019e16220b1a301c063f9a24f33e5caba6204ffb7111
Opcode Fuzzy Hash: 252acb072f3ec41d7c03dd5d0142205f41ba9d1911c6706d0a2bceb44efab98a
Instruction Fuzzy Hash: BD71A731255641CBC318CF28FDA26E63BF5FB9A7017A4C52AD446CB6B0EF349981CB44

Function 00AEC9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 00AECAF2
SetServiceStatus.ADVAPI32(00B1B2DC), ref: 00AECB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AECB78
SetServiceStatus.ADVAPI32(00B1B2DC), ref: 00AECBE5
WaitForSingleObject.KERNEL32(00001388), ref: 00AECC62
SetServiceStatus.ADVAPI32(00B1B2DC), ref: 00AECCAF
CloseHandle.KERNEL32 ref: 00AECCC5
SetServiceStatus.ADVAPI32(00B1B2DC), ref: 00AECD8F

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: e32fbaf8c9ab6d3f6e04c5176490a1418f8177633691374461aa20466c8317f3
Instruction ID: 0f8c42cf84e7aba94c2b937ca4b13bb1ea06848b1a83d35d409df3562fb3277b
Opcode Fuzzy Hash: e32fbaf8c9ab6d3f6e04c5176490a1418f8177633691374461aa20466c8317f3
Instruction Fuzzy Hash: 70911F75021241CBC718DF2AED999EA3BF5FB587153D0C52AE406CB270EF309986CB84

Function 00AFB046 Relevance: 9.2, APIs: 6, Instructions: 184filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00AFB104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00AFB16D
CloseHandle.KERNEL32(00000000), ref: 00AFB1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AFB25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00AFB2AB
CloseHandle.KERNEL32(00000000), ref: 00AFB2D8

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 0e8b05fd85d97416b8cf53fc74d30faff480aedf8767369e7b8f123ed7fad09b
Instruction ID: 61796f2cbea9151f61ca4b491b2264b4b9a72310efd44f1333b3387053dc1149
Opcode Fuzzy Hash: 0e8b05fd85d97416b8cf53fc74d30faff480aedf8767369e7b8f123ed7fad09b
Instruction Fuzzy Hash: 7F71CC35525208DFC314CFA8ED919FA37B4FB49315790C62AE952C76B0EF349A81CB25

Function 00B04589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B04637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00B04655
CloseHandle.KERNEL32(00000000,?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B0468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B046A1
CloseHandle.KERNEL32(?,00000002,?,00AED583,Function_0000AD87,00000002,00000000), ref: 00B04712

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: a9213fc8d695cb811f268f3d7dbcea159b9bc9676159429d16501bed636e3dd6
Instruction ID: 3f4f61d4ea989734ac725a6cf2b6addf28eff149e60d9cb93fb20bbe7e8d0383
Opcode Fuzzy Hash: a9213fc8d695cb811f268f3d7dbcea159b9bc9676159429d16501bed636e3dd6
Instruction Fuzzy Hash: A24158B6111240DFC324CF68ED859A63BF6FB9A7117A0C42AE506C76B0EF309841CB11

Function 00B04927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00B04CBC

Part of subcall function 00AF074E: wvsprintfA.USER32(?,?,?), ref: 00AF07C3

Sleep.KERNEL32(00015F90), ref: 00B04E60
DeleteFileA.KERNEL32(?), ref: 00B04E7F

Strings

KU, xrefs: 00B04A26

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: ef25b11faa9af5daa9ccef3d74349bbc65cecb6f58d46eee7699ce1b4524cb57
Instruction ID: a0370fd0a7501173dcc2f73722e280c2224de78512c978f300208ef0711384d8
Opcode Fuzzy Hash: ef25b11faa9af5daa9ccef3d74349bbc65cecb6f58d46eee7699ce1b4524cb57
Instruction Fuzzy Hash: BAD1F275550208DEC718DF64ED929F67BF8FB58710B80C45AEA06CB2B1EF349A81CB51

Function 00AF9B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF9C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00AF9CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00AF9DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00AF9E86

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 4663bdf7108ac5010a276723f883749668dee3b3ac1e813f41dcf9798ebc0674
Instruction ID: 87bd01f756b9b4cd1bff1b03d0fbd795931ade51028bb2c84c1184ecd45ac6a2
Opcode Fuzzy Hash: 4663bdf7108ac5010a276723f883749668dee3b3ac1e813f41dcf9798ebc0674
Instruction Fuzzy Hash: 7181CA75611204DBC714DFA0FD96AFA37B8FB48711F90842AF902DB2A1EF34A981CB55

Function 00B090F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00AF8146,00000000,?,?,?,?,?,00AEF85A,?,?,?,00B09573), ref: 00B09143
RtlReAllocateHeap.NTDLL(00000000,?,00AF8146,00000000), ref: 00B0914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00AF8146,00000000,?,?,?,?,?,00AEF85A,?,?,?,00B09573,?), ref: 00B09174
HeapAlloc.KERNEL32(00000000,?,00AF8146,00000000,?,?,?,?,?,00AEF85A,?,?,?,00B09573,?,00000001), ref: 00B0917B

Memory Dump Source

Source File: 00000000.00000002.1483108287.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.1483087605.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483134725.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483150487.0000000000B10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483169889.0000000000B13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1483189744.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 5eb4c3dfd55f378c50213a319101110f4efba90c7f28cf713b1e096bf12d85b9
Instruction ID: 1e94700a47c2b82a5ea58225a80b6f53a7b060460ca3fe564c9e496e59eda545
Opcode Fuzzy Hash: 5eb4c3dfd55f378c50213a319101110f4efba90c7f28cf713b1e096bf12d85b9
Instruction Fuzzy Hash: A9011676690604DFCB149FA0FC99AE93BA4FB49301BC48115F90AC7662EF7994448B80

Analysis Process: psjpq2s5tgtsjq0yguk.exePID: 2976, Parent PID: 5452COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	1499
Total number of Limit Nodes:	10

Executed Functions

Function 0060FF2A Relevance: 66.8, APIs: 29, Strings: 8, Instructions: 2026synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 00610590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 006105E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00610629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00610649
GetTickCount.KERNEL32 ref: 006106E6
GetCommandLineA.KERNEL32 ref: 00610873

Strings

~z0, xrefs: 006106C2
241, xrefs: 00610787
$}\N, xrefs: 006113B4
wb_m, xrefs: 00611FC6
HO, xrefs: 00611893
^d/, xrefs: 00610102
C:\Users\user, xrefs: 0061058A
C:\hjflhukc\xxxniijvj.exe, xrefs: 0061187E, 00611883, 006118C6, 00611E76, 00611E94, 00611EAE, 006120C8

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: $}\N$241$C:\Users\user$C:\hjflhukc\xxxniijvj.exe$HO$^d/$wb_m$~z0
API String ID: 3327569919-3478614120
Opcode ID: b40213a01dea7c42d6de4f1d795496064a5a0a8d272db4633dfaef4cf155fed9
Instruction ID: 4fa9b2472780790776c4e47e706597c68fd573b7afe21f240df8c33385a556f7
Opcode Fuzzy Hash: b40213a01dea7c42d6de4f1d795496064a5a0a8d272db4633dfaef4cf155fed9
Instruction Fuzzy Hash: 4503A671905E01CFD778DF68EC86ABA37B7FB44311B14601AE902CA2B1EB749983CB55

Function 005F88A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0062B028), ref: 005F893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 005F8AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 005F8D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 005F8D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 005F8DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 005F8E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 005F9158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 005F91F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 005F936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 005F94DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 005F963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 005F97B0

Strings

h)N^, xrefs: 005F8A54, 005F8A77
\, xrefs: 005F93D0
gKV`, xrefs: 005F8CE7
C:\hjflhukc\, xrefs: 005F8DF6, 005F9174, 005F947F, 005F9666
C:\Users\user, xrefs: 005F9016, 005F908E

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\hjflhukc\$\$gKV`$h)N^
API String ID: 1691758827-1793791328
Opcode ID: 0885bad4790cd400fe19c4db1e1d23dad3eec455825dc3c12f67666ce41e35f0
Instruction ID: 7f227bf4feece33dd77afbcd7e3fc01dde1bd1de2cb92c51ef7a1a2c84a747df
Opcode Fuzzy Hash: 0885bad4790cd400fe19c4db1e1d23dad3eec455825dc3c12f67666ce41e35f0
Instruction Fuzzy Hash: CE82E371501E05CFC738DB64EC86ABA37B7FB54311B00A42AE602D72A1EB789987CF55

Function 006184D7 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 688
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 006186E1
LoadLibraryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 0061876A
GetProcAddress.KERNEL32(00000000,00000000), ref: 00618854
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 00618891
RtlAllocateHeap.NTDLL(?,00000000,00000288,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000), ref: 006188DD
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 00618908
GetAdaptersInfo.IPHLPAPI(00000000,00000100,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 00618935
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000), ref: 0061897A
HeapAlloc.KERNEL32(?,00000000,00000100,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000), ref: 006189C3
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 00618A10
GetAdaptersInfo.IPHLPAPI(00000000,00000100,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 00618A78
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000), ref: 006190B2
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0060B7C4,?,?,00000000,00000100), ref: 006190D7

Strings

Q:3q, xrefs: 006185DB
SAcA, xrefs: 00618614

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Free$HeapLibrary$AdaptersInfo$AddressAllocAllocateLoadProcProcess
String ID: Q:3q$SAcA
API String ID: 3577610392-494069912
Opcode ID: e732b8629920ef7a1f16c6633c7f76f8cfd6e994cdecf487eb65c0ef7fcd002e
Instruction ID: 08128cbf936eaa1d77cd919fbc1f60627044c1bb025f6d90bf95c050f38d5f4a
Opcode Fuzzy Hash: e732b8629920ef7a1f16c6633c7f76f8cfd6e994cdecf487eb65c0ef7fcd002e
Instruction Fuzzy Hash: CC529A75915E01CFC338DF68ED91AA937B7FB58311B14641AE802DB2B0EB349983CB55

Function 006135AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 00613685
CreateServiceA.ADVAPI32(00000000,009B07F0,009B07F0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 006136D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00613728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0061374C
CloseServiceHandle.ADVAPI32(00000000), ref: 0061375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 006137D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00613836
CloseServiceHandle.ADVAPI32(00000000), ref: 00613847
CloseServiceHandle.ADVAPI32(00000000), ref: 006138B1

Strings

3ch, xrefs: 00613701
qh~B, xrefs: 0061360F

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 77a22542c8234396f8e9f60358750651d1cc1371e143e0f608592797e58f9519
Instruction ID: a033bc267e600585234c0685b444f12322cd0391144fa4dc3f13f37a56f33880
Opcode Fuzzy Hash: 77a22542c8234396f8e9f60358750651d1cc1371e143e0f608592797e58f9519
Instruction Fuzzy Hash: 8B919975615E21DBC3388F64ED859B937B7FB48701704741AE802DA3B0EBB49A83CB65

Function 0060B3DB Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,?), ref: 0060B528

Part of subcall function 006142B6: lstrlen.KERNEL32(?,?,005F2347,?), ref: 00614320

Strings

myiW, xrefs: 0060B70F
K]g[, xrefs: 0060B819

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID: K]g[$myiW
API String ID: 4141851928-3148350528
Opcode ID: 4c1622df156a64d173aaf8208884d1812f40457b8f2d2c542f137b00c198e333
Instruction ID: 9e765d8e50ccea923b5eca58ae917749d17cc525dbed8fccf9e29fb6969ca6ee
Opcode Fuzzy Hash: 4c1622df156a64d173aaf8208884d1812f40457b8f2d2c542f137b00c198e333
Instruction Fuzzy Hash: CA42C371901A0ACFC728EF64ED969BA77BAFB54300F00601AE506E71B1EF349A46CF55

Function 005FBECE Relevance: 4.7, APIs: 3, Instructions: 222
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 005FC004
GetProcAddress.KERNEL32(00000000), ref: 005FC080
CryptGenRandom.ADVAPI32(00000004,005F66DE,-AF16B4FB,?,0060AEAC,005F66DE), ref: 005FC1D3

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: b5ed670cb8b7c9aa5496730f0b4e4a87d6ad786b6fcd17c149730b5d544b8ab0
Instruction ID: 150df739450c2feaf2be0714a2c08cec6c41e5a4b038512e88b81dc621302e3d
Opcode Fuzzy Hash: b5ed670cb8b7c9aa5496730f0b4e4a87d6ad786b6fcd17c149730b5d544b8ab0
Instruction Fuzzy Hash: 5091A931601E06CFD7389F64ED569393BE7FB54321710B12AE902C66B0EB798983CB15

Function 00605485 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,005FDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00605628
CloseHandle.KERNEL32(005FDA33,?,?,?,?,00000000), ref: 00605652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00605665

Strings

D, xrefs: 006055A3

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 3857f39b238653ad21f8cf58dce664dbd88ec75464f53fd740c1f16dc0284b05
Instruction ID: cfd0eec36d7fad11f1b616ee86c438025ebc3e4afe185b68b32bfab6baaee0c4
Opcode Fuzzy Hash: 3857f39b238653ad21f8cf58dce664dbd88ec75464f53fd740c1f16dc0284b05
Instruction Fuzzy Hash: F641E132501E449BCB38DFA5FD969BB77B7FB85310B00601AE802866B0EB758853CF25

Function 006054D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,005FDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00605628
CloseHandle.KERNEL32(005FDA33,?,?,?,?,00000000), ref: 00605652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00605665

Strings

D, xrefs: 006055A3

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 367f4a795fbbe0e9756bf43843ad5e6f400ee90a5b8b014c43af46b0325a2720
Instruction ID: 31d6730533a7dfb0e11dfc9b29ffe5db41e53dc368ea7184cff347cc0660cc54
Opcode Fuzzy Hash: 367f4a795fbbe0e9756bf43843ad5e6f400ee90a5b8b014c43af46b0325a2720
Instruction Fuzzy Hash: 2041BD31501E04DBCB38DFA5ED9A9BB77B7FB84310B00601AE802966B0EB748843CF25

Function 00609B78 Relevance: 6.2, APIs: 4, Instructions: 201
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00609C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00609CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00609DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00609E86

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 793edd93b3282eee80957b0132ef33e0afad9bd66eb38cad09ffc086dcfe8333
Instruction ID: 067ba0913de941f77a4421990823f5296d1ef9b0dac6735b7c37c3f8f9137284
Opcode Fuzzy Hash: 793edd93b3282eee80957b0132ef33e0afad9bd66eb38cad09ffc086dcfe8333
Instruction Fuzzy Hash: 9E81AD75611A01DBD738EF60ED86A7A37BBFB44311F00341AE902C62E1EB749983CB25

Function 005FC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FB7CD: WaitForSingleObject.KERNEL32(0060AEAC,00004E20,00000001,?,005FBFA2,00000001,-AF16B4FB,?,0060AEAC,005F66DE), ref: 005FB81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,005F67E3,?,00000004,?,00000000,?), ref: 005FC746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 005FC90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00000001), ref: 005FC983

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: 6c9cceb19ecd5e1ddd9b09d18da98fb0a6887d5371b43b868931d3220c737852
Instruction ID: e758a9892ee4fbcdbf255680cfdbf92632465e5bd5a79c7b8c68fe98973b2d97
Opcode Fuzzy Hash: 6c9cceb19ecd5e1ddd9b09d18da98fb0a6887d5371b43b868931d3220c737852
Instruction Fuzzy Hash: 2491BC71911A09DFC724DF68EE859657BB7FB88310710742AE606CA2B0EB389943CF15

Function 005FE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(005F8954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,005F8954), ref: 005FE865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 005FE895
FreeSid.ADVAPI32(?), ref: 005FE8DC

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 05460035b282456fb4b6cc542214a18397161efd1396d5f360c685064bcd89ba
Instruction ID: 2466d60e028f1cc8e687655016ffe0b7f57b682f40cb4e435d06806dfaa910e9
Opcode Fuzzy Hash: 05460035b282456fb4b6cc542214a18397161efd1396d5f360c685064bcd89ba
Instruction Fuzzy Hash: 5A41CE74906A05DFC730DFA5ED8597977F7FB08301B40241AE502D7270E7388982CB56

Function 006020D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,006009C2,?,?,?), ref: 006020F0
CharLowerBuffA.USER32(?,00000000,?,006009C2,?,?,?), ref: 00602131

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: ee73c951c350497530d8362034d6b1a106d64e5f105f61c4c41cad366aaf643b
Instruction ID: 33b93180d572dc232c694493d8776cc4f12dc0e66c67611be2b6e2279504c099
Opcode Fuzzy Hash: ee73c951c350497530d8362034d6b1a106d64e5f105f61c4c41cad366aaf643b
Instruction Fuzzy Hash: 5FF09A31224A049FCB29DF45EC5A47A37F3FB547407107019F9068A671EB79ED82EB52

Function 006123A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0061A3A7,?,?,?,0061D0BE), ref: 006123F6
RtlAllocateHeap.NTDLL(00000000,?,0061A3A7,?,?,?,0061D0BE), ref: 006123FD

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 565732f94d207a669bbd21fdaf4c8c67c3f82b753302500aedf6ed3950205067
Instruction ID: 297faad1c247bc26eea75e4a3c5bd4d05c67f7ce4c9afbe5602d14815cc7ae86
Opcode Fuzzy Hash: 565732f94d207a669bbd21fdaf4c8c67c3f82b753302500aedf6ed3950205067
Instruction Fuzzy Hash: 71F02B369017019FCB209FA9FC49A893766F304305B286003F015DA1B1C738E891CF54

Function 005FDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00608109,?,00608109,00000000), ref: 005FDE6C
RtlFreeHeap.NTDLL(00000000,?,00608109,00000000), ref: 005FDE73

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 70434dd4944bbdf22301d12b4601505661962473775acec2e69c2677e08839f4
Instruction ID: a22f19853aa9f10ca7a4553db50eebdb5aeb8c09184377d23b6a3cad66c9f515
Opcode Fuzzy Hash: 70434dd4944bbdf22301d12b4601505661962473775acec2e69c2677e08839f4
Instruction Fuzzy Hash: D3E0C232A40A48DBEF208BD5FC4B7143BEEFB20341F00A511F219CA130CB2595528B84

Function 005F3B2C Relevance: 1.6, APIs: 1, Instructions: 104
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 005F3BF6

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3848fd7d0af5992af4c318bccde0aa84230070625423d8bcb178bac6f6abd4d3
Instruction ID: 88e57e698fe270b7ed3edb0a604b9963deed0859105e93dc2f249b2c079d595d
Opcode Fuzzy Hash: 3848fd7d0af5992af4c318bccde0aa84230070625423d8bcb178bac6f6abd4d3
Instruction Fuzzy Hash: B741F772951A09DBC334DF69EC4ADA237BAF744324F04A42AF605D7660DA349983CF90

Function 006015E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0060160D

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2be8dd2b0af8feaf0d327f20386d6aa84ed83eb077b4da13c7492953ecfba74e
Instruction ID: 7bd343f3eec5eccc650f9bc6fa3fe8d5cf83bb19c0530d04d9bf19568f949d48
Opcode Fuzzy Hash: 2be8dd2b0af8feaf0d327f20386d6aa84ed83eb077b4da13c7492953ecfba74e
Instruction Fuzzy Hash: 9BD0C9340047559A8B247FA59C064267BA6EB046007413015A8409A070DBB4D901C75B

Non-executed Functions

Function 0061D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 0061D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0061D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 0061DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0061DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0061DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 0061DC1C
CloseHandle.KERNEL32(?), ref: 0061DC33
CloseHandle.KERNEL32(?), ref: 0061DC66
CloseHandle.KERNEL32(?), ref: 0061DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 0061DD4F
CloseHandle.KERNEL32(?), ref: 0061DD9F
CloseHandle.KERNEL32(?), ref: 0061DDB2
CloseHandle.KERNEL32(?), ref: 0061DE41
CloseHandle.KERNEL32(00000000), ref: 0061DE67
CloseHandle.KERNEL32(?), ref: 0061DE7E

Strings

D, xrefs: 0061DB1A

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: f275c3bef1310fede200eb27d6ff37e7247e4549f5b5a90258cd72afa2548e9d
Instruction ID: a3e17ae5fa63f66a5eb05c2a2a08e801f1f7e8ce5bb4c17eb830df27c2d6d628
Opcode Fuzzy Hash: f275c3bef1310fede200eb27d6ff37e7247e4549f5b5a90258cd72afa2548e9d
Instruction Fuzzy Hash: FE027676911A05DFCB34CF68ED829AA7BB7FB08301714651AE802D7270EB349993CF55

Function 0060111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006011F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00601267
CloseHandle.KERNEL32(00000000), ref: 0060128B
GetTickCount.KERNEL32 ref: 006012D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0060153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0060157E
CloseHandle.KERNEL32(00000000), ref: 0060158F

Strings

Ra);, xrefs: 00601514

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: 0cea652f6d2de7e75502d301bcd363d2514f90b3ff34b4521bd96b7011772511
Instruction ID: ea4913d3252a291d631475fcc0fb2e5836860cb4b48e164600ca18be7e856a75
Opcode Fuzzy Hash: 0cea652f6d2de7e75502d301bcd363d2514f90b3ff34b4521bd96b7011772511
Instruction Fuzzy Hash: 57B1ABB1515E019FD7388F68ED8697A37B7FB49351710601AF902CA2B0EB748983CB29

Function 00601636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006016B2
Process32First.KERNEL32(00000000,00000128), ref: 006017BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00601932
Module32First.KERNEL32(00000000,00000224), ref: 00601991
CloseHandle.KERNEL32(?,0000000A), ref: 00601A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00601ACE
CloseHandle.KERNEL32(00000000), ref: 00601AF5

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 633269ae5a571381c8559d7b337dafceda0ef76acf507d419f004d1dc98aaa57
Instruction ID: c28e4c163065f0285ff6b872f2fec6d1c1425e2596a592f658f1eaabca1eb5bc
Opcode Fuzzy Hash: 633269ae5a571381c8559d7b337dafceda0ef76acf507d419f004d1dc98aaa57
Instruction Fuzzy Hash: 94C1F075901E00CFD738DF64EC96ABA33B7FB55311B00601AE906CA2A0EB789983CF55

Function 00609F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00609FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 0060A049
GetLastError.KERNEL32 ref: 0060A061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 0060A162
CloseServiceHandle.ADVAPI32(00000000), ref: 0060A3B6

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 34b9d9712ff23c4d04c8614b836b6a660ba2b7021e1c698ee88d18d32c54c110
Instruction ID: 3bd1636e41696569662696c8833c4e3ccfd359b85e871b97aee838dc21a651e7
Opcode Fuzzy Hash: 34b9d9712ff23c4d04c8614b836b6a660ba2b7021e1c698ee88d18d32c54c110
Instruction Fuzzy Hash: 56D1EB76901E00DFC338CFA4ED85A7A77B7FB44351B14641AE802DB2A0EB749A83CB51

Function 005F5C39 Relevance: 7.7, APIs: 5, Instructions: 247filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 005F5DEC
FindFirstFileA.KERNEL32(?,?), ref: 005F5EB2
DeleteFileA.KERNEL32(?), ref: 005F5FE2
FindNextFileA.KERNEL32(00000000,?), ref: 005F6020
FindClose.KERNEL32(00000000), ref: 005F6042

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 8ffc83ab1a0cb4620c71a1f8b151efe7faf0afb33d0a8ce7c5661ccc09169505
Instruction ID: 3f632cb44b6832bada044c4b3d6926fa40c2ca1452c35c58f4ae915df1956e40
Opcode Fuzzy Hash: 8ffc83ab1a0cb4620c71a1f8b151efe7faf0afb33d0a8ce7c5661ccc09169505
Instruction Fuzzy Hash: C4A1CE75512E19CFC338DB64EC869B937BAFB48301710741AEA06CB670EB789983CB55

Function 0060571F Relevance: 6.2, APIs: 4, Instructions: 213processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00605804
Process32First.KERNEL32(00000000,00000128), ref: 006058E2
Process32Next.KERNEL32(00000000,00000128), ref: 006059E8
CloseHandle.KERNEL32(00000000), ref: 00605A7E

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ba3b7ef4476c4896ea28d82c027a252a8036bad05325a1d7f1306e7000d86ce3
Instruction ID: 1f25a0c704af366b7f0e984fdcb3b146d7a3000b2ba874f54e4a8258f1dd6d0c
Opcode Fuzzy Hash: ba3b7ef4476c4896ea28d82c027a252a8036bad05325a1d7f1306e7000d86ce3
Instruction Fuzzy Hash: FE91BD75605E10CBC738DB69ED9A9AA37F7FB48311B10651AE803DA6A0EB349943CF11

Function 0060AE3B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20aff88d1ca88ae825f46216a95df1e84c8d30feb3d51e8297848ff3d80d9fd
Instruction ID: 3c9b249f7fab82b726208598949ddb38e315394bb385129829beb5e683662ec2
Opcode Fuzzy Hash: f20aff88d1ca88ae825f46216a95df1e84c8d30feb3d51e8297848ff3d80d9fd
Instruction Fuzzy Hash: 241119B1615A41CBD379CF68ED815653BB3F794342750B81AE102DB6B1EB348583DF11

Function 005FC9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 005FCAF2
SetServiceStatus.ADVAPI32(0062B2DC), ref: 005FCB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005FCB78
SetServiceStatus.ADVAPI32(0062B2DC), ref: 005FCBE5
WaitForSingleObject.KERNEL32(00001388), ref: 005FCC62
SetServiceStatus.ADVAPI32(0062B2DC), ref: 005FCCAF
CloseHandle.KERNEL32 ref: 005FCCC5
SetServiceStatus.ADVAPI32(0062B2DC), ref: 005FCD8F

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 1435bbfad42b65cf5bc9607903b72feff3deed1ae5cb932645f872d0cf4d17c9
Instruction ID: 7fe5e36369723705648624b3b2afab3e0aa190cbd90d57ff593f47c27262b52a
Opcode Fuzzy Hash: 1435bbfad42b65cf5bc9607903b72feff3deed1ae5cb932645f872d0cf4d17c9
Instruction Fuzzy Hash: D6913374112E56CBC334DF69EE898693BFBFB58315300752AE906CA270DB78A943CB54

Function 00600806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006008C2
Process32First.KERNEL32(00000000,00000128), ref: 00600966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00600A15
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00600A64
CloseHandle.KERNEL32(00000000), ref: 00600A82
Process32Next.KERNEL32(00000000,00000128), ref: 00600AD2
CloseHandle.KERNEL32(00000000), ref: 00600B10

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 64212bb2e90b2f53dd13b401846f3080bf3ae7de9a5a02c97607a67d5a53d84c
Instruction ID: 8ae6a2c343f416fd9e839ac9e0b61209ef052e70c3097e9c75895368c886e707
Opcode Fuzzy Hash: 64212bb2e90b2f53dd13b401846f3080bf3ae7de9a5a02c97607a67d5a53d84c
Instruction Fuzzy Hash: 6681BB72911E11DFD334CF68ED85ABA33B7FB58312B00611AE842C66B1EB748983CB45

Function 0060B046 Relevance: 9.2, APIs: 6, Instructions: 184filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0060B104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0060B16D
CloseHandle.KERNEL32(00000000), ref: 0060B1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0060B25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0060B2AB
CloseHandle.KERNEL32(00000000), ref: 0060B2D8

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 9f0d07ec58764fef2417a9a6a64130347fa3fbd34bab84a726e5b90fcd983391
Instruction ID: 10b5fae86033a7a08ab5565b55248efaa9eabb07ab7926269ce8cb1ee1f71a1c
Opcode Fuzzy Hash: 9f0d07ec58764fef2417a9a6a64130347fa3fbd34bab84a726e5b90fcd983391
Instruction Fuzzy Hash: 3B71AB31511A05DFC738DF68ED818BA37B7FB44316710751AE852C76A0E7349A83CB25

Function 00614589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,005FD583,Function_0000AD87,00000002,00000000), ref: 00614637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00614655
CloseHandle.KERNEL32(00000000,?,00000002,?,005FD583,Function_0000AD87,00000002,00000000), ref: 0061468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,005FD583,Function_0000AD87,00000002,00000000), ref: 006146A1
CloseHandle.KERNEL32(?,00000002,?,005FD583,Function_0000AD87,00000002,00000000), ref: 00614712

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 2b2d6b315d2ca45f8ca93439e52deccf45d7eb258fddcdbf23d9627052046a48
Instruction ID: 48e32eb143ec0485cc5c5ed187819c460e77c94bb702900c6111910739421c31
Opcode Fuzzy Hash: 2b2d6b315d2ca45f8ca93439e52deccf45d7eb258fddcdbf23d9627052046a48
Instruction Fuzzy Hash: F8416575501A80DFC334DF68ED869663BB7FB99715724A42AE846C7670EB309883CB11

Function 00614927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00614CBC

Part of subcall function 0060074E: wvsprintfA.USER32(?,?,?), ref: 006007C3

Sleep.KERNEL32(00015F90), ref: 00614E60
DeleteFileA.KERNEL32(?), ref: 00614E7F

Strings

KU, xrefs: 00614A26

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: a2ed34554701cbe7cf686a9f33d7c62946dab27086a1d077f81f1b922084094f
Instruction ID: 4438079f5aa67d77def8adacb33930340e17ae361a83cc19dd02cfe09d8e6555
Opcode Fuzzy Hash: a2ed34554701cbe7cf686a9f33d7c62946dab27086a1d077f81f1b922084094f
Instruction Fuzzy Hash: C6D1E035511E058FC738DF64ED96AA637FBFB44310B04640AE906CB2B1EB789983CB65

Function 006190F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00608146,00000000,?,?,?,?,?,005FF85A,?,?,?,00619573), ref: 00619143
RtlReAllocateHeap.NTDLL(00000000,?,00608146,00000000), ref: 0061914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00608146,00000000,?,?,?,?,?,005FF85A,?,?,?,00619573,?), ref: 00619174
HeapAlloc.KERNEL32(00000000,?,00608146,00000000,?,?,?,?,?,005FF85A,?,?,?,00619573,?,00000001), ref: 0061917B

Memory Dump Source

Source File: 00000002.00000002.1468893570.00000000005F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1468882233.00000000005F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468914847.000000000061F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468926349.0000000000620000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468938349.0000000000623000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1468951231.000000000062C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_psjpq2s5tgtsjq0yguk.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 0b63fb82352c31843dafa032c885d1fbef7c7baba0643a81f37ea8a4f1dbe100
Instruction ID: 0ee31b10d65ffe309e68701ac9d7065528c637dfb9b1a65fc577ac3fb32264e0
Opcode Fuzzy Hash: 0b63fb82352c31843dafa032c885d1fbef7c7baba0643a81f37ea8a4f1dbe100
Instruction Fuzzy Hash: 70011676540E04DFDB309FA0FC9AA6937B7FB08301F886515F90A87272EB7995428B94

Analysis Process: yanidfx.exePID: 3120, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	19.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1503
Total number of Limit Nodes:	22

Executed Functions

Function 0075FF2A Relevance: 68.5, APIs: 29, Strings: 9, Instructions: 2026synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00760590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 007605E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00760629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00760649
GetTickCount.KERNEL32 ref: 007606E6
GetCommandLineA.KERNEL32 ref: 00760873

Strings

C:\Windows\system32\config\systemprofile, xrefs: 0076058A
~z0, xrefs: 007606C2
$}\N, xrefs: 007613B4
^d/, xrefs: 00760102
241, xrefs: 00760787
HO, xrefs: 00761893
C:\hjflhukc\xxxniijvj.exe, xrefs: 0076187E, 00761883, 007618C6, 00761E76, 00761E94, 00761EAE, 007620C8
wb_m, xrefs: 00761FC6
tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe", xrefs: 0076204C, 0076205D, 007620B6

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: $}\N$241$C:\Windows\system32\config\systemprofile$C:\hjflhukc\xxxniijvj.exe$HO$^d/$tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"$wb_m$~z0
API String ID: 3327569919-2039580995
Opcode ID: b1771a39554c1f9514a54c2555303194813295cf95f3b76d768b64eab0336eb6
Instruction ID: 351fc37a19fb045a9f5cf539365717174466d4e89d51cdedf5293a07ae452612
Opcode Fuzzy Hash: b1771a39554c1f9514a54c2555303194813295cf95f3b76d768b64eab0336eb6
Instruction Fuzzy Hash: CA03AB71600601DBD758DF64EC8A97A37B4F744391B54C52AE90ECA2B1EB7C98C0CB5E

Function 007488A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0077B028), ref: 0074893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00748AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 00748D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 00748D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00748DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00748E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00749158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 007491F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 0074936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 007494DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 0074963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 007497B0

Strings

C:\Windows\system32\config\systemprofile, xrefs: 00749016, 0074908E
\, xrefs: 007493D0
C:\hjflhukc\, xrefs: 00748DF6, 00749174, 0074947F, 00749666
h)N^, xrefs: 00748A54, 00748A77
gKV`, xrefs: 00748CE7

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\hjflhukc\$\$gKV`$h)N^
API String ID: 1691758827-4224816522
Opcode ID: 0b5ec13e09de181e212b54349ba19fdcfff61136d0197711d2b6e0a9d38078f7
Instruction ID: ba6d161f0cfa0a0c98b843a2b97ce4f8203674bae49a0947d921165e7346437b
Opcode Fuzzy Hash: 0b5ec13e09de181e212b54349ba19fdcfff61136d0197711d2b6e0a9d38078f7
Instruction Fuzzy Hash: C182E3B1540204DBD708DF64EC8A9BA37B4F744381B40C42AEA0ED62B1EB7C99C5CB5E

Function 007684D7 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 688
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 007686E1
LoadLibraryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 0076876A
GetProcAddress.KERNEL32(00000000,00000000), ref: 00768854
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 00768891
RtlAllocateHeap.NTDLL(?,00000000,00000288,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100), ref: 007688DD
FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 00768908
GetAdaptersInfo.IPHLPAPI(00000000,00000009,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 00768935
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100), ref: 0076897A
HeapAlloc.KERNEL32(?,00000000,00000009,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100), ref: 007689C3
FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 00768A10
GetAdaptersInfo.IPHLPAPI(00000000,00000009,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 00768A78
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100), ref: 007690B2
FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,?,0075B7C4,?,?,00000000,00000100,00000009), ref: 007690D7

Strings

SAcA, xrefs: 00768614
Q:3q, xrefs: 007685DB

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Free$HeapLibrary$AdaptersInfo$AddressAllocAllocateLoadProcProcess
String ID: Q:3q$SAcA
API String ID: 3577610392-494069912
Opcode ID: 0ea9ce0713135d178214f031ff7df5a110c980fe7b4e082a3d1ceb3ca5d9bafa
Instruction ID: 45e45d4d94d9e51ebb09071d5819525051dd3bad23efc10af7de767ceaa374e2
Opcode Fuzzy Hash: 0ea9ce0713135d178214f031ff7df5a110c980fe7b4e082a3d1ceb3ca5d9bafa
Instruction Fuzzy Hash: FD52AA75615600CBC358DF68EC89A6937F4FB58391B14C51AE90ECA2B1EB7C98C0CB5E

Function 00758695 Relevance: 22.0, APIs: 10, Strings: 2, Instructions: 1045networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00759154
setsockopt.WS2_32(00000000,0000FFFF,00001006,00000000,00000004), ref: 007591DB
gethostbyname.WS2_32(?), ref: 00759261
inet_ntoa.WS2_32(?), ref: 007592CF
inet_addr.WS2_32(00000000), ref: 007592D6
htons.WS2_32(00000050), ref: 007592FB
connect.WS2_32(00000000,?,00000010), ref: 00759316
send.WS2_32(00000000,00000000,00000000,00000000), ref: 007593A1
recv.WS2_32(0000000B,?,00000400,00000000), ref: 0075947C
closesocket.WS2_32(0000000B), ref: 007597C6

Strings

/, xrefs: 00758982
;$Rb, xrefs: 00758C35

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonsinet_addrinet_ntoarecvsendsetsockoptsocket
String ID: /$;$Rb
API String ID: 4203722200-1076244922
Opcode ID: d50ec3684e26ff0a5cc88c183488d8d024b6d5ea8bf7895afe372cb384461324
Instruction ID: 543c808c4c643f2ebe5c83615db42120ae169c3657cc4ce032b7adde553d5371
Opcode Fuzzy Hash: d50ec3684e26ff0a5cc88c183488d8d024b6d5ea8bf7895afe372cb384461324
Instruction Fuzzy Hash: 4792E271511600DBD718DF24EC86AB937B4FB44392B10C42AE90EDA2B1EBBC99C5CF59

Function 00745C39 Relevance: 7.7, APIs: 5, Instructions: 247
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00745DEC
FindFirstFileA.KERNELBASE(?,?), ref: 00745EB2
DeleteFileA.KERNELBASE(?), ref: 00745FE2
FindNextFileA.KERNELBASE(00000000,?), ref: 00746020
FindClose.KERNEL32(00000000), ref: 00746042

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 01d18aafec02c22e6073d5d067dc97199db91445d759ed3b2044b7bfff68d9b9
Instruction ID: 503270ab9cef37b7f1e5e863a0a0c43c84c2d78cd78332923fd9047175fb517d
Opcode Fuzzy Hash: 01d18aafec02c22e6073d5d067dc97199db91445d759ed3b2044b7bfff68d9b9
Instruction Fuzzy Hash: EBA1BB71610A45DBD358CB64EC8A9A933B8F744381710C01AE90ECA671EB7C99C5CF5E

Function 0075571F Relevance: 6.2, APIs: 4, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00755804
Process32First.KERNEL32(00000000,00000128), ref: 007558E2
Process32Next.KERNEL32(00000000,00000128), ref: 007559E8
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00755A7E

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: c6ebf96ba146eccceabbe73003dc974cdd2292699dc6f71059ff594445a9a899
Instruction ID: 028dab1f6ea502545a50babc2c6d019c4d9c5a7b5d164e054c0901058bb5b811
Opcode Fuzzy Hash: c6ebf96ba146eccceabbe73003dc974cdd2292699dc6f71059ff594445a9a899
Instruction Fuzzy Hash: 2591DC75A05600CFC748DB28ECAA5A937B4F748392B10C51AE90ACA670EB7C99D5CF49

Function 0075B3DB Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,?), ref: 0075B528

Part of subcall function 007642B6: lstrlen.KERNEL32(?,?,00745DCE,?,00000104,?), ref: 00764320

Strings

K]g[, xrefs: 0075B819
myiW, xrefs: 0075B70F

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID: K]g[$myiW
API String ID: 4141851928-3148350528
Opcode ID: 942b4be34c60c2d2241269fa53a376a4e473d66dedf6fe1957c2ad43fdfc684b
Instruction ID: 95ab95026a94a035e0c5c9d20ec61927b2a0aeec599abb4c8241d2022c05f3ff
Opcode Fuzzy Hash: 942b4be34c60c2d2241269fa53a376a4e473d66dedf6fe1957c2ad43fdfc684b
Instruction Fuzzy Hash: 2742B271900605DBCB18EF64ED969FD73B8FB14381B40801AE50AD61B2EB7C9AC5CF5A

Function 007624D3 Relevance: 5.0, APIs: 1, Strings: 2, Instructions: 520
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000008AE), ref: 00762D0A

Strings

C:\hjflhukc\xxxniijvj.exe, xrefs: 00762D9E
tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe", xrefs: 00762D94

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Sleep
String ID: C:\hjflhukc\xxxniijvj.exe$tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
API String ID: 3472027048-2520137044
Opcode ID: 71046394ced923067c81f3675949dc66f52f312f7782c00106168c06955c5e82
Instruction ID: 042cbe7680456917e68a0bf2468e7844d643f2065583e9134a45f2658c78c5b0
Opcode Fuzzy Hash: 71046394ced923067c81f3675949dc66f52f312f7782c00106168c06955c5e82
Instruction Fuzzy Hash: F132BF71900604DFD758DF64ED96AA937F4FB04381B10C42AE80EDB2A2EB7C99C5CB59

Function 0074BECE Relevance: 4.7, APIs: 3, Instructions: 222
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00000000), ref: 0074C004
GetProcAddress.KERNEL32(00000000), ref: 0074C080
CryptGenRandom.ADVAPI32(00000004,?,00000000,?,00764797,?,007627D6,?), ref: 0074C1D3

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: 8f5c33d6028fbadf54965343ffc19a0489e8d2225cbb979fa9c0254d001e493c
Instruction ID: 3ebdcbe9acf5ec3b329c15ab38cdeaaabe82e0e275a146322461563d22afb595
Opcode Fuzzy Hash: 8f5c33d6028fbadf54965343ffc19a0489e8d2225cbb979fa9c0254d001e493c
Instruction Fuzzy Hash: 7C91AC71615601DBE7589F68EC5AA3937E5FB543D1710C21AE40EC66B0EBBC88C0CB5E

Function 007674E8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00767525

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: f3f172231995c76cfde71bbf68703e65f8fe055f6295912373019552af8d72cd
Instruction ID: 84d4866cbd5f88d2e3bce7adc9f8a507cc1e53a05037496e26d80cd5851a2893
Opcode Fuzzy Hash: f3f172231995c76cfde71bbf68703e65f8fe055f6295912373019552af8d72cd
Instruction Fuzzy Hash: 38F05EB2A202089FD704DF58E94576977F8F704356F04856AD41DD3250E779A654CF44

Function 0074C9ED Relevance: 12.2, APIs: 8, Instructions: 196
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 0074CAF2
SetServiceStatus.SECHOST(0077B2DC), ref: 0074CB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0074CB78
SetServiceStatus.ADVAPI32(0077B2DC), ref: 0074CBE5
WaitForSingleObject.KERNEL32(00001388), ref: 0074CC62
SetServiceStatus.ADVAPI32(0077B2DC), ref: 0074CCAF
CloseHandle.KERNEL32 ref: 0074CCC5
SetServiceStatus.ADVAPI32(0077B2DC), ref: 0074CD8F

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: c8b877f52ea3dd56e2a20f352f9960a6c0dd03b90f06fa0c246fd65e649a7447
Instruction ID: adb5f683aefeabdfbee8c75a0f16eaf8ebd1ffd09f129f040b3c29d7029df94f
Opcode Fuzzy Hash: c8b877f52ea3dd56e2a20f352f9960a6c0dd03b90f06fa0c246fd65e649a7447
Instruction Fuzzy Hash: 71913F745122019FD359DF68EE89A293BF5F718385350C52AE40ECA271EB7C98C1CB9E

Function 00755485 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0074DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00755628
CloseHandle.KERNEL32(0074DA33,?,?,?,?,00000000), ref: 00755652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00755665

Strings

D, xrefs: 007555A3

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 209d7f70ee109695907a81dac0f221592afc4cfbd2c90528c1362b267f4ea3f1
Instruction ID: 986e87d0dee8ec301c6f4693b0a91b8e4c090b4f9aeba68a2c8c8b6088e87152
Opcode Fuzzy Hash: 209d7f70ee109695907a81dac0f221592afc4cfbd2c90528c1362b267f4ea3f1
Instruction Fuzzy Hash: F0411371501644DBCB18DFA5ED969AA77B5FB84381710C02AE90ECA170E7BC88D5CB1E

Function 007554D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0074DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00755628
CloseHandle.KERNEL32(0074DA33,?,?,?,?,00000000), ref: 00755652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00755665

Strings

D, xrefs: 007555A3

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 48d812dcba309806bcb2f03d60804f091087d602f7820cbb58af4e64fa19d166
Instruction ID: e1c1125b1401e1dce14546906e936b77e2bcdff4c3560ace18c2170adf26f073
Opcode Fuzzy Hash: 48d812dcba309806bcb2f03d60804f091087d602f7820cbb58af4e64fa19d166
Instruction Fuzzy Hash: 4C41EE71500644DBDB18DFA4ED9A9BA77B5FB84781B00C01AE90E86170EBBC48D4CF1E

Function 0074C622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0074B7CD: WaitForSingleObject.KERNEL32(007627D6,00004E20,00000000,?,0074BFA2,00000000,00000000,?,00764797,?,007627D6,?), ref: 0074B81D

CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000000,00000000,00000000,0074D913,00000000,00000000,?,00000000), ref: 0074C746
WriteFile.KERNELBASE(00000000,?,?,?,00000000,?,?,?,?,00000000,?), ref: 0074C90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000,?), ref: 0074C983

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: 6c491641a2a2165c4a12b2f091cd051dda37ce04c6ecf45c56b4b67747a55721
Instruction ID: 9e1fd3c8e9f40fc1ce4129841172a1f1ee4a077fa93be2228b60157793a7e6cb
Opcode Fuzzy Hash: 6c491641a2a2165c4a12b2f091cd051dda37ce04c6ecf45c56b4b67747a55721
Instruction Fuzzy Hash: 8C91B9B1612605DBC749CF28ED899297BB4FB84391710C12AE60ECA2B4E73C99C0DF0D

Function 0074E769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00748954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00748954), ref: 0074E865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0074E895
FreeSid.ADVAPI32(?), ref: 0074E8DC

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 4ee2ec24ab14a1767100d8d68247152d50a3a15adb14b331f600dca6f0123098
Instruction ID: 6613d183a5ec98cefb6ec52ba4fae6446e6300aead6e8fb5cd45cfaf91430f6c
Opcode Fuzzy Hash: 4ee2ec24ab14a1767100d8d68247152d50a3a15adb14b331f600dca6f0123098
Instruction Fuzzy Hash: E2418875915204EFDB44CFA5EC88A7977B4FB08395B80C01AE60AD7261E73C99C0CB1E

Function 007520D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,00755997,?,?,?), ref: 007520F0
CharLowerBuffA.USER32(?,00000000,?,00755997,?,?,?), ref: 00752131

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: d2a5fc5a06489bc0a1b6049a0af1965055ffbf20750ef217c5f42d9532ccd34e
Instruction ID: 7ff3d76142b422a5f5e5cb311ba74c4c625e1203c3992cc6f4de1740f9b106a2
Opcode Fuzzy Hash: d2a5fc5a06489bc0a1b6049a0af1965055ffbf20750ef217c5f42d9532ccd34e
Instruction Fuzzy Hash: DCF06D312246049BDB498F45ED4A47A3BF1F754781700C019E80E8A671E73D9DC0AB9A

Function 007623A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0076A3A7,?,?,?,0076D0BE), ref: 007623F6
RtlAllocateHeap.NTDLL(00000000,?,0076A3A7,?,?,?,0076D0BE), ref: 007623FD

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 9951d2934db34d68b7f40710c78829eae6e8035ad9e9a9e54e741949a6726ef2
Instruction ID: 6b6fd2ab9cdfebf0f17ea3a0e73e3ba58c0d5b566ee1f4aac0208c822daf1966
Opcode Fuzzy Hash: 9951d2934db34d68b7f40710c78829eae6e8035ad9e9a9e54e741949a6726ef2
Instruction Fuzzy Hash: 3FF0A036201301ABCA008FA9FD8D9593764F304394B208002F55EDA1A1D37CE8908F98

Function 0074DE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000002,?,007582CB,000036E2,000036E2,00000000,-00000002,?,00745E87,00000002,00000000,?,00000000,000036E2,00000002), ref: 0074DE6C
RtlFreeHeap.NTDLL(00000000,?,007582CB,000036E2,000036E2,00000000,-00000002,?,00745E87,00000002,00000000,?,00000000,000036E2,00000002,?), ref: 0074DE73

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 67433bdd19c016d95999e4154ce50c231460c9b79d7e877c1951eb4c30f858d5
Instruction ID: 68de796a6693888b46f7e479e951522ebad2193c2db315de217aa30bd353125f
Opcode Fuzzy Hash: 67433bdd19c016d95999e4154ce50c231460c9b79d7e877c1951eb4c30f858d5
Instruction Fuzzy Hash: 8EE08C32600348EBEE149BE5FC4A6043BECFB21381B00C520F11ECA130D72999808A8D

Function 007675CE Relevance: 1.7, APIs: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(007627D6,80000000,00000000,00000000,00000003,00000000,00000000,00000000,00000000,00000000,?,007647E5,007627D6,00000000,00003571,00000003), ref: 0076770C

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fd81ec042631f558597adcdb26644b04166357ca922f1ef161170bbb8d5e9104
Instruction ID: d35f18ef0d289789890ffaa8cc73d48f371090e899c63ffcfc261e73c47c287c
Opcode Fuzzy Hash: fd81ec042631f558597adcdb26644b04166357ca922f1ef161170bbb8d5e9104
Instruction Fuzzy Hash: CB510236659301DBE30C9B68FD56A3637A4F7503E6B10C02AE90ECA5B0E76D99C0CB5D

Function 00743B2C Relevance: 1.6, APIs: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00743BF6

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: aee5dad8de1a7d345022a1b383246881d991e693e5bd9b799685f0137bc5da48
Instruction ID: 3c0007159605df09e171263f5b018fcbfdc12cc9f80eeee93c49f3737c520202
Opcode Fuzzy Hash: aee5dad8de1a7d345022a1b383246881d991e693e5bd9b799685f0137bc5da48
Instruction Fuzzy Hash: 48410472941209DBC364DF69EC4A9E237B8E740395B04C52AE60DD7260EB7C95C1CFA9

Function 0076473B Relevance: 1.4, APIs: 1, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,?,00000000,00000000,?,007627D6,?), ref: 00764859

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5f656a1d51d8b699b2f4816ac9971ce2f90cd7c5e81fc713808011d368b39b07
Instruction ID: fc84d31ab16e7c8aa0e7e84b3a82f0164422660323eb5d9d82f6f0c0e0e1ae67
Opcode Fuzzy Hash: 5f656a1d51d8b699b2f4816ac9971ce2f90cd7c5e81fc713808011d368b39b07
Instruction Fuzzy Hash: 6341F071540601DBD329AB64EC4BA2537B0FB447D1B51C42EE90E8A271EBBC85C0CB6E

Non-executed Functions

Function 0076D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 0076D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0076D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 0076DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0076DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0076DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 0076DC1C
CloseHandle.KERNEL32(?), ref: 0076DC33
CloseHandle.KERNEL32(?), ref: 0076DC66
CloseHandle.KERNEL32(?), ref: 0076DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 0076DD4F
CloseHandle.KERNEL32(?), ref: 0076DD9F
CloseHandle.KERNEL32(?), ref: 0076DDB2
CloseHandle.KERNEL32(?), ref: 0076DE41
CloseHandle.KERNEL32(00000000), ref: 0076DE67
CloseHandle.KERNEL32(?), ref: 0076DE7E

Strings

D, xrefs: 0076DB1A

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: fa84efb41be3743c0922df205026b6ce91084918fe287269569a5ea6ca4a5cb6
Instruction ID: 3cf5bedc0599248fe8a72db546849f5e28db29ee81c3d71f835f725f1ba8bb0f
Opcode Fuzzy Hash: fa84efb41be3743c0922df205026b6ce91084918fe287269569a5ea6ca4a5cb6
Instruction Fuzzy Hash: 2302A976A10604DFDB18DF68EC859697BB4FB48380714C11AE90AD6270EB7C99D0CF5E

Function 007635AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00763685
CreateServiceA.ADVAPI32(00000000,00DBE5D8,00DBE5D8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 007636D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00763728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0076374C
CloseServiceHandle.ADVAPI32(00000000), ref: 0076375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 007637D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00763836
CloseServiceHandle.ADVAPI32(00000000), ref: 00763847
CloseServiceHandle.ADVAPI32(00000000), ref: 007638B1

Strings

qh~B, xrefs: 0076360F
3ch, xrefs: 00763701

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 4f175bff90c494f202d3e8111aab1c78ebbca763b23bbd7b6bf00d10bbbb601f
Instruction ID: 6877a4a1c5289d3fc8c1c5975d0ce75663111c4129615aad8aa070607724a3bf
Opcode Fuzzy Hash: 4f175bff90c494f202d3e8111aab1c78ebbca763b23bbd7b6bf00d10bbbb601f
Instruction Fuzzy Hash: EB91A8B5614A00EBE3088F28ED8597937F5F748781340C41AE80EDA271EBBC99C1CB6D

Function 0075111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007511F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00751267
CloseHandle.KERNEL32(00000000), ref: 0075128B
GetTickCount.KERNEL32 ref: 007512D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0075153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0075157E
CloseHandle.KERNEL32(00000000), ref: 0075158F

Strings

Ra);, xrefs: 00751514

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: 2effb4b96f0121aa175d48304b2eab2d30cc502c1722c4ac9f7764bd1195892f
Instruction ID: 09c115d9edcad917b02eb13a90213368f0c4213444fd9414eb8c48fb56fae57e
Opcode Fuzzy Hash: 2effb4b96f0121aa175d48304b2eab2d30cc502c1722c4ac9f7764bd1195892f
Instruction Fuzzy Hash: 74B1E071511600EEE7189F68EC89A7937B4FB443D6750C11AE90DC62B1EBBC89C5CB1E

Function 00751636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007516B2
Process32First.KERNEL32(00000000,00000128), ref: 007517BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00751932
Module32First.KERNEL32(00000000,00000224), ref: 00751991
CloseHandle.KERNEL32(?,0000000A), ref: 00751A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00751ACE
CloseHandle.KERNEL32(00000000), ref: 00751AF5

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 495a0f9b425ef54f6f55690740096fdc57e7f59eeac303080643d8444f127486
Instruction ID: 436db10102f0c31205cdf80eadfdea07c8a74757e6637a72d57054922e555ffb
Opcode Fuzzy Hash: 495a0f9b425ef54f6f55690740096fdc57e7f59eeac303080643d8444f127486
Instruction Fuzzy Hash: 34C1CE76901600DBD718DB64EC8AAB937B4F754392B00C11AEA0DC62A1EBBC99C5CF5D

Function 00759F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00759FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 0075A049
GetLastError.KERNEL32 ref: 0075A061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 0075A162
CloseServiceHandle.ADVAPI32(00000000), ref: 0075A3B6

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: cc1f84ebbefaf0268ac1206fc57b2d468dc4816395b4350afafb6c6d56b39376
Instruction ID: 72521336b914b9c4ff56fa75d3896f7e159c1e73bbb16bff6d1b801cdfc97a6e
Opcode Fuzzy Hash: cc1f84ebbefaf0268ac1206fc57b2d468dc4816395b4350afafb6c6d56b39376
Instruction Fuzzy Hash: F0D1EE76901600EFD308CF68EC859A937F4F744391B15C52AE90DDA270EBBC99C0CB5A

Function 00750806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007508C2
Process32First.KERNEL32(00000000,00000128), ref: 00750966
OpenProcess.KERNEL32(00000001,00000000,?,?,?,?,?,000000B3), ref: 00750A15
TerminateProcess.KERNEL32(00000000,000000FF,?,?,?,?,000000B3), ref: 00750A64
CloseHandle.KERNEL32(00000000,?,?,?,?,000000B3), ref: 00750A82
Process32Next.KERNEL32(00000000,00000128), ref: 00750AD2
CloseHandle.KERNEL32(00000000), ref: 00750B10

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 8f3ed777eed7cf5fd7c0ee6e69e66fd27d636991e5ca8fd34f2f33910e16e1e8
Instruction ID: d195b8f6e396df37a5c35d176be022b1ba8768123394b4141ab1bd6eadd90b30
Opcode Fuzzy Hash: 8f3ed777eed7cf5fd7c0ee6e69e66fd27d636991e5ca8fd34f2f33910e16e1e8
Instruction Fuzzy Hash: A381CD72611611DBD358DF68FC85A6933B4FB48392B00C12AE90DC6671EB7C99D4CB8D

Function 0075B046 Relevance: 9.2, APIs: 6, Instructions: 184filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0075B104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0075B16D
CloseHandle.KERNEL32(00000000), ref: 0075B1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0075B25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0075B2AB
CloseHandle.KERNEL32(00000000), ref: 0075B2D8

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 99f3c446e6c40058ef6e09e87bb140e14c829807ddc5b2a126f6fa40087113fd
Instruction ID: c44948147c225e605d46c5b7cdb7306044445ac5a884f875bf8184ccd8542280
Opcode Fuzzy Hash: 99f3c446e6c40058ef6e09e87bb140e14c829807ddc5b2a126f6fa40087113fd
Instruction Fuzzy Hash: E971EA71601604DFD344DF68ED858BA3BB4F7483A6710C52AE90EC66B0E77C89C4CB2A

Function 00764589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000009,00000002,?,0074D583,0074AD87,00000002,00000000), ref: 00764637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00764655
CloseHandle.KERNEL32(00000000,?,0074D583,0074AD87,00000002,00000000,?,?,?,?,?,?,?,00000009,?,?), ref: 0076468D
WaitForSingleObject.KERNEL32(?,000000FF,?,0074D583,0074AD87,00000002,00000000,?,?,?,?,?,?,?,00000009,?), ref: 007646A1
CloseHandle.KERNEL32(?,0074D583,0074AD87,00000002,00000000,?,?,?,?,?,?,?,00000009,?,?), ref: 00764712

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: ef3cbd54d16ed3f9065e611d0baa6726a1d3ce46d2206c3b1dbaf197339d1a3f
Instruction ID: 97cc0602d13743eb60ff6295ac4d57ca1904c2fc686dd7a1bffd4c2d72783aed
Opcode Fuzzy Hash: ef3cbd54d16ed3f9065e611d0baa6726a1d3ce46d2206c3b1dbaf197339d1a3f
Instruction Fuzzy Hash: A6418875101240DFC328DF28ED8992A3BB6F78A791311C42AE80EC6631E73C98E1CB19

Function 00764927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00764CBC

Part of subcall function 0075074E: wvsprintfA.USER32(?,?,00000000), ref: 007507C3

Sleep.KERNEL32(00015F90), ref: 00764E60
DeleteFileA.KERNEL32(?), ref: 00764E7F

Strings

KU, xrefs: 00764A26

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: 6ee4bd521f2e3254741b79d1cd96fe8e3bf3d8e93923c5caa406115b02adce69
Instruction ID: 0f1c2a5009b178e06f4e787d15fddc2bc757d1401254151adac414cf157f242a
Opcode Fuzzy Hash: 6ee4bd521f2e3254741b79d1cd96fe8e3bf3d8e93923c5caa406115b02adce69
Instruction Fuzzy Hash: 75D1E275610604DED718DF64EC969A937F8FB44781B00C41AEA0ECB2B1EB7C99C1CB59

Function 00759B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00759C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00759CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00759DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00759E86

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 3a75383e18586bee0532fc47a39a469df3d856c2a5c76dfded887011ee2def6d
Instruction ID: 64b3296519e9b48f005f80af368d0cdddb0e41fc082880d8026812cdb6df5529
Opcode Fuzzy Hash: 3a75383e18586bee0532fc47a39a469df3d856c2a5c76dfded887011ee2def6d
Instruction Fuzzy Hash: B281CE75611600DBD714DF64EC8AABA33B9FB44392B00C419EA0EC62A1E77C98C1CF5E

Function 007690F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00758146,00000000,?,00000000,?,0074F85A,0076970E,?,?,00769573,0076970E,00000001), ref: 00769143
RtlReAllocateHeap.NTDLL(00000000,?,00758146,00000000), ref: 0076914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00758146,00000000,?,00000000,?,0074F85A,0076970E,?,?,00769573,0076970E,00000001,?), ref: 00769174
HeapAlloc.KERNEL32(00000000,?,00758146,00000000,?,00000000,?,0074F85A,0076970E,?,?,00769573,0076970E,00000001,?), ref: 0076917B

Memory Dump Source

Source File: 00000003.00000002.2205066447.0000000000741000.00000020.00000001.01000000.00000005.sdmp, Offset: 00740000, based on PE: true

Associated: 00000003.00000002.2205048640.0000000000740000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205096110.000000000076F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205113588.0000000000770000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205132801.0000000000773000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2205153312.000000000077C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_740000_yanidfx.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 58ac25b8bc53b0ab33cd3029d9bf86ddbae31c35fadfda3710e801d8c02d43fb
Instruction ID: 1cac2c4002c204d31b80bcd51773fe075a7f1656628a4926ea4bf5c6f066e455
Opcode Fuzzy Hash: 58ac25b8bc53b0ab33cd3029d9bf86ddbae31c35fadfda3710e801d8c02d43fb
Instruction Fuzzy Hash: 1C011E76640604DFCB049F54FC4962537A4F708391F44C025F91EC6262DBBDA4D08B5D

Analysis Process: xxxniijvj.exePID: 1984, Parent PID: 3120COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1504
Total number of Limit Nodes:	7

Executed Functions

Function 00CFFF2A Relevance: 63.3, APIs: 29, Strings: 6, Instructions: 2026synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00D00590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00D005E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00D00629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00D00649
GetTickCount.KERNEL32 ref: 00D006E6
GetCommandLineA.KERNEL32 ref: 00D00873

Strings

241, xrefs: 00D00787
C:\Windows\system32\config\systemprofile, xrefs: 00D0058A
HO, xrefs: 00D01893
^d/, xrefs: 00D00102
~z0, xrefs: 00D006C2
wb_m, xrefs: 00D01FC6

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: 241$C:\Windows\system32\config\systemprofile$HO$^d/$wb_m$~z0
API String ID: 3327569919-55223334
Opcode ID: eed380e281fce9acff3a89b7a8a65102a28011829e715658ded3f78738e5c7fa
Instruction ID: 761914c77d0ebba821c5728284ae1fdcab5dedcca92e1ff4d028c904513b87eb
Opcode Fuzzy Hash: eed380e281fce9acff3a89b7a8a65102a28011829e715658ded3f78738e5c7fa
Instruction Fuzzy Hash: A1037575605300BBD708DB68FC96AFA37B5EB48311B14811AE906CA3B1EF349983DB75

Function 00CE88A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00D1B028), ref: 00CE893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00CE8AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 00CE8D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 00CE8D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00CE8DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00CE8E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00CE9158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00CE91F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 00CE936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 00CE94DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 00CE963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 00CE97B0

Strings

\, xrefs: 00CE93D0
C:\Windows\system32\config\systemprofile, xrefs: 00CE9016, 00CE908E
C:\hjflhukc\, xrefs: 00CE8DF6, 00CE9174, 00CE947F, 00CE9666
gKV`, xrefs: 00CE8CE7
Ua-W, xrefs: 00CE9341, 00CE9347

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\hjflhukc\$Ua-W$\$gKV`
API String ID: 1691758827-3231860264
Opcode ID: aabc132e53101bb6000d22fd6388893b5031224571925ea483d6e3f535dc464c
Instruction ID: f1fe09d9f98096bfcd093f23c6d0b63990471910d471a44c26959a20a1373274
Opcode Fuzzy Hash: aabc132e53101bb6000d22fd6388893b5031224571925ea483d6e3f535dc464c
Instruction Fuzzy Hash: 5982BBB1505344ABD708DB69FC929EA77B9FB54310B00C02AE906D63B1EF349A87DB35

Function 00CF571F Relevance: 6.2, APIs: 4, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CF5804
Process32First.KERNEL32(00000000,00000128), ref: 00CF58E2
Process32Next.KERNEL32(00000000,00000128), ref: 00CF59E8
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00CF5A7E

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 64f4078512d768dcb15d4ac52fae9fa14911bdcf5877f9a54ebd96633fc34287
Instruction ID: 6cadce2803e1dc49d3b4d673cf3536f246e1b02f4db24a4ed502602c96e0c36d
Opcode Fuzzy Hash: 64f4078512d768dcb15d4ac52fae9fa14911bdcf5877f9a54ebd96633fc34287
Instruction Fuzzy Hash: BB918676A15704EBC748DB69FCA65F977B4EB48311B10811AEA02C63B0EF349A43CF61

Function 00CF0806 Relevance: 10.7, APIs: 7, Instructions: 195
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CF08C2
Process32First.KERNEL32(00000000,00000128), ref: 00CF0966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CF0A15
TerminateProcess.KERNELBASE(00000000,000000FF), ref: 00CF0A64
CloseHandle.KERNEL32(00000000), ref: 00CF0A82
Process32Next.KERNEL32(00000000,00000128), ref: 00CF0AD2
CloseHandle.KERNEL32(00000000), ref: 00CF0B10

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 3ea1bf732c790467651be85401ceeafe1befd8dde859d9eed8778fcf48dcea6f
Instruction ID: 5f93a5b7c95a7b862a53cbd8df5eb19d0dfe0546bce1698dfe67f8a7f159de30
Opcode Fuzzy Hash: 3ea1bf732c790467651be85401ceeafe1befd8dde859d9eed8778fcf48dcea6f
Instruction Fuzzy Hash: 36819576511705BBD344CB68FD91AEA73B4FB48712B10C11AE906C67B1EF3889838B65

Function 00CFB046 Relevance: 9.2, APIs: 6, Instructions: 184
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00CFB104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00CFB16D
CloseHandle.KERNEL32(00000000), ref: 00CFB1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CFB25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00CFB2AB
CloseHandle.KERNEL32(00000000), ref: 00CFB2D8

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: b0b5f6b65f04700b5930cff0657384be66ad3474653db08d39e1fa7399daed56
Instruction ID: 9ac484e0a9636a332d67bae39328e26ae9f89acf8192f191ca2e705f4c189383
Opcode Fuzzy Hash: b0b5f6b65f04700b5930cff0657384be66ad3474653db08d39e1fa7399daed56
Instruction Fuzzy Hash: 95717675615308FBD344CF68FD915BA77B4FB48325710861AE912C67B0EB389A83CB22

Function 00CF549D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00CEDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00CF5628
CloseHandle.KERNEL32(00CEDA33,?,?,?,?,00000000), ref: 00CF5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00CF5665

Strings

D, xrefs: 00CF55A3

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 3a271c7762d8fa70e47ceab446e27737f9b1c1e21966a9a8c6d5020f54ad6b44
Instruction ID: 29a3d91b798934095765118fedc76953fd280ec31505801747c02194dedfe9ec
Opcode Fuzzy Hash: 3a271c7762d8fa70e47ceab446e27737f9b1c1e21966a9a8c6d5020f54ad6b44
Instruction Fuzzy Hash: 1641CD32500748ABC758DBA5FD66AFA77B5FB84310B00C11AEA12CA361EF358903DB35

Function 00CF54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00CEDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00CF5628
CloseHandle.KERNEL32(00CEDA33,?,?,?,?,00000000), ref: 00CF5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00CF5665

Strings

D, xrefs: 00CF55A3

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 9f81daf0239ef4927e11b0a864d633eaac5f78387aa9d126f2cfa27ee306699f
Instruction ID: 629d228ccd2f20d53bd62a00c3c42a53d6eddad0f2b8987101ffe9e31890e346
Opcode Fuzzy Hash: 9f81daf0239ef4927e11b0a864d633eaac5f78387aa9d126f2cfa27ee306699f
Instruction Fuzzy Hash: 35418971501708FBCB58DB95FD969FA77B5EB84700B00C01AE612CA360EF348942DB72

Function 00CEC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CEB7CD: WaitForSingleObject.KERNEL32(00CFAEAC,00004E20,00000001,?,00CEBFA2,00000001,-AF16B4FB,?,00CFAEAC,00CE66DE), ref: 00CEB81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,00CE67E3,?,00000004,?,00000000,?), ref: 00CEC746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 00CEC90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00000001), ref: 00CEC983

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: d0ffba35c5f0f7f5e844c34dc9014bf609b28a6b015ea40450005255906b118e
Instruction ID: b5f68218c8cbbf6db562740dffe741186bef1901b688649d163c65a42cd5f4b5
Opcode Fuzzy Hash: d0ffba35c5f0f7f5e844c34dc9014bf609b28a6b015ea40450005255906b118e
Instruction Fuzzy Hash: 9F9162B5511341BBC708CF69FDA69AA7BA5FB88320710C11AE406CA3B5EF349943DB64

Function 00CEE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00CE8954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00CE8954), ref: 00CEE865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00CEE895
FreeSid.ADVAPI32(?), ref: 00CEE8DC

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ff3c54a07f57bb40e93950c0c05d125f53269d73697390893c720c531285a70c
Instruction ID: 10781b547aaef78270913865db409cd4c3e70c878cc0f5b50475a8c5ffa6d735
Opcode Fuzzy Hash: ff3c54a07f57bb40e93950c0c05d125f53269d73697390893c720c531285a70c
Instruction Fuzzy Hash: 7C411275915304FBCB04CFAAFD956E9B7B5FB08305B90801AE402D63A4EF349982DB65

Function 00CF20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,00CF09C2,?,?,?), ref: 00CF20F0
CharLowerBuffA.USER32(?,00000000,?,00CF09C2,?,?,?), ref: 00CF2131

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 55a34f58d42be80674dd59dca0a2d1d472f043801a8f5133b6b568df94ee2845
Instruction ID: f8e6a9139ae35c602040fd897ac04a7c47df111ec9341d7c8a8ec7e2d288a326
Opcode Fuzzy Hash: 55a34f58d42be80674dd59dca0a2d1d472f043801a8f5133b6b568df94ee2845
Instruction Fuzzy Hash: E0F06D31514304BBDB45CF4AE8564BA37B2FB54700740C019E806CA771EF309D82EB76

Function 00D023A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00D0A3A7,?,?,?,00D0D0BE), ref: 00D023F6
RtlAllocateHeap.NTDLL(00000000,?,00D0A3A7,?,?,?,00D0D0BE), ref: 00D023FD

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 31a5053e5351b3c290feda93def48459f172f4231d71e052e217649c936f81ce
Instruction ID: 5c0829bc647f38f2479d3735965abcb8e215e57c98d988039aede19321330575
Opcode Fuzzy Hash: 31a5053e5351b3c290feda93def48459f172f4231d71e052e217649c936f81ce
Instruction Fuzzy Hash: 2DF03976501301ABCA108FA9FD49B9A3BA8F314318B648416F449DA2B5DB78E8468FB0

Function 00CEDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00CF8109,?,00CF8109,00000000), ref: 00CEDE6C
RtlFreeHeap.NTDLL(00000000,?,00CF8109,00000000), ref: 00CEDE73

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: e246c8975b9e179da6429938b8ba44a7b9e205c1aa0c5fdf96cd3e153b0f7b66
Instruction ID: dd517a1fe23b585a65a04a166319087864a8551e711ad67a9e334a190f741dbd
Opcode Fuzzy Hash: e246c8975b9e179da6429938b8ba44a7b9e205c1aa0c5fdf96cd3e153b0f7b66
Instruction Fuzzy Hash: BDE08C72540344BBEA008BD6FD4A7843BE8FB21741B10C511F11ACA730CB2195428AA4

Function 00CF15E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00CF160D

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3fb0a3d77d03a44ed423dca2de6b26a8822f6da5e65b59453553833433dc564a
Instruction ID: 12bbad38fbcfa456a96cfc2170dea992a1c07c65da1dbf8b4a904cb8a0413079
Opcode Fuzzy Hash: 3fb0a3d77d03a44ed423dca2de6b26a8822f6da5e65b59453553833433dc564a
Instruction Fuzzy Hash: 50D01234004349BA87106FA8DC064A53BB5FF047007419011E945D9231DFB0D901D77B

Non-executed Functions

Function 00D0D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 00D0D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00D0D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 00D0DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00D0DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00D0DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 00D0DC1C
CloseHandle.KERNEL32(?), ref: 00D0DC33
CloseHandle.KERNEL32(?), ref: 00D0DC66
CloseHandle.KERNEL32(?), ref: 00D0DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 00D0DD4F
CloseHandle.KERNEL32(?), ref: 00D0DD9F
CloseHandle.KERNEL32(?), ref: 00D0DDB2
CloseHandle.KERNEL32(?), ref: 00D0DE41
CloseHandle.KERNEL32(00000000), ref: 00D0DE67
CloseHandle.KERNEL32(?), ref: 00D0DE7E

Strings

D, xrefs: 00D0DB1A

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: c9b07c4438aa0098cd07fa7c541d85fc31ec3fce5cbb4b7e7d8ff2cfe7addb81
Instruction ID: e9d78fd0a8e0a98aef5d500ba12ef3d31e68cf6ec108f8bf799e4a7ac4db13df
Opcode Fuzzy Hash: c9b07c4438aa0098cd07fa7c541d85fc31ec3fce5cbb4b7e7d8ff2cfe7addb81
Instruction Fuzzy Hash: 66025576611705EBCB04CFA8FD91AE97BB6FB48310714811AE806D63B0EF349942DB75

Function 00D035AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00D03685
CreateServiceA.ADVAPI32(00000000,0088E678,0088E678,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00D036D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00D03728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00D0374C
CloseServiceHandle.ADVAPI32(00000000), ref: 00D0375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 00D037D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00D03836
CloseServiceHandle.ADVAPI32(00000000), ref: 00D03847
CloseServiceHandle.ADVAPI32(00000000), ref: 00D038B1

Strings

qh~B, xrefs: 00D0360F
3ch, xrefs: 00D03701

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 4f1e4d63b6ce23b9f4c283c37ef7934297dc7a9acd446a33e04e3716aef870ac
Instruction ID: 1bf84ecb6574865267fbe524b96d486e8c1d5b224561fed4722e71eed62d7807
Opcode Fuzzy Hash: 4f1e4d63b6ce23b9f4c283c37ef7934297dc7a9acd446a33e04e3716aef870ac
Instruction Fuzzy Hash: AE9142B9514300BBC3088B68FDA5AF977B9FB49701744C01AE806DA3B1EE759943CB75

Function 00CF111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CF11F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00CF1267
CloseHandle.KERNEL32(00000000), ref: 00CF128B
GetTickCount.KERNEL32 ref: 00CF12D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00CF153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00CF157E
CloseHandle.KERNEL32(00000000), ref: 00CF158F

Strings

Ra);, xrefs: 00CF1514

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: cfbe619f57b8a91cda5c33f04685c91c3340acc6ecf8b90c607c4d7abbfca75f
Instruction ID: 504e58bd93d17a767ee1766925f2aa199972c81f9c462e6842e6228b0eda2f0b
Opcode Fuzzy Hash: cfbe619f57b8a91cda5c33f04685c91c3340acc6ecf8b90c607c4d7abbfca75f
Instruction Fuzzy Hash: 36B198B2515704FAD7188B68FD91AFA37B8FB48315714801AE915CA3B1EF388943DB36

Function 00CF1636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CF16B2
Process32First.KERNEL32(00000000,00000128), ref: 00CF17BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00CF1932
Module32First.KERNEL32(00000000,00000224), ref: 00CF1991
CloseHandle.KERNEL32(?,0000000A), ref: 00CF1A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00CF1ACE
CloseHandle.KERNEL32(00000000), ref: 00CF1AF5

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: f682d4f0d2be8905227de946b18f257c4ba201a5f48d1a1640567992bfce67cc
Instruction ID: 0ecee4c64a46b3e3e9666550e8219de0ee3411e1ab28c9571974965c98c61264
Opcode Fuzzy Hash: f682d4f0d2be8905227de946b18f257c4ba201a5f48d1a1640567992bfce67cc
Instruction Fuzzy Hash: 30C1DB76605704EBD708DB64FC966F933B4FB44311B04C11AEA06CA3A0EF789983CB65

Function 00CF9F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00CF9FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 00CFA049
GetLastError.KERNEL32 ref: 00CFA061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 00CFA162
CloseServiceHandle.ADVAPI32(00000000), ref: 00CFA3B6

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: bc15a431043944f25e6eb3b4b3159980d2e49f31b43d553ea2ab8a402c3a1b6f
Instruction ID: 108f5685a6ee2370e2a381a707444034748bc3a7d488e5e969d2ffdb8c7bf5dd
Opcode Fuzzy Hash: bc15a431043944f25e6eb3b4b3159980d2e49f31b43d553ea2ab8a402c3a1b6f
Instruction Fuzzy Hash: 4FD1BAB6905704EBC708CF68FD91AF9B7B5FB44310B14801AE915D63A0EF349A83DB62

Function 00CE5C39 Relevance: 7.7, APIs: 5, Instructions: 247filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00CE5DEC
FindFirstFileA.KERNEL32(?,?), ref: 00CE5EB2
DeleteFileA.KERNEL32(?), ref: 00CE5FE2
FindNextFileA.KERNEL32(00000000,?), ref: 00CE6020
FindClose.KERNEL32(00000000), ref: 00CE6042

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 3c07c9edebc0613a67afe2704c2e422353409ec6b70fc717025050fe9d131073
Instruction ID: 0044a78d3c66e3b76898713296ed2989b2458c9611f1eb19004af33da0e78221
Opcode Fuzzy Hash: 3c07c9edebc0613a67afe2704c2e422353409ec6b70fc717025050fe9d131073
Instruction Fuzzy Hash: 3AA1ABB5515755EBD708CB6AFC929E933B8FB48301710811AE906CA370EF389A83DB75

Function 00CEC9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 00CECAF2
SetServiceStatus.ADVAPI32(00D1B2DC), ref: 00CECB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CECB78
SetServiceStatus.ADVAPI32(00D1B2DC), ref: 00CECBE5
WaitForSingleObject.KERNEL32(00001388), ref: 00CECC62
SetServiceStatus.ADVAPI32(00D1B2DC), ref: 00CECCAF
CloseHandle.KERNEL32 ref: 00CECCC5
SetServiceStatus.ADVAPI32(00D1B2DC), ref: 00CECD8F

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: f19169a374bc35a71b2a306990e9ea4a2b5b40ea3f38cb981d2cd0b0475e1d01
Instruction ID: edb1abdb8745e6c10dab995e10ed9a6ff1b48dc1020fa89f11ad64e052fc5e0b
Opcode Fuzzy Hash: f19169a374bc35a71b2a306990e9ea4a2b5b40ea3f38cb981d2cd0b0475e1d01
Instruction Fuzzy Hash: 71910B74111341ABC308CF2AFD999EA7BB6FB18721310C52AE406CA371DF348987DB64

Function 00D04589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,00CED583,Function_0000AD87,00000002,00000000), ref: 00D04637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00D04655
CloseHandle.KERNEL32(00000000,?,00000002,?,00CED583,Function_0000AD87,00000002,00000000), ref: 00D0468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,00CED583,Function_0000AD87,00000002,00000000), ref: 00D046A1
CloseHandle.KERNEL32(?,00000002,?,00CED583,Function_0000AD87,00000002,00000000), ref: 00D04712

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 8c71b30b71d5bebf0544622207c639b88fbc1e5e043c19776161ba1310658636
Instruction ID: 1daa1c57a446e912a0cc90ddfe20f30c6cd1b4137b340775f19be96ea6ec8787
Opcode Fuzzy Hash: 8c71b30b71d5bebf0544622207c639b88fbc1e5e043c19776161ba1310658636
Instruction Fuzzy Hash: 234124B5515340FBC3248F68FD85AA67BBAFB89711760C41AE54AC67B0EB349843CB31

Function 00D04927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00D04CBC

Part of subcall function 00CF074E: wvsprintfA.USER32(?,?,?), ref: 00CF07C3

Sleep.KERNEL32(00015F90), ref: 00D04E60
DeleteFileA.KERNEL32(?), ref: 00D04E7F

Strings

KU, xrefs: 00D04A26

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: 4d3f4cff14edc592f6e4614ae4d5cb7ea7e4883992f92262f4f26d524c3eb214
Instruction ID: c41e766ef2ae388bdc2227f259966e430d4269b2ba08fad511f22886b56575d5
Opcode Fuzzy Hash: 4d3f4cff14edc592f6e4614ae4d5cb7ea7e4883992f92262f4f26d524c3eb214
Instruction Fuzzy Hash: B4D1BD75514704BAC708DF64FD92AE677B9FB48710B00841AEA0ACA3B1EF349983DB71

Function 00CF9B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CF9C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00CF9CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00CF9DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CF9E86

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 5e155086f529bffd6c59480b941e6a07423fc13910b1918dc4c480f6f59ed6c8
Instruction ID: 5695f7e8e8ad0815353b7f55b6a3c08a73bdfc12ba271153dcd0ca8b299cafe1
Opcode Fuzzy Hash: 5e155086f529bffd6c59480b941e6a07423fc13910b1918dc4c480f6f59ed6c8
Instruction Fuzzy Hash: CB818575611304ABCB14DF64EC92AFA77A9FB48711B10841AE906C63A1EF349983CB76

Function 00D090F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00CF8146,00000000,?,?,?,?,?,00CEF85A,?,?,?,00D09573), ref: 00D09143
RtlReAllocateHeap.NTDLL(00000000,?,00CF8146,00000000), ref: 00D0914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00CF8146,00000000,?,?,?,?,?,00CEF85A,?,?,?,00D09573,?), ref: 00D09174
HeapAlloc.KERNEL32(00000000,?,00CF8146,00000000,?,?,?,?,?,00CEF85A,?,?,?,00D09573,?,00000001), ref: 00D0917B

Memory Dump Source

Source File: 00000004.00000002.2227053501.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000004.00000002.2226953420.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227082702.0000000000D0F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227099187.0000000000D10000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227115098.0000000000D13000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2227139676.0000000000D1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ce0000_xxxniijvj.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 896526b1de86cf9aa778c2c6ccbc20735dae05c74435719cf3532c7e7ad5c1fe
Instruction ID: 90eec667f5d392f68c828e2445ec5088ef0938a595d42eb19da29d023f70a48d
Opcode Fuzzy Hash: 896526b1de86cf9aa778c2c6ccbc20735dae05c74435719cf3532c7e7ad5c1fe
Instruction Fuzzy Hash: A1014876680700FFCB00DFA0FC597A83BA4FB48300B448516F90AC6766EF7894428B74

Analysis Process: xxxniijvj.exePID: 6500, Parent PID: 5676COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1498
Total number of Limit Nodes:	7

Executed Functions

Function 0005FF20 Relevance: 63.3, APIs: 29, Strings: 6, Instructions: 2031synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00060590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 000605E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00060629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00060649
GetTickCount.KERNEL32 ref: 000606E6
GetCommandLineA.KERNEL32 ref: 00060873

Strings

~z0, xrefs: 000606C2
^d/, xrefs: 00060102
HO, xrefs: 00061893
C:\Windows\system32\config\systemprofile, xrefs: 0006058A
wb_m, xrefs: 00061FC6
241, xrefs: 00060787

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: 241$C:\Windows\system32\config\systemprofile$HO$^d/$wb_m$~z0
API String ID: 3327569919-55223334
Opcode ID: fdc241b2d739371ec051f0598690e6ddbb98e9f53b0df0022f67fb20c9119b15
Instruction ID: 27fd9fecd40b7de0697229c9cb76298783c4fc1ca376ef847430228dd4518410
Opcode Fuzzy Hash: fdc241b2d739371ec051f0598690e6ddbb98e9f53b0df0022f67fb20c9119b15
Instruction Fuzzy Hash: 3603BC71E446019BF358DF64EC869BA37B5FB44301B14412AE90EFA2B1EB7D99C0CB52

Function 000488A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0007B028), ref: 0004893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00048AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 00048D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 00048D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00048DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00048E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00049158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 000491F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 0004936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 000494DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 0004963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 000497B0

Strings

C:\Windows\system32\config\systemprofile, xrefs: 00049016, 0004908E
Ua-W, xrefs: 00049341, 00049347
C:\hjflhukc\, xrefs: 00048DF6, 00049174, 0004947F, 00049666
gKV`, xrefs: 00048CE7
\, xrefs: 000493D0

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\hjflhukc\$Ua-W$\$gKV`
API String ID: 1691758827-3231860264
Opcode ID: aeb04c608a65590021a163e9bd56b8e5a9484fbe7aa88cb785cb97692ab1d4cb
Instruction ID: 7dac72961df3323e4369cc74e02f44855be43ffc474ed0323a270ef120d6be22
Opcode Fuzzy Hash: aeb04c608a65590021a163e9bd56b8e5a9484fbe7aa88cb785cb97692ab1d4cb
Instruction Fuzzy Hash: 4582D3B1E40604DFF718DF64EC869AA37B4F744311B40842AE90EF6262EB7C99C5CB56

Function 0005571F Relevance: 6.2, APIs: 4, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00055804
Process32First.KERNEL32(00000000,00000128), ref: 000558E2
Process32Next.KERNEL32(00000000,00000128), ref: 000559E8
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00055A7E

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: af3bf86f518085339e3310485ec1f2f8b04e88bd1a94a4e4217c0709eee2f19a
Instruction ID: 69a5e0c91fbc1b28d46b6f4eed551ad691147f6b28a9e92589fb0bd3f6e392de
Opcode Fuzzy Hash: af3bf86f518085339e3310485ec1f2f8b04e88bd1a94a4e4217c0709eee2f19a
Instruction Fuzzy Hash: 1091AA35E05A04CBE758DB68ECAA5AA37F4F748312B14411AE80EE6261EB3C99C5CF41

Function 00050806 Relevance: 10.7, APIs: 7, Instructions: 195
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000508C2
Process32First.KERNEL32(00000000,00000128), ref: 00050966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00050A15
TerminateProcess.KERNELBASE(00000000,000000FF), ref: 00050A64
CloseHandle.KERNEL32(00000000), ref: 00050A82
Process32Next.KERNEL32(00000000,00000128), ref: 00050AD2
CloseHandle.KERNEL32(00000000), ref: 00050B10

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 852cde9e156b046680483627cdd04d80fbaa7b977c05022f2ff21542ca410893
Instruction ID: 8e91b74047045fce3f761e649c895d74031b46b35c6821ac4e1e8137c93baa39
Opcode Fuzzy Hash: 852cde9e156b046680483627cdd04d80fbaa7b977c05022f2ff21542ca410893
Instruction Fuzzy Hash: A581AC72D11A11DBF354DF68EC856AA33B4FB48312B00411AE90EE6671EB7C99C5CB46

Function 0005B046 Relevance: 9.2, APIs: 6, Instructions: 184
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0005B104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0005B16D
CloseHandle.KERNEL32(00000000), ref: 0005B1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0005B25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0005B2AB
CloseHandle.KERNEL32(00000000), ref: 0005B2D8

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 05c26961bd4fb8ac6ffff879bf9cce5a874fe822e8143103ecec8176ac7e1f50
Instruction ID: af1a86d23ded9b64639877041ec21a25d2dff494158f1438573132dcf0fcf25a
Opcode Fuzzy Hash: 05c26961bd4fb8ac6ffff879bf9cce5a874fe822e8143103ecec8176ac7e1f50
Instruction Fuzzy Hash: 6A71B971E00604DBF354DF68ED8196A3BF4F745316714462AE80EE66B0E73C9AC5CB26

Function 00055498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0004DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00055628
CloseHandle.KERNEL32(0004DA33,?,?,?,?,00000000), ref: 00055652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00055665

Strings

D, xrefs: 000555A3

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 61ee4e4ba474db1a1d1bb7cbb8eec24b92509df664ed4d08af0a5894c9990490
Instruction ID: f2c8ba331d51ccee5320d68df2b151b21030c95c7e132a2fea2525f29b282f47
Opcode Fuzzy Hash: 61ee4e4ba474db1a1d1bb7cbb8eec24b92509df664ed4d08af0a5894c9990490
Instruction Fuzzy Hash: 0C411472E00A40DBE718DF64FD699AA77B4FB85302B04801EE90EE71B1E77D8984CB11

Function 000554D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0004DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00055628
CloseHandle.KERNEL32(0004DA33,?,?,?,?,00000000), ref: 00055652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00055665

Strings

D, xrefs: 000555A3

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 37f701de91a8f0a126d5d21fb4f7bb0de878c3a90768812395df91f760cac92e
Instruction ID: 81bfa1eb243a66b726552b74140570d694df4abde940b89e1824fcba4aec276e
Opcode Fuzzy Hash: 37f701de91a8f0a126d5d21fb4f7bb0de878c3a90768812395df91f760cac92e
Instruction Fuzzy Hash: 9E41A171D00A45DBEB58DF65EDAA9AA77B5FB84702B00401AE90EB6170EB7C49C4CB12

Function 0004C622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0004B7CD: WaitForSingleObject.KERNEL32(0005AEAC,00004E20,00000001,?,0004BFA2,00000001,-AF16B4FB,?,0005AEAC,000466DE), ref: 0004B81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,000467E3,?,00000004,?,00000000,?), ref: 0004C746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 0004C90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00000001), ref: 0004C983

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: 7ee5d4e65a14d2efd5a1e7aaec03cefe30640cec846db508fc807cbfd063f453
Instruction ID: 830fef32286b4fa656b17bdbb5e1b6198ac41daf8d736f47be0bca06e42f6d38
Opcode Fuzzy Hash: 7ee5d4e65a14d2efd5a1e7aaec03cefe30640cec846db508fc807cbfd063f453
Instruction Fuzzy Hash: B291BAB1E11601DBF758CF28ED959693BE4FB84311710802AE50EEA2B1EB3D99C0CF19

Function 0004E769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00048954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00048954), ref: 0004E865
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0004E895
FreeSid.ADVAPI32(?), ref: 0004E8DC

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: fd4301dd52e15f2fbe8a245595a8eb8cb2b0699e0f300e52f28402e659058ea8
Instruction ID: 177dccb889e018c3a30fbcd38e53fb358732a7ed8b0dfab018e241a0e8b836cb
Opcode Fuzzy Hash: fd4301dd52e15f2fbe8a245595a8eb8cb2b0699e0f300e52f28402e659058ea8
Instruction Fuzzy Hash: A8417AB4D55244EFEB40CFA5EC88AA977B4FB09305B40402AE50EF7261EB3C99C0CB55

Function 000520D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,000509C2,?,?,?), ref: 000520F0
CharLowerBuffA.USER32(?,00000000,?,000509C2,?,?,?), ref: 00052131

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: eaf4d094f65e06734ef9f2bda75e50179dfe29b36fb73aef494b02e6fa88e3d3
Instruction ID: df08fdce8bfae79e786c564362b6d173db40b65cab87bf02d539b75f249d675f
Opcode Fuzzy Hash: eaf4d094f65e06734ef9f2bda75e50179dfe29b36fb73aef494b02e6fa88e3d3
Instruction Fuzzy Hash: 77F06D31D14A049BEB498F05E94A43A3BF1FB947017008019E80EAA630EB3D9DC0EB56

Function 000623A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0006A3A7,?,?,?,0006D0BE), ref: 000623F6
RtlAllocateHeap.NTDLL(00000000,?,0006A3A7,?,?,?,0006D0BE), ref: 000623FD

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 32998cee58bea2d9c3ff31f89b3a799a9bb81f00742b32e7487546cd948c6953
Instruction ID: b13be65ecb536c4729c0905d064ef7b5e06e279c052fcc857e12ee8526f82443
Opcode Fuzzy Hash: 32998cee58bea2d9c3ff31f89b3a799a9bb81f00742b32e7487546cd948c6953
Instruction Fuzzy Hash: A9F03976A01302ABFA108FA9FD49A5A37A5F314358B650012F25DEA1A5D77CE8948BA0

Function 0004DE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00058109,?,00058109,00000000), ref: 0004DE6C
RtlFreeHeap.NTDLL(00000000,?,00058109,00000000), ref: 0004DE73

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: cf66ba3a07d672f1912cc4ba575f44ea84e485856164406b9ee2b91aca844985
Instruction ID: 8001f6c23eebdd6b69eb8b1c3eb83722999f33b6c36f9065bc39c0f7e9e12283
Opcode Fuzzy Hash: cf66ba3a07d672f1912cc4ba575f44ea84e485856164406b9ee2b91aca844985
Instruction Fuzzy Hash: 3DE0C232D00248EBFE149BD6FC4A7043BECFB21341F008121F11EEA130D72D99D08A85

Function 000515E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0005160D

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b38d7a5427f17576125bc7e519ee6622556652fd069bff8bae42116df58b3146
Instruction ID: 438d2e948da11c2c567e1cc08378a7517d64dce8c94ebf330ea3997dc65bb3e9
Opcode Fuzzy Hash: b38d7a5427f17576125bc7e519ee6622556652fd069bff8bae42116df58b3146
Instruction Fuzzy Hash: 73D01224904384AAA7107F649C0A56A3BB4FF886017411021F848B9031EB7DD980C75B

Non-executed Functions

Function 0006D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 0006D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0006D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 0006DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0006DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0006DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 0006DC1C
CloseHandle.KERNEL32(?), ref: 0006DC33
CloseHandle.KERNEL32(?), ref: 0006DC66
CloseHandle.KERNEL32(?), ref: 0006DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 0006DD4F
CloseHandle.KERNEL32(?), ref: 0006DD9F
CloseHandle.KERNEL32(?), ref: 0006DDB2
CloseHandle.KERNEL32(?), ref: 0006DE41
CloseHandle.KERNEL32(00000000), ref: 0006DE67
CloseHandle.KERNEL32(?), ref: 0006DE7E

Strings

D, xrefs: 0006DB1A

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: 9e1776c79c41f5c004c533194adc21faa80e56914d9e3d48cf7a3bd3b3e58645
Instruction ID: f095436937d554724fde0cd6906eacfe2eb13effabf9e591180fea2f099d0dfc
Opcode Fuzzy Hash: 9e1776c79c41f5c004c533194adc21faa80e56914d9e3d48cf7a3bd3b3e58645
Instruction Fuzzy Hash: EC029676E10604DBEB14DF68EC859AA7BF5FB08301714811AE80EF6231EB7D99D1CB52

Function 000635AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00063685
CreateServiceA.ADVAPI32(00000000,00912F68,00912F68,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 000636D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00063728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0006374C
CloseServiceHandle.ADVAPI32(00000000), ref: 0006375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 000637D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00063836
CloseServiceHandle.ADVAPI32(00000000), ref: 00063847
CloseServiceHandle.ADVAPI32(00000000), ref: 000638B1

Strings

qh~B, xrefs: 0006360F
3ch, xrefs: 00063701

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 890320046d1b0e0dee086c434ea869350a29637b20f1f6e69bbc9ab130d0bcd5
Instruction ID: 84dc494caf210b4c683a4244e353c3adf2a39eae02f9323bf99413cd41ed9efa
Opcode Fuzzy Hash: 890320046d1b0e0dee086c434ea869350a29637b20f1f6e69bbc9ab130d0bcd5
Instruction Fuzzy Hash: 0C918AB5E14A10ABF3188F28ED859B937F5F749701340441AE80EBA271EB7D99C1CBA1

Function 0005111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000511F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00051267
CloseHandle.KERNEL32(00000000), ref: 0005128B
GetTickCount.KERNEL32 ref: 000512D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0005153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0005157E
CloseHandle.KERNEL32(00000000), ref: 0005158F

Strings

Ra);, xrefs: 00051514

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: 8bd8447b4fe83fcb4091c761578054707c5237f8980bbbedc787bcdbe56945ab
Instruction ID: 095e51955c56a1b7a6a9536f04c9508aea5424dc0ba3fd9717c4368ccdf4f141
Opcode Fuzzy Hash: 8bd8447b4fe83fcb4091c761578054707c5237f8980bbbedc787bcdbe56945ab
Instruction Fuzzy Hash: 6CB1E171D15A00AEF7189F64EC85ABA37F4FB48356710401AF90DE62B1EB7C89C5CB16

Function 00051636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000516B2
Process32First.KERNEL32(00000000,00000128), ref: 000517BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00051932
Module32First.KERNEL32(00000000,00000224), ref: 00051991
CloseHandle.KERNEL32(?,0000000A), ref: 00051A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00051ACE
CloseHandle.KERNEL32(00000000), ref: 00051AF5

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 05d51c00f46aa174b177e5c522a987979c465f60d8ced2824dcf367381ceefe5
Instruction ID: ea795721006d39a6a13ccd4f7a81d214a88bc580766b9d0ed7c810f2615d2d0b
Opcode Fuzzy Hash: 05d51c00f46aa174b177e5c522a987979c465f60d8ced2824dcf367381ceefe5
Instruction Fuzzy Hash: 4FC1DE76E04604CBF758DF68EC866BA33B4F749312B00411AE90EE62A1EB7C99C5CF55

Function 00059F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00059FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 0005A049
GetLastError.KERNEL32 ref: 0005A061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 0005A162
CloseServiceHandle.ADVAPI32(00000000), ref: 0005A3B6

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 69c017d3d9fd6105eec18d5473cf67c5cc1dae124fd6cc7bcc5a1d55ea5eaa59
Instruction ID: 245b701e4e97dd1a771a1a0afbc08c0122b1dcb0d48183f7fc94b49410aca86e
Opcode Fuzzy Hash: 69c017d3d9fd6105eec18d5473cf67c5cc1dae124fd6cc7bcc5a1d55ea5eaa59
Instruction Fuzzy Hash: B5D1CD76E00600DFF718CF68ED956AA77F4F745312B14411AE80EBA261EB7C9AC1CB52

Function 00045C39 Relevance: 7.7, APIs: 5, Instructions: 247filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00045DEC
FindFirstFileA.KERNEL32(?,?), ref: 00045EB2
DeleteFileA.KERNEL32(?), ref: 00045FE2
FindNextFileA.KERNEL32(00000000,?), ref: 00046020
FindClose.KERNEL32(00000000), ref: 00046042

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: a2d1448bd059c349d753b393b22eedbcf8f4ac3352143dc64be112c4bcb64561
Instruction ID: 05b5da1dc047328b69268950ea980008504997498129bffe7b40d4bdcc44ee09
Opcode Fuzzy Hash: a2d1448bd059c349d753b393b22eedbcf8f4ac3352143dc64be112c4bcb64561
Instruction Fuzzy Hash: D0A1CEB1D10A05DBF358DF64EC8A5A933B8F748342710402AE90EEA671EB7C99C5CF56

Function 0004C9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 0004CAF2
SetServiceStatus.ADVAPI32(0007B2DC), ref: 0004CB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0004CB78
SetServiceStatus.ADVAPI32(0007B2DC), ref: 0004CBE5
WaitForSingleObject.KERNEL32(00001388), ref: 0004CC62
SetServiceStatus.ADVAPI32(0007B2DC), ref: 0004CCAF
CloseHandle.KERNEL32 ref: 0004CCC5
SetServiceStatus.ADVAPI32(0007B2DC), ref: 0004CD8F

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 560e2c2394613ef4f36472b28d1b70cb06984281ac04a6761254d867d4cc2a8e
Instruction ID: f96156196dac12193f0f1ee8be3eec9c26c9fd34a685737c2d807d4fadefbae6
Opcode Fuzzy Hash: 560e2c2394613ef4f36472b28d1b70cb06984281ac04a6761254d867d4cc2a8e
Instruction Fuzzy Hash: C59144B4D126418BF798DF28ED99A693BF4F709305340452AE40EEA271DB7C98C2CB45

Function 00064589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,0004D583,Function_0000AD87,00000002,00000000), ref: 00064637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00064655
CloseHandle.KERNEL32(00000000,?,00000002,?,0004D583,Function_0000AD87,00000002,00000000), ref: 0006468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,0004D583,Function_0000AD87,00000002,00000000), ref: 000646A1
CloseHandle.KERNEL32(?,00000002,?,0004D583,Function_0000AD87,00000002,00000000), ref: 00064712

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 266b47c58f41e549f72198b62c3230b3843b1479793bc129659bbbf15f70d90a
Instruction ID: cd316fe5bdb5f74ee68df5d9ed06d9b4515524b54718aeefc8fe92a431720094
Opcode Fuzzy Hash: 266b47c58f41e549f72198b62c3230b3843b1479793bc129659bbbf15f70d90a
Instruction Fuzzy Hash: 80416775D05640DFE328DF28ED8996A3BF6F78A712710442AE40EE6631E73C9891CB12

Function 00064927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00064CBC

Part of subcall function 0005074E: wvsprintfA.USER32(?,?,?), ref: 000507C3

Sleep.KERNEL32(00015F90), ref: 00064E60
DeleteFileA.KERNEL32(?), ref: 00064E7F

Strings

KU, xrefs: 00064A26

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: dba2fb44e413e334180082a805e19e11d655a69d4f3b7620b3b2213f7ec14e95
Instruction ID: 308c4f3e375b140e4d1e58b053ba27801f848aa674f9d05c35e779167ef312a6
Opcode Fuzzy Hash: dba2fb44e413e334180082a805e19e11d655a69d4f3b7620b3b2213f7ec14e95
Instruction Fuzzy Hash: 4DD1E271E106049EF758DF64EC96AAA37B9FB44701B00441AE90EFB2B1DB3D99C1CB51

Function 00059B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00059C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00059CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00059DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00059E86

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 5e1a2ce493a3e69463c71067a0a3bf497161c6fab9b485d408e3790add7b0983
Instruction ID: 7ed7fb5c68138083f1ce577c721b7aabe37c98815331cd6e800df862d63b0355
Opcode Fuzzy Hash: 5e1a2ce493a3e69463c71067a0a3bf497161c6fab9b485d408e3790add7b0983
Instruction Fuzzy Hash: 2D81BC75E10600DBF714DF64EC86ABA37F9FB44312B004429E90EE62A1E73C99C1CB56

Function 000690F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00058146,00000000,?,?,?,?,?,0004F85A,?,?,?,00069573), ref: 00069143
RtlReAllocateHeap.NTDLL(00000000,?,00058146,00000000), ref: 0006914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00058146,00000000,?,?,?,?,?,0004F85A,?,?,?,00069573,?), ref: 00069174
HeapAlloc.KERNEL32(00000000,?,00058146,00000000,?,?,?,?,?,0004F85A,?,?,?,00069573,?,00000001), ref: 0006917B

Memory Dump Source

Source File: 0000000B.00000002.3197050507.0000000000041000.00000020.00000001.01000000.00000007.sdmp, Offset: 00040000, based on PE: true

Associated: 0000000B.00000002.3197034305.0000000000040000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197105644.000000000006F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197124907.0000000000070000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197143695.0000000000073000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3197159676.000000000007C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40000_xxxniijvj.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 231cd8dcfe27ee2d212168d71e76c0708fdc46757f4a47f8e2894c3d1d43f31f
Instruction ID: 61fc5e31dc81f031c21b943c3ba2da40ff67569a057049aab41b773dd5131bb2
Opcode Fuzzy Hash: 231cd8dcfe27ee2d212168d71e76c0708fdc46757f4a47f8e2894c3d1d43f31f
Instruction Fuzzy Hash: 50010C75940604EFFB449F54FC4966537A5FB08302F444015F91EA6662EBBDA4D08B51

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7qBBKk0P4l.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\hjflhukc\hhziccmdjsti

C:\hjflhukc\hhziccmdjsti

C:\hjflhukc\psjpq2s5tgtsjq0yguk.exe

C:\hjflhukc\xxxniijvj.exe

C:\hjflhukc\yanidfx.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
7qBBKk0P4l.exe

Function 00AE88A8 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 877
fileCOMMON

Function 00AFFF2A Relevance: 19.9, APIs: 6, Strings: 5, Instructions: 627
COMMON

Function 00AF111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289
fileCOMMON

Function 00AE5C39 Relevance: 7.7, APIs: 5, Instructions: 247
filesleepCOMMON

Function 00AEE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Function 00AEDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Function 00AF54A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108
processCOMMON

Function 00AF54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Function 00AEC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Function 00AF20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Function 00B023A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Function 00AF15E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre